diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed42/config.yaml b/artifacts/route_comparison/baseline_ciciot2023_seed42/config.yaml new file mode 100644 index 0000000..caaef7c --- /dev/null +++ b/artifacts/route_comparison/baseline_ciciot2023_seed42/config.yaml @@ -0,0 +1,38 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 42 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_flow: 0.3 +lambda_packet: 0.3 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packet_mask_ratio: 0.5 +packet_preprocess: mixed_dequant +reference_mode: null +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed42 +seed: 42 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed42/history.json b/artifacts/route_comparison/baseline_ciciot2023_seed42/history.json new file mode 100644 index 0000000..3f12cbd --- /dev/null +++ b/artifacts/route_comparison/baseline_ciciot2023_seed42/history.json @@ -0,0 +1,243 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 2.238484724974021, + 1.8185321612235827, + 1.5694421652035835, + 1.4087621432084303, + 1.2802610947535589, + 1.1938801652345903, + 1.1530314546365004, + 1.1122528880070417, + 1.078464151957096, + 1.0582786691494477, + 1.0316591690748165, + 1.0144523366903648, + 1.0529242142652855, + 0.9896519994124388, + 0.9754727391096262, + 0.9706255992253622, + 0.9741136722075634, + 0.9865069588025411, + 0.9677906938088245, + 0.9452652243467478, + 0.9449864794046451, + 0.9600389385834719, + 0.9319891318296775, + 0.9258378530159975, + 0.9202344417572021, + 0.924770115277706, + 0.9080082728312566, + 0.9161710937817892, + 0.9036619051908835, + 0.9133531130277194, + 0.9049287820473696, + 0.9109944227414254, + 0.901113204466991, + 0.9060565202664106, + 0.8893112234580212, + 0.884432274561662, + 0.8819552537722465, + 0.8883787133754828, + 0.8901151204720522, + 0.8866420097840138, + 0.8883571181541834, + 0.8856784028884692, + 0.8709982587740972, + 0.8824056555063297, + 0.8767944207558265, + 0.8775220131262754, + 0.877884797560863, + 0.8735333589407114, + 0.8781453523880396, + 0.8738587162433527 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.79407765, + "auroc_curvature_flow": 0.15714608, + "auroc_curvature_packet": 0.2038064525, + "auroc_curvature_total": 0.1068776625, + "auroc_kappa2_speed2norm_packet_mean": 0.13401841, + "auroc_kappa2_speed2norm_packet_median": 0.1318591025, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.12739881, + "auroc_kinetic_energy": 0.7742252599999999, + "auroc_kinetic_flow": 0.7552203875, + "auroc_kinetic_packet": 0.7979296899999999, + "auroc_terminal_flow": 0.9368992, + "auroc_terminal_norm": 0.9527770775, + "auroc_terminal_packet": 0.927169855, + "auroc_velocity_flow": 0.8290729225, + "auroc_velocity_packet": 0.8840924375, + "auroc_velocity_total": 0.8987191 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.922707725, + "auroc_curvature_flow": 0.28839765, + "auroc_curvature_packet": 0.67098521, + "auroc_curvature_total": 0.58685538, + "auroc_kappa2_speed2norm_packet_mean": 0.59119754, + "auroc_kappa2_speed2norm_packet_median": 0.5961876800000001, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.595088985, + "auroc_kinetic_energy": 0.9240453074999999, + "auroc_kinetic_flow": 0.8633862675, + "auroc_kinetic_packet": 0.866862925, + "auroc_terminal_flow": 0.9507568899999999, + "auroc_terminal_norm": 0.960393865, + "auroc_terminal_packet": 0.9406175125, + "auroc_velocity_flow": 0.8536202575, + "auroc_velocity_packet": 0.86155299, + "auroc_velocity_total": 0.8947056325 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.931072335, + "auroc_curvature_flow": 0.2290959125, + "auroc_curvature_packet": 0.6883449424999999, + "auroc_curvature_total": 0.5377353225, + "auroc_kappa2_speed2norm_packet_mean": 0.32323636, + "auroc_kappa2_speed2norm_packet_median": 0.3233789775, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.3171084325, + "auroc_kinetic_energy": 0.9311031274999999, + "auroc_kinetic_flow": 0.8738844175, + "auroc_kinetic_packet": 0.899137655, + "auroc_terminal_flow": 0.9482941475, + "auroc_terminal_norm": 0.9588114600000001, + "auroc_terminal_packet": 0.9410277425, + "auroc_velocity_flow": 0.83529879, + "auroc_velocity_packet": 0.88076889, + "auroc_velocity_total": 0.9019990474999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9402365175, + "auroc_curvature_flow": 0.42293543000000006, + "auroc_curvature_packet": 0.8347149700000001, + "auroc_curvature_total": 0.7646005800000001, + "auroc_kappa2_speed2norm_packet_mean": 0.601222045, + "auroc_kappa2_speed2norm_packet_median": 0.589868305, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.599252635, + "auroc_kinetic_energy": 0.9404652225000001, + "auroc_kinetic_flow": 0.8897583250000001, + "auroc_kinetic_packet": 0.9208423849999999, + "auroc_terminal_flow": 0.941909435, + "auroc_terminal_norm": 0.9631979500000001, + "auroc_terminal_packet": 0.9569458550000001, + "auroc_velocity_flow": 0.86892876, + "auroc_velocity_packet": 0.88417203, + "auroc_velocity_total": 0.9073885924999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9454752249999999, + "auroc_curvature_flow": 0.5339493325, + "auroc_curvature_packet": 0.8753622025000001, + "auroc_curvature_total": 0.8370682250000001, + "auroc_kappa2_speed2norm_packet_mean": 0.5704927049999999, + "auroc_kappa2_speed2norm_packet_median": 0.56995154, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.57063048, + "auroc_kinetic_energy": 0.9457943750000001, + "auroc_kinetic_flow": 0.8932741250000001, + "auroc_kinetic_packet": 0.9334533075, + "auroc_terminal_flow": 0.94798644, + "auroc_terminal_norm": 0.96389727, + "auroc_terminal_packet": 0.95557592, + "auroc_velocity_flow": 0.8700007175, + "auroc_velocity_packet": 0.8949090625, + "auroc_velocity_total": 0.9097327275000001 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed42/model.pt b/artifacts/route_comparison/baseline_ciciot2023_seed42/model.pt new file mode 100644 index 0000000..7d7ef46 Binary files /dev/null and b/artifacts/route_comparison/baseline_ciciot2023_seed42/model.pt differ diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed42/phase1.log b/artifacts/route_comparison/baseline_ciciot2023_seed42/phase1.log new file mode 100644 index 0000000..abbc854 --- /dev/null +++ b/artifacts/route_comparison/baseline_ciciot2023_seed42/phase1.log @@ -0,0 +1,134 @@ +[config] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed42/config.yaml +[model] T=64 flow_dim=20 packet_dim=9 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets_source=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] using external flow features D=20 +[data] rows total=8,193,621 keep len>=2: 3,797,530 +[data] benign=97,045 attack=20,000 -> train=77,636 val=10,000 +[data] train=77,636 val=10,000 attack=20,000 +[eval] scoring val=5,000 and attack=10,000 +/home/chy/mambafortrafficmodeling/.venv/lib/python3.14/site-packages/torch/autograd/graph.py:869: UserWarning: Attempting to run cuBLAS, but there was no current CUDA context! Attempting to set the primary context... (Triggered internally at /pytorch/aten/src/ATen/cuda/CublasHandlePool.cpp:335.) + return Variable._execution_engine.run_backward( # Calls into the C++ engine to run the backward pass +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done in 12.3s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] attack done in 23.2s +[eval] score keys: 57 first 5: ['arc_length', 'causal_surprisal_flow', 'causal_surprisal_packet_max', 'causal_surprisal_packet_mean', 'causal_surprisal_packet_median'] +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed42/phase1_summary.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed42/phase1_scores.npz + +=== overall AUROC (sorted desc) === + terminal_norm AUROC=0.9635 AUPRC=0.9837 + terminal_packet AUROC=0.9570 AUPRC=0.9816 + kinetic_energy AUROC=0.9504 AUPRC=0.9738 + arc_length AUROC=0.9501 AUPRC=0.9733 + terminal_flow AUROC=0.9461 AUPRC=0.9694 + kinetic_packet AUROC=0.9414 AUPRC=0.9753 + velocity_total_t09 AUROC=0.9226 AUPRC=0.9338 + velocity_packet_t09 AUROC=0.9123 AUPRC=0.9519 + velocity_total AUROC=0.9115 AUPRC=0.9249 + velocity_total_t07 AUROC=0.9110 AUPRC=0.9277 + velocity_total_t10 AUROC=0.9100 AUPRC=0.9230 + velocity_packet AUROC=0.8957 AUPRC=0.9414 + kinetic_flow AUROC=0.8948 AUPRC=0.8972 + velocity_total_t05 AUROC=0.8938 AUPRC=0.9153 + velocity_packet_t05 AUROC=0.8865 AUPRC=0.9297 + velocity_total_t03 AUROC=0.8861 AUPRC=0.9097 + velocity_packet_t03 AUROC=0.8850 AUPRC=0.9218 + velocity_packet_t07 AUROC=0.8846 AUPRC=0.9377 + velocity_packet_t01 AUROC=0.8832 AUPRC=0.9171 + velocity_total_t01 AUROC=0.8830 AUPRC=0.9077 + velocity_flow_t09 AUROC=0.8742 AUPRC=0.8753 + velocity_flow AUROC=0.8723 AUPRC=0.8756 + velocity_flow_t07 AUROC=0.8716 AUPRC=0.8778 + velocity_flow_t05 AUROC=0.8711 AUPRC=0.8820 + velocity_flow_t03 AUROC=0.8703 AUPRC=0.8864 + velocity_flow_t10 AUROC=0.8688 AUPRC=0.8709 + consistency_total AUROC=0.8659 AUPRC=0.9209 + curvature_packet AUROC=0.8659 AUPRC=0.9234 + velocity_packet_t10 AUROC=0.8588 AUPRC=0.9252 + velocity_flow_t01 AUROC=0.8586 AUPRC=0.8845 + flow_consistency AUROC=0.8451 AUPRC=0.9064 + packet_consistency AUROC=0.8326 AUPRC=0.9114 + curvature_total AUROC=0.7999 AUPRC=0.8760 + jacobian_packet AUROC=0.6982 AUPRC=0.8428 + pna_packet_max AUROC=0.5744 AUPRC=0.6995 + causal_surprisal_packet_max AUROC=0.5641 AUPRC=0.6608 + causal_surprisal_total AUROC=0.5376 AUPRC=0.6923 + causal_surprisal_flow AUROC=0.5158 AUPRC=0.6397 + causal_surprisal_packet_mean AUROC=0.5131 AUPRC=0.6309 + kappa2_speed2norm_packet_mean AUROC=0.4788 AUPRC=0.6621 + pna_packet_mean AUROC=0.4788 AUPRC=0.6621 + causal_surprisal_packet_median AUROC=0.4764 AUPRC=0.6796 + kappa2_speed2norm_packet_median AUROC=0.4694 AUPRC=0.6703 + pna_packet_median AUROC=0.4694 AUPRC=0.6703 + kappa2_speed2norm_packet_trimmed10_mean AUROC=0.4679 AUPRC=0.6646 + pna_packet_trimmed10_mean AUROC=0.4679 AUPRC=0.6646 + causal_surprisal_packet_trimmed10_mean AUROC=0.4637 AUPRC=0.6437 + jacobian_total AUROC=0.4197 AUPRC=0.6798 + curvature_flow AUROC=0.3684 AUPRC=0.5799 + direction_drift_packet_max AUROC=0.2468 AUPRC=0.5402 + jacobian_flow AUROC=0.1880 AUPRC=0.4977 + direction_drift_packet_trimmed10_mean AUROC=0.1338 AUPRC=0.4820 + direction_drift_packet_median AUROC=0.1317 AUPRC=0.4807 + direction_drift_packet_mean AUROC=0.1303 AUPRC=0.4801 + direction_drift_flow AUROC=0.1162 AUPRC=0.4734 + direction_drift_total AUROC=0.0884 AUPRC=0.4656 + pna_flow AUROC=0.0792 AUPRC=0.4649 diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed42/phase1_scores.npz b/artifacts/route_comparison/baseline_ciciot2023_seed42/phase1_scores.npz new file mode 100644 index 0000000..7c60c58 Binary files /dev/null and b/artifacts/route_comparison/baseline_ciciot2023_seed42/phase1_scores.npz differ diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed42/phase1_summary.json b/artifacts/route_comparison/baseline_ciciot2023_seed42/phase1_summary.json new file mode 100644 index 0000000..02d00c1 --- /dev/null +++ b/artifacts/route_comparison/baseline_ciciot2023_seed42/phase1_summary.json @@ -0,0 +1,2232 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed42", + "config": { + "T": 64, + "attack_cap": 20000, + "batch_size": 256, + "benign_label": "normal", + "d_model": 128, + "data_seed": 42, + "device": "auto", + "epochs": 50, + "eval_batch_size": 512, + "eval_every": 10, + "eval_n": 20000, + "eval_n_steps": 8, + "flow_features_align": "auto", + "flow_features_path": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet", + "flows_parquet": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet", + "grad_clip": 1.0, + "lambda_flow": 0.3, + "lambda_packet": 0.3, + "lr": 0.0003, + "min_len": 2, + "mlp_ratio": 4.0, + "n_heads": 4, + "n_layers": 4, + "n_train": 10000, + "num_workers": 0, + "packet_mask_ratio": 0.5, + "packet_preprocess": "mixed_dequant", + "reference_mode": null, + "save_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed42", + "seed": 42, + "sigma": 0.1, + "source_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "time_dim": 64, + "token_dim": null, + "train_ratio": 0.8, + "use_ot": true, + "val_cap": 10000, + "weight_decay": 0.01 + }, + "n_val": 5000, + "n_atk": 10000, + "n_score_keys": 57, + "overall": { + "arc_length": { + "auroc": 0.95010225, + "auprc": 0.9733037781841916 + }, + "causal_surprisal_flow": { + "auroc": 0.51577956, + "auprc": 0.639723032333495 + }, + "causal_surprisal_packet_max": { + "auroc": 0.56408748, + "auprc": 0.6608088092015394 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.51311433, + "auprc": 0.6308645231427117 + }, + "causal_surprisal_packet_median": { + "auroc": 0.47640562000000003, + "auprc": 0.6796035180532527 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.46366103999999997, + "auprc": 0.6436878126998302 + }, + "causal_surprisal_total": { + "auroc": 0.53764018, + "auprc": 0.6923005405282634 + }, + "consistency_total": { + "auroc": 0.8659437200000002, + "auprc": 0.9209229646641154 + }, + "curvature_flow": { + "auroc": 0.36838266999999997, + "auprc": 0.5799061040890843 + }, + "curvature_packet": { + "auroc": 0.8659347500000001, + "auprc": 0.9234490140314798 + }, + "curvature_total": { + "auroc": 0.7999456199999999, + "auprc": 0.8760076590489226 + }, + "direction_drift_flow": { + "auroc": 0.11622966, + "auprc": 0.473436626171269 + }, + "direction_drift_packet_max": { + "auroc": 0.24681248, + "auprc": 0.5401525406070653 + }, + "direction_drift_packet_mean": { + "auroc": 0.13033018, + "auprc": 0.48010623323414264 + }, + "direction_drift_packet_median": { + "auroc": 0.1317426, + "auprc": 0.48070029733025155 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.13384583, + "auprc": 0.48197962348685286 + }, + "direction_drift_total": { + "auroc": 0.08838002000000002, + "auprc": 0.4655688708246087 + }, + "flow_consistency": { + "auroc": 0.84505695, + "auprc": 0.9064366674199544 + }, + "jacobian_flow": { + "auroc": 0.18800138, + "auprc": 0.49769989309488616 + }, + "jacobian_packet": { + "auroc": 0.69822193, + "auprc": 0.8427533835849533 + }, + "jacobian_total": { + "auroc": 0.41967502999999995, + "auprc": 0.6798038517456344 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.47876780999999996, + "auprc": 0.6620794736406528 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.46944674999999997, + "auprc": 0.670256169706536 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.46785767000000006, + "auprc": 0.6646032619673266 + }, + "kinetic_energy": { + "auroc": 0.95038526, + "auprc": 0.9737913841415574 + }, + "kinetic_flow": { + "auroc": 0.89483914, + "auprc": 0.8971828863274042 + }, + "kinetic_packet": { + "auroc": 0.9414458000000001, + "auprc": 0.9752679631025851 + }, + "packet_consistency": { + "auroc": 0.83255119, + "auprc": 0.9113621588475921 + }, + "pna_flow": { + "auroc": 0.0792145, + "auprc": 0.4648746684620224 + }, + "pna_packet_max": { + "auroc": 0.57442366, + "auprc": 0.6994634666301122 + }, + "pna_packet_mean": { + "auroc": 0.47876780999999996, + "auprc": 0.6620794736406528 + }, + "pna_packet_median": { + "auroc": 0.46944674999999997, + "auprc": 0.670256169706536 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.46785767000000006, + "auprc": 0.6646032619673266 + }, + "terminal_flow": { + "auroc": 0.94609693, + "auprc": 0.9693815759011022 + }, + "terminal_norm": { + "auroc": 0.9635469000000001, + "auprc": 0.9837164010819393 + }, + "terminal_packet": { + "auroc": 0.95698916, + "auprc": 0.9816041201621385 + }, + "velocity_flow": { + "auroc": 0.87231398, + "auprc": 0.8755830880480562 + }, + "velocity_flow_t01": { + "auroc": 0.8585841000000001, + "auprc": 0.8844914217352944 + }, + "velocity_flow_t03": { + "auroc": 0.87032037, + "auprc": 0.8863704257904561 + }, + "velocity_flow_t05": { + "auroc": 0.8710867599999998, + "auprc": 0.881962060414057 + }, + "velocity_flow_t07": { + "auroc": 0.87156409, + "auprc": 0.8777738989284353 + }, + "velocity_flow_t09": { + "auroc": 0.87416666, + "auprc": 0.8752882603806662 + }, + "velocity_flow_t10": { + "auroc": 0.86881667, + "auprc": 0.8708931603001522 + }, + "velocity_packet": { + "auroc": 0.89573376, + "auprc": 0.9414090432809483 + }, + "velocity_packet_t01": { + "auroc": 0.88321147, + "auprc": 0.9171185768015653 + }, + "velocity_packet_t03": { + "auroc": 0.88495022, + "auprc": 0.9218012619192215 + }, + "velocity_packet_t05": { + "auroc": 0.8864741, + "auprc": 0.9297115500570716 + }, + "velocity_packet_t07": { + "auroc": 0.8845657200000001, + "auprc": 0.9377049315680877 + }, + "velocity_packet_t09": { + "auroc": 0.91233948, + "auprc": 0.9519472439708292 + }, + "velocity_packet_t10": { + "auroc": 0.8587787499999999, + "auprc": 0.9252398226609502 + }, + "velocity_total": { + "auroc": 0.9115093399999998, + "auprc": 0.9248941807959392 + }, + "velocity_total_t01": { + "auroc": 0.88298736, + "auprc": 0.9076886029067686 + }, + "velocity_total_t03": { + "auroc": 0.8860948800000001, + "auprc": 0.9097249062164703 + }, + "velocity_total_t05": { + "auroc": 0.8937945, + "auprc": 0.9152886074892558 + }, + "velocity_total_t07": { + "auroc": 0.9110355600000001, + "auprc": 0.927744101466674 + }, + "velocity_total_t09": { + "auroc": 0.92259292, + "auprc": 0.9338059853712932 + }, + "velocity_total_t10": { + "auroc": 0.9099640900000001, + "auprc": 0.9230409774782189 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 9.0, + "arc_length": 0.8651333333333333, + "causal_surprisal_flow": 0.6165111111111111, + "causal_surprisal_packet_max": 0.5444222222222221, + "causal_surprisal_packet_mean": 0.3737111111111111, + "causal_surprisal_packet_median": 0.2868666666666666, + "causal_surprisal_packet_trimmed10_mean": 0.31306666666666666, + "causal_surprisal_total": 0.4228666666666666, + "consistency_total": 0.6983111111111111, + "curvature_flow": 0.7310888888888889, + "curvature_packet": 0.6777555555555556, + "curvature_total": 0.7188444444444444, + "direction_drift_flow": 0.11106666666666665, + "direction_drift_packet_max": 0.3974, + "direction_drift_packet_mean": 0.1413111111111111, + "direction_drift_packet_median": 0.1866222222222222, + "direction_drift_packet_trimmed10_mean": 0.14737777777777777, + "direction_drift_total": 0.13053333333333333, + "flow_consistency": 0.6919333333333333, + "jacobian_flow": 0.13942222222222223, + "jacobian_packet": 0.3383555555555555, + "jacobian_total": 0.17977777777777781, + "kappa2_speed2norm_packet_mean": 0.5386666666666666, + "kappa2_speed2norm_packet_median": 0.5331111111111111, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5455555555555556, + "kinetic_energy": 0.8619333333333333, + "kinetic_flow": 0.9027999999999999, + "kinetic_packet": 0.6597555555555555, + "packet_consistency": 0.6685555555555556, + "pna_flow": 0.16784444444444446, + "pna_packet_max": 0.5911333333333333, + "pna_packet_mean": 0.5386666666666666, + "pna_packet_median": 0.5331111111111111, + "pna_packet_trimmed10_mean": 0.5455555555555556, + "terminal_flow": 0.8595111111111111, + "terminal_norm": 0.8319555555555556, + "terminal_packet": 0.7580888888888889, + "velocity_flow": 0.8899111111111111, + "velocity_flow_t01": 0.8869555555555555, + "velocity_flow_t03": 0.8851333333333333, + "velocity_flow_t05": 0.8813333333333334, + "velocity_flow_t07": 0.8817999999999999, + "velocity_flow_t09": 0.9012444444444444, + "velocity_flow_t10": 0.8992222222222221, + "velocity_packet": 0.7915555555555556, + "velocity_packet_t01": 0.8330444444444446, + "velocity_packet_t03": 0.8386444444444444, + "velocity_packet_t05": 0.8218444444444445, + "velocity_packet_t07": 0.7957333333333333, + "velocity_packet_t09": 0.8206444444444444, + "velocity_packet_t10": 0.7599999999999999, + "velocity_total": 0.8782666666666666, + "velocity_total_t01": 0.8524888888888889, + "velocity_total_t03": 0.865, + "velocity_total_t05": 0.8711777777777777, + "velocity_total_t07": 0.8743555555555556, + "velocity_total_t09": 0.8944666666666666, + "velocity_total_t10": 0.8879111111111111 + }, + "commandinjection": { + "_n": 11.0, + "arc_length": 0.7830727272727273, + "causal_surprisal_flow": 0.5575818181818182, + "causal_surprisal_packet_max": 0.4102181818181817, + "causal_surprisal_packet_mean": 0.37130909090909087, + "causal_surprisal_packet_median": 0.3244909090909091, + "causal_surprisal_packet_trimmed10_mean": 0.34958181818181816, + "causal_surprisal_total": 0.4984727272727273, + "consistency_total": 0.6354, + "curvature_flow": 0.5990545454545455, + "curvature_packet": 0.6005636363636364, + "curvature_total": 0.6092181818181819, + "direction_drift_flow": 0.14550909090909092, + "direction_drift_packet_max": 0.30983636363636363, + "direction_drift_packet_mean": 0.22694545454545453, + "direction_drift_packet_median": 0.27087272727272727, + "direction_drift_packet_trimmed10_mean": 0.23327272727272727, + "direction_drift_total": 0.15874545454545455, + "flow_consistency": 0.6612363636363637, + "jacobian_flow": 0.33761818181818176, + "jacobian_packet": 0.4713636363636363, + "jacobian_total": 0.4675454545454546, + "kappa2_speed2norm_packet_mean": 0.4723090909090909, + "kappa2_speed2norm_packet_median": 0.4844727272727273, + "kappa2_speed2norm_packet_trimmed10_mean": 0.49681818181818177, + "kinetic_energy": 0.7835818181818182, + "kinetic_flow": 0.7600727272727272, + "kinetic_packet": 0.7737454545454545, + "packet_consistency": 0.43940000000000007, + "pna_flow": 0.17432727272727275, + "pna_packet_max": 0.4134, + "pna_packet_mean": 0.4723090909090909, + "pna_packet_median": 0.4844727272727273, + "pna_packet_trimmed10_mean": 0.49681818181818177, + "terminal_flow": 0.8568181818181818, + "terminal_norm": 0.8047272727272727, + "terminal_packet": 0.6971818181818181, + "velocity_flow": 0.7662727272727272, + "velocity_flow_t01": 0.6565272727272726, + "velocity_flow_t03": 0.6752363636363636, + "velocity_flow_t05": 0.709090909090909, + "velocity_flow_t07": 0.7211454545454545, + "velocity_flow_t09": 0.7790181818181819, + "velocity_flow_t10": 0.8100727272727273, + "velocity_packet": 0.6957818181818182, + "velocity_packet_t01": 0.6424181818181819, + "velocity_packet_t03": 0.6263272727272727, + "velocity_packet_t05": 0.6226363636363637, + "velocity_packet_t07": 0.6130909090909091, + "velocity_packet_t09": 0.6831818181818181, + "velocity_packet_t10": 0.7414727272727273, + "velocity_total": 0.7720727272727272, + "velocity_total_t01": 0.6768545454545454, + "velocity_total_t03": 0.7002727272727273, + "velocity_total_t05": 0.6999272727272727, + "velocity_total_t07": 0.7142363636363636, + "velocity_total_t09": 0.7944545454545455, + "velocity_total_t10": 0.8341090909090909 + }, + "ddos-ack_fragmentation": { + "_n": 310.0, + "arc_length": 0.9804929032258064, + "causal_surprisal_flow": 0.17800322580645161, + "causal_surprisal_packet_max": 0.3570748387096774, + "causal_surprisal_packet_mean": 0.2729509677419355, + "causal_surprisal_packet_median": 0.3485129032258064, + "causal_surprisal_packet_trimmed10_mean": 0.29093741935483874, + "causal_surprisal_total": 0.1776874193548387, + "consistency_total": 0.9209296774193548, + "curvature_flow": 0.20967612903225807, + "curvature_packet": 0.954138064516129, + "curvature_total": 0.8260503225806451, + "direction_drift_flow": 0.09827548387096774, + "direction_drift_packet_max": 0.18962161290322582, + "direction_drift_packet_mean": 0.12254516129032257, + "direction_drift_packet_median": 0.1362916129032258, + "direction_drift_packet_trimmed10_mean": 0.13947032258064515, + "direction_drift_total": 0.05002322580645161, + "flow_consistency": 0.793841935483871, + "jacobian_flow": 0.04602451612903226, + "jacobian_packet": 0.9324380645161291, + "jacobian_total": 0.46806258064516126, + "kappa2_speed2norm_packet_mean": 0.2686948387096774, + "kappa2_speed2norm_packet_median": 0.2790025806451613, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2867348387096774, + "kinetic_energy": 0.9805200000000001, + "kinetic_flow": 0.9321574193548386, + "kinetic_packet": 0.9700909677419356, + "packet_consistency": 0.9693967741935483, + "pna_flow": 0.026970322580645165, + "pna_packet_max": 0.2830006451612903, + "pna_packet_mean": 0.2686948387096774, + "pna_packet_median": 0.2790025806451613, + "pna_packet_trimmed10_mean": 0.2867348387096774, + "terminal_flow": 0.9837045161290323, + "terminal_norm": 0.9861683870967741, + "terminal_packet": 0.9826070967741936, + "velocity_flow": 0.9114838709677419, + "velocity_flow_t01": 0.9474909677419354, + "velocity_flow_t03": 0.9411032258064516, + "velocity_flow_t05": 0.9277677419354838, + "velocity_flow_t07": 0.9135954838709679, + "velocity_flow_t09": 0.9068787096774193, + "velocity_flow_t10": 0.9023470967741936, + "velocity_packet": 0.9702877419354838, + "velocity_packet_t01": 0.96924, + "velocity_packet_t03": 0.9690019354838709, + "velocity_packet_t05": 0.9661329032258065, + "velocity_packet_t07": 0.9584690322580646, + "velocity_packet_t09": 0.9660238709677421, + "velocity_packet_t10": 0.9716703225806451, + "velocity_total": 0.9732567741935484, + "velocity_total_t01": 0.976672258064516, + "velocity_total_t03": 0.9759670967741936, + "velocity_total_t05": 0.9744574193548388, + "velocity_total_t07": 0.9713535483870968, + "velocity_total_t09": 0.9720064516129031, + "velocity_total_t10": 0.973903870967742 + }, + "ddos-http_flood": { + "_n": 918.0, + "arc_length": 0.9519751633986928, + "causal_surprisal_flow": 0.5366973856209151, + "causal_surprisal_packet_max": 0.5100769063180828, + "causal_surprisal_packet_mean": 0.5156281045751634, + "causal_surprisal_packet_median": 0.6546788671023964, + "causal_surprisal_packet_trimmed10_mean": 0.5306302832244009, + "causal_surprisal_total": 0.5454546840958605, + "consistency_total": 0.8193898692810458, + "curvature_flow": 0.42647995642701525, + "curvature_packet": 0.9387389978213508, + "curvature_total": 0.8988056644880175, + "direction_drift_flow": 0.13080021786492374, + "direction_drift_packet_max": 0.3433230936819172, + "direction_drift_packet_mean": 0.19189357298474946, + "direction_drift_packet_median": 0.19304607843137256, + "direction_drift_packet_trimmed10_mean": 0.19940555555555556, + "direction_drift_total": 0.09939411764705883, + "flow_consistency": 0.7845222222222221, + "jacobian_flow": 0.2982331154684096, + "jacobian_packet": 0.6519077342047931, + "jacobian_total": 0.5314492374727668, + "kappa2_speed2norm_packet_mean": 0.6476537037037038, + "kappa2_speed2norm_packet_median": 0.6544115468409585, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6613908496732026, + "kinetic_energy": 0.9524899782135077, + "kinetic_flow": 0.8754721132897604, + "kinetic_packet": 0.9558993464052288, + "packet_consistency": 0.860973311546841, + "pna_flow": 0.08466318082788672, + "pna_packet_max": 0.7151078431372548, + "pna_packet_mean": 0.6476537037037038, + "pna_packet_median": 0.6544115468409585, + "pna_packet_trimmed10_mean": 0.6613908496732026, + "terminal_flow": 0.9672705882352941, + "terminal_norm": 0.9895516339869281, + "terminal_packet": 0.9832287581699346, + "velocity_flow": 0.8658753812636166, + "velocity_flow_t01": 0.8374311546840959, + "velocity_flow_t03": 0.8494753812636165, + "velocity_flow_t05": 0.8586844226579521, + "velocity_flow_t07": 0.8660627450980392, + "velocity_flow_t09": 0.8650725490196078, + "velocity_flow_t10": 0.8619376906318084, + "velocity_packet": 0.882161220043573, + "velocity_packet_t01": 0.9091363834422659, + "velocity_packet_t03": 0.8929464052287581, + "velocity_packet_t05": 0.8679494553376906, + "velocity_packet_t07": 0.8528629629629629, + "velocity_packet_t09": 0.9233967320261438, + "velocity_packet_t10": 0.851642265795207, + "velocity_total": 0.9137191721132897, + "velocity_total_t01": 0.8668882352941177, + "velocity_total_t03": 0.868358605664488, + "velocity_total_t05": 0.8794819172113288, + "velocity_total_t07": 0.9152596949891069, + "velocity_total_t09": 0.9244945533769063, + "velocity_total_t10": 0.9055596949891067 + }, + "ddos-icmp_flood": { + "_n": 24.0, + "arc_length": 0.5958, + "causal_surprisal_flow": 0.5620666666666666, + "causal_surprisal_packet_max": 0.3806, + "causal_surprisal_packet_mean": 0.3653916666666667, + "causal_surprisal_packet_median": 0.4009083333333333, + "causal_surprisal_packet_trimmed10_mean": 0.34631666666666666, + "causal_surprisal_total": 0.5097, + "consistency_total": 0.5535583333333334, + "curvature_flow": 0.43686666666666674, + "curvature_packet": 0.4478333333333333, + "curvature_total": 0.4831083333333333, + "direction_drift_flow": 0.31117500000000003, + "direction_drift_packet_max": 0.43961666666666666, + "direction_drift_packet_mean": 0.40854999999999997, + "direction_drift_packet_median": 0.4132666666666666, + "direction_drift_packet_trimmed10_mean": 0.43685833333333324, + "direction_drift_total": 0.3504333333333333, + "flow_consistency": 0.6246916666666666, + "jacobian_flow": 0.338625, + "jacobian_packet": 0.4436583333333333, + "jacobian_total": 0.4066416666666667, + "kappa2_speed2norm_packet_mean": 0.45985833333333337, + "kappa2_speed2norm_packet_median": 0.461775, + "kappa2_speed2norm_packet_trimmed10_mean": 0.469375, + "kinetic_energy": 0.5960749999999999, + "kinetic_flow": 0.674125, + "kinetic_packet": 0.48339166666666666, + "packet_consistency": 0.3752, + "pna_flow": 0.40815, + "pna_packet_max": 0.461025, + "pna_packet_mean": 0.45985833333333337, + "pna_packet_median": 0.461775, + "pna_packet_trimmed10_mean": 0.469375, + "terminal_flow": 0.662, + "terminal_norm": 0.6056083333333333, + "terminal_packet": 0.5836166666666667, + "velocity_flow": 0.5981333333333334, + "velocity_flow_t01": 0.566125, + "velocity_flow_t03": 0.5685166666666666, + "velocity_flow_t05": 0.574025, + "velocity_flow_t07": 0.5829583333333332, + "velocity_flow_t09": 0.6013666666666667, + "velocity_flow_t10": 0.6039166666666667, + "velocity_packet": 0.47454166666666664, + "velocity_packet_t01": 0.5180750000000001, + "velocity_packet_t03": 0.4976916666666666, + "velocity_packet_t05": 0.5001583333333333, + "velocity_packet_t07": 0.4839416666666666, + "velocity_packet_t09": 0.5044583333333333, + "velocity_packet_t10": 0.47375, + "velocity_total": 0.5257583333333333, + "velocity_total_t01": 0.534425, + "velocity_total_t03": 0.530475, + "velocity_total_t05": 0.5297, + "velocity_total_t07": 0.5345500000000001, + "velocity_total_t09": 0.5582666666666667, + "velocity_total_t10": 0.5483583333333333 + }, + "ddos-icmp_fragmentation": { + "_n": 37.0, + "arc_length": 0.7692270270270272, + "causal_surprisal_flow": 0.5880702702702704, + "causal_surprisal_packet_max": 0.4525567567567568, + "causal_surprisal_packet_mean": 0.4170270270270271, + "causal_surprisal_packet_median": 0.4510540540540541, + "causal_surprisal_packet_trimmed10_mean": 0.4060972972972974, + "causal_surprisal_total": 0.5572540540540541, + "consistency_total": 0.6425081081081082, + "curvature_flow": 0.3721189189189189, + "curvature_packet": 0.6371567567567568, + "curvature_total": 0.6230648648648649, + "direction_drift_flow": 0.1592, + "direction_drift_packet_max": 0.4418972972972973, + "direction_drift_packet_mean": 0.4027081081081081, + "direction_drift_packet_median": 0.41036756756756754, + "direction_drift_packet_trimmed10_mean": 0.4290864864864865, + "direction_drift_total": 0.30805945945945945, + "flow_consistency": 0.6838432432432433, + "jacobian_flow": 0.27578918918918927, + "jacobian_packet": 0.3918216216216216, + "jacobian_total": 0.3697621621621622, + "kappa2_speed2norm_packet_mean": 0.5785297297297297, + "kappa2_speed2norm_packet_median": 0.5593378378378379, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5883513513513513, + "kinetic_energy": 0.7690972972972974, + "kinetic_flow": 0.7449189189189189, + "kinetic_packet": 0.6438, + "packet_consistency": 0.4554864864864865, + "pna_flow": 0.16896756756756756, + "pna_packet_max": 0.5632216216216217, + "pna_packet_mean": 0.5785297297297297, + "pna_packet_median": 0.5593378378378379, + "pna_packet_trimmed10_mean": 0.5883513513513513, + "terminal_flow": 0.8200594594594594, + "terminal_norm": 0.8289891891891892, + "terminal_packet": 0.7845567567567567, + "velocity_flow": 0.755281081081081, + "velocity_flow_t01": 0.7036486486486486, + "velocity_flow_t03": 0.7112324324324325, + "velocity_flow_t05": 0.7246486486486486, + "velocity_flow_t07": 0.7373243243243244, + "velocity_flow_t09": 0.766518918918919, + "velocity_flow_t10": 0.7778540540540541, + "velocity_packet": 0.6307621621621622, + "velocity_packet_t01": 0.7099513513513513, + "velocity_packet_t03": 0.6862324324324325, + "velocity_packet_t05": 0.6629243243243242, + "velocity_packet_t07": 0.6076594594594595, + "velocity_packet_t09": 0.6516972972972973, + "velocity_packet_t10": 0.6077027027027027, + "velocity_total": 0.7587783783783784, + "velocity_total_t01": 0.7416702702702703, + "velocity_total_t03": 0.7402918918918919, + "velocity_total_t05": 0.742908108108108, + "velocity_total_t07": 0.7467837837837837, + "velocity_total_t09": 0.7748270270270271, + "velocity_total_t10": 0.7599837837837838 + }, + "ddos-pshack_flood": { + "_n": 1030.0, + "arc_length": 0.9925792233009709, + "causal_surprisal_flow": 0.5689487378640775, + "causal_surprisal_packet_max": 0.6447798058252427, + "causal_surprisal_packet_mean": 0.5888069902912622, + "causal_surprisal_packet_median": 0.4406939805825243, + "causal_surprisal_packet_trimmed10_mean": 0.46048, + "causal_surprisal_total": 0.5922968932038835, + "consistency_total": 0.9466933980582525, + "curvature_flow": 0.37602077669902917, + "curvature_packet": 0.921385436893204, + "curvature_total": 0.8541848543689321, + "direction_drift_flow": 0.037699805825242724, + "direction_drift_packet_max": 0.04952660194174757, + "direction_drift_packet_mean": 0.012531650485436904, + "direction_drift_packet_median": 0.016484660194174758, + "direction_drift_packet_trimmed10_mean": 0.013874368932038833, + "direction_drift_total": 0.00625417475728157, + "flow_consistency": 0.920505631067961, + "jacobian_flow": 0.04019145631067961, + "jacobian_packet": 0.5939893203883495, + "jacobian_total": 0.1974966990291262, + "kappa2_speed2norm_packet_mean": 0.3195387378640776, + "kappa2_speed2norm_packet_median": 0.27054543689320387, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2698729126213592, + "kinetic_energy": 0.9927679611650485, + "kinetic_flow": 0.958291067961165, + "kinetic_packet": 0.9955563106796117, + "packet_consistency": 0.9626198058252426, + "pna_flow": 0.02386815533980583, + "pna_packet_max": 0.5161215533980582, + "pna_packet_mean": 0.3195387378640776, + "pna_packet_median": 0.27054543689320387, + "pna_packet_trimmed10_mean": 0.2698729126213592, + "terminal_flow": 0.9557951456310679, + "terminal_norm": 0.9942388349514564, + "terminal_packet": 0.9960328155339805, + "velocity_flow": 0.9385704854368931, + "velocity_flow_t01": 0.9590341747572816, + "velocity_flow_t03": 0.9568629126213593, + "velocity_flow_t05": 0.9530384466019417, + "velocity_flow_t07": 0.9445368932038836, + "velocity_flow_t09": 0.9366881553398059, + "velocity_flow_t10": 0.9313545631067961, + "velocity_packet": 0.9858184466019417, + "velocity_packet_t01": 0.9660099029126213, + "velocity_packet_t03": 0.9706920388349515, + "velocity_packet_t05": 0.9804038834951455, + "velocity_packet_t07": 0.9880759223300971, + "velocity_packet_t09": 0.989717281553398, + "velocity_packet_t10": 0.9659986407766992, + "velocity_total": 0.9777126213592234, + "velocity_total_t01": 0.9660693203883495, + "velocity_total_t03": 0.9708761165048544, + "velocity_total_t05": 0.9772333980582524, + "velocity_total_t07": 0.982091650485437, + "velocity_total_t09": 0.9786846601941748, + "velocity_total_t10": 0.9682273786407767 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "arc_length": 0.5803, + "causal_surprisal_flow": 0.9838, + "causal_surprisal_packet_max": 0.9465, + "causal_surprisal_packet_mean": 0.5996, + "causal_surprisal_packet_median": 0.2635, + "causal_surprisal_packet_trimmed10_mean": 0.4292, + "causal_surprisal_total": 0.6736, + "consistency_total": 0.7735000000000001, + "curvature_flow": 0.9561, + "curvature_packet": 0.8256000000000001, + "curvature_total": 0.8613, + "direction_drift_flow": 0.058099999999999985, + "direction_drift_packet_max": 0.7893000000000001, + "direction_drift_packet_mean": 0.3011, + "direction_drift_packet_median": 0.2535, + "direction_drift_packet_trimmed10_mean": 0.2677, + "direction_drift_total": 0.3792, + "flow_consistency": 0.6026999999999999, + "jacobian_flow": 0.00880000000000003, + "jacobian_packet": 0.018799999999999983, + "jacobian_total": 0.012799999999999978, + "kappa2_speed2norm_packet_mean": 0.7389, + "kappa2_speed2norm_packet_median": 0.6671, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7529, + "kinetic_energy": 0.5743, + "kinetic_flow": 0.9698, + "kinetic_packet": 0.49539999999999995, + "packet_consistency": 0.7248, + "pna_flow": 0.17679999999999996, + "pna_packet_max": 0.8232, + "pna_packet_mean": 0.7389, + "pna_packet_median": 0.6671, + "pna_packet_trimmed10_mean": 0.7529, + "terminal_flow": 0.9479999999999998, + "terminal_norm": 0.7923, + "terminal_packet": 0.7365, + "velocity_flow": 0.9852, + "velocity_flow_t01": 0.9523, + "velocity_flow_t03": 0.9602999999999999, + "velocity_flow_t05": 0.9722, + "velocity_flow_t07": 0.9810000000000001, + "velocity_flow_t09": 0.9884000000000001, + "velocity_flow_t10": 0.9891, + "velocity_packet": 0.9246000000000001, + "velocity_packet_t01": 0.8781, + "velocity_packet_t03": 0.8829, + "velocity_packet_t05": 0.9085, + "velocity_packet_t07": 0.9087, + "velocity_packet_t09": 0.9394, + "velocity_packet_t10": 0.8717, + "velocity_total": 0.8689, + "velocity_total_t01": 0.8410000000000001, + "velocity_total_t03": 0.8325, + "velocity_total_t05": 0.8422000000000001, + "velocity_total_t07": 0.859, + "velocity_total_t09": 0.8938, + "velocity_total_t10": 0.8966000000000001 + }, + "ddos-slowloris": { + "_n": 304.0, + "arc_length": 0.8814776315789473, + "causal_surprisal_flow": 0.7897605263157894, + "causal_surprisal_packet_max": 0.7478467105263158, + "causal_surprisal_packet_mean": 0.7813006578947368, + "causal_surprisal_packet_median": 0.8030546052631579, + "causal_surprisal_packet_trimmed10_mean": 0.7580026315789474, + "causal_surprisal_total": 0.7666782894736842, + "consistency_total": 0.8804960526315788, + "curvature_flow": 0.41591578947368424, + "curvature_packet": 0.8718625000000001, + "curvature_total": 0.8318243421052632, + "direction_drift_flow": 0.16524440789473685, + "direction_drift_packet_max": 0.624132894736842, + "direction_drift_packet_mean": 0.3078427631578947, + "direction_drift_packet_median": 0.2823582236842105, + "direction_drift_packet_trimmed10_mean": 0.2567796052631579, + "direction_drift_total": 0.2862697368421052, + "flow_consistency": 0.8686815789473683, + "jacobian_flow": 0.21295361842105262, + "jacobian_packet": 0.2210924342105263, + "jacobian_total": 0.19342302631578945, + "kappa2_speed2norm_packet_mean": 0.7420565789473683, + "kappa2_speed2norm_packet_median": 0.7132565789473684, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7051973684210527, + "kinetic_energy": 0.8808184210526318, + "kinetic_flow": 0.8861585526315789, + "kinetic_packet": 0.8270052631578946, + "packet_consistency": 0.7778898026315789, + "pna_flow": 0.07615197368421052, + "pna_packet_max": 0.8062671052631578, + "pna_packet_mean": 0.7420565789473683, + "pna_packet_median": 0.7132565789473684, + "pna_packet_trimmed10_mean": 0.7051973684210527, + "terminal_flow": 0.9403901315789474, + "terminal_norm": 0.9461348684210527, + "terminal_packet": 0.9261348684210527, + "velocity_flow": 0.8553986842105262, + "velocity_flow_t01": 0.8200434210526315, + "velocity_flow_t03": 0.8305355263157894, + "velocity_flow_t05": 0.8386993421052632, + "velocity_flow_t07": 0.8477842105263157, + "velocity_flow_t09": 0.8663631578947368, + "velocity_flow_t10": 0.8732881578947368, + "velocity_packet": 0.8551138157894738, + "velocity_packet_t01": 0.8923276315789472, + "velocity_packet_t03": 0.8926592105263158, + "velocity_packet_t05": 0.8874138157894738, + "velocity_packet_t07": 0.8491039473684211, + "velocity_packet_t09": 0.8436052631578947, + "velocity_packet_t10": 0.7415302631578947, + "velocity_total": 0.8614052631578948, + "velocity_total_t01": 0.8402157894736842, + "velocity_total_t03": 0.8471967105263157, + "velocity_total_t05": 0.8577059210526314, + "velocity_total_t07": 0.8637414473684211, + "velocity_total_t09": 0.8660703947368421, + "velocity_total_t10": 0.854625 + }, + "ddos-syn_flood": { + "_n": 1195.0, + "arc_length": 0.9834408368200835, + "causal_surprisal_flow": 0.5707864435146444, + "causal_surprisal_packet_max": 0.6224948953974895, + "causal_surprisal_packet_mean": 0.5083524686192469, + "causal_surprisal_packet_median": 0.1766739748953975, + "causal_surprisal_packet_trimmed10_mean": 0.28260853556485355, + "causal_surprisal_total": 0.5820011715481173, + "consistency_total": 0.9463210041841005, + "curvature_flow": 0.27203062761506275, + "curvature_packet": 0.8490868619246862, + "curvature_total": 0.7404588284518828, + "direction_drift_flow": 0.10981581589958159, + "direction_drift_packet_max": 0.053351631799163184, + "direction_drift_packet_mean": 0.02009757322175733, + "direction_drift_packet_median": 0.02435991631799164, + "direction_drift_packet_trimmed10_mean": 0.02149004184100419, + "direction_drift_total": 0.012121338912133895, + "flow_consistency": 0.9220217573221757, + "jacobian_flow": 0.04979698744769875, + "jacobian_packet": 0.7326838493723848, + "jacobian_total": 0.2230634309623431, + "kappa2_speed2norm_packet_mean": 0.347707949790795, + "kappa2_speed2norm_packet_median": 0.34013589958158996, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3109234309623431, + "kinetic_energy": 0.9837760669456066, + "kinetic_flow": 0.9312498744769874, + "kinetic_packet": 0.9887544769874478, + "packet_consistency": 0.9354558995815899, + "pna_flow": 0.025599330543933048, + "pna_packet_max": 0.42510410041841007, + "pna_packet_mean": 0.347707949790795, + "pna_packet_median": 0.34013589958158996, + "pna_packet_trimmed10_mean": 0.3109234309623431, + "terminal_flow": 0.9908085355648535, + "terminal_norm": 0.9962535564853556, + "terminal_packet": 0.9941805857740584, + "velocity_flow": 0.9121969874476987, + "velocity_flow_t01": 0.9481872803347281, + "velocity_flow_t03": 0.9439046025104602, + "velocity_flow_t05": 0.9263469456066946, + "velocity_flow_t07": 0.9141119665271966, + "velocity_flow_t09": 0.90218410041841, + "velocity_flow_t10": 0.8909479497907951, + "velocity_packet": 0.966302259414226, + "velocity_packet_t01": 0.9502418410041841, + "velocity_packet_t03": 0.9554927196652718, + "velocity_packet_t05": 0.9650602510460252, + "velocity_packet_t07": 0.9726709623430962, + "velocity_packet_t09": 0.9758033472803349, + "velocity_packet_t10": 0.8898883682008368, + "velocity_total": 0.9535998326359832, + "velocity_total_t01": 0.9478213389121338, + "velocity_total_t03": 0.9491620083682007, + "velocity_total_t05": 0.9548970711297071, + "velocity_total_t07": 0.9575956485355648, + "velocity_total_t09": 0.9606502092050209, + "velocity_total_t10": 0.9421188284518829 + }, + "ddos-synonymousip_flood": { + "_n": 164.0, + "arc_length": 0.9882256097560975, + "causal_surprisal_flow": 0.0666841463414634, + "causal_surprisal_packet_max": 0.6487036585365854, + "causal_surprisal_packet_mean": 0.41779390243902437, + "causal_surprisal_packet_median": 0.11325243902439025, + "causal_surprisal_packet_trimmed10_mean": 0.2225158536585366, + "causal_surprisal_total": 0.005148780487804877, + "consistency_total": 0.9999926829268293, + "curvature_flow": 0.0, + "curvature_packet": 0.9958573170731707, + "curvature_total": 0.9940146341463415, + "direction_drift_flow": 0.005067073170731705, + "direction_drift_packet_max": 0.6652756097560975, + "direction_drift_packet_mean": 0.4094743902439024, + "direction_drift_packet_median": 0.41390243902439017, + "direction_drift_packet_trimmed10_mean": 0.44880487804878044, + "direction_drift_total": 0.48473231707317066, + "flow_consistency": 0.9999926829268292, + "jacobian_flow": 0.0034804878048780487, + "jacobian_packet": 0.3882024390243903, + "jacobian_total": 0.1490987804878049, + "kappa2_speed2norm_packet_mean": 0.885589024390244, + "kappa2_speed2norm_packet_median": 0.9007536585365853, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9069256097560975, + "kinetic_energy": 0.9895475609756098, + "kinetic_flow": 0.8807548780487806, + "kinetic_packet": 0.9997890243902439, + "packet_consistency": 0.6540676829268293, + "pna_flow": 1.219512195121817e-06, + "pna_packet_max": 0.8398768292682927, + "pna_packet_mean": 0.885589024390244, + "pna_packet_median": 0.9007536585365853, + "pna_packet_trimmed10_mean": 0.9069256097560975, + "terminal_flow": 0.9999963414634145, + "terminal_norm": 0.9999963414634145, + "terminal_packet": 0.9998134146341463, + "velocity_flow": 0.8794182926829268, + "velocity_flow_t01": 0.8606536585365854, + "velocity_flow_t03": 0.8514048780487805, + "velocity_flow_t05": 0.8539012195121951, + "velocity_flow_t07": 0.8757841463414634, + "velocity_flow_t09": 0.8876073170731708, + "velocity_flow_t10": 0.9042036585365854, + "velocity_packet": 0.948690243902439, + "velocity_packet_t01": 0.9789829268292682, + "velocity_packet_t03": 0.9718853658536585, + "velocity_packet_t05": 0.9668134146341463, + "velocity_packet_t07": 0.9552499999999999, + "velocity_packet_t09": 0.9205365853658536, + "velocity_packet_t10": 0.7186548780487804, + "velocity_total": 0.8362195121951219, + "velocity_total_t01": 0.8703975609756097, + "velocity_total_t03": 0.8769402439024391, + "velocity_total_t05": 0.8841817073170732, + "velocity_total_t07": 0.8597353658536586, + "velocity_total_t09": 0.8354353658536585, + "velocity_total_t10": 0.735040243902439 + }, + "ddos-tcp_flood": { + "_n": 1255.0, + "arc_length": 0.9941746613545817, + "causal_surprisal_flow": 0.5588736254980079, + "causal_surprisal_packet_max": 0.6028306772908367, + "causal_surprisal_packet_mean": 0.495684780876494, + "causal_surprisal_packet_median": 0.2813018326693227, + "causal_surprisal_packet_trimmed10_mean": 0.5260793625498008, + "causal_surprisal_total": 0.5849461354581672, + "consistency_total": 0.83704406374502, + "curvature_flow": 0.24422270916334662, + "curvature_packet": 0.8071117131474104, + "curvature_total": 0.6553033466135458, + "direction_drift_flow": 0.03527665338645419, + "direction_drift_packet_max": 0.02764366533864542, + "direction_drift_packet_mean": 0.003053067729083669, + "direction_drift_packet_median": 0.00572605577689243, + "direction_drift_packet_trimmed10_mean": 0.004022151394422318, + "direction_drift_total": 0.0014621513944223221, + "flow_consistency": 0.8218197609561754, + "jacobian_flow": 0.04642310756972112, + "jacobian_packet": 0.9192704382470119, + "jacobian_total": 0.4306253386454183, + "kappa2_speed2norm_packet_mean": 0.27325163346613546, + "kappa2_speed2norm_packet_median": 0.18639027888446213, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2747763346613546, + "kinetic_energy": 0.9944323505976096, + "kinetic_flow": 0.9541792828685259, + "kinetic_packet": 0.9941168127490039, + "packet_consistency": 0.7691124302788845, + "pna_flow": 0.01517513944223106, + "pna_packet_max": 0.49016557768924307, + "pna_packet_mean": 0.27325163346613546, + "pna_packet_median": 0.18639027888446213, + "pna_packet_trimmed10_mean": 0.2747763346613546, + "terminal_flow": 0.9600086055776892, + "terminal_norm": 0.9934076494023903, + "terminal_packet": 0.9933697211155378, + "velocity_flow": 0.9329243027888446, + "velocity_flow_t01": 0.9579459760956174, + "velocity_flow_t03": 0.9543198406374501, + "velocity_flow_t05": 0.9444426294820717, + "velocity_flow_t07": 0.9364049402390437, + "velocity_flow_t09": 0.9300038247011952, + "velocity_flow_t10": 0.924603107569721, + "velocity_packet": 0.9678643824701195, + "velocity_packet_t01": 0.8919231872509961, + "velocity_packet_t03": 0.908384701195219, + "velocity_packet_t05": 0.9452725099601593, + "velocity_packet_t07": 0.975636892430279, + "velocity_packet_t09": 0.9886092430278884, + "velocity_packet_t10": 0.9378997609561753, + "velocity_total": 0.9723078884462151, + "velocity_total_t01": 0.9580122709163346, + "velocity_total_t03": 0.9604145019920319, + "velocity_total_t05": 0.9657069322709162, + "velocity_total_t07": 0.9748626294820717, + "velocity_total_t09": 0.9773564940239045, + "velocity_total_t10": 0.9672659760956176 + }, + "ddos-udp_flood": { + "_n": 15.0, + "arc_length": 0.87112, + "causal_surprisal_flow": 0.8167733333333335, + "causal_surprisal_packet_max": 0.6329733333333333, + "causal_surprisal_packet_mean": 0.30788, + "causal_surprisal_packet_median": 0.29416000000000003, + "causal_surprisal_packet_trimmed10_mean": 0.27742666666666665, + "causal_surprisal_total": 0.34712000000000004, + "consistency_total": 0.9250133333333334, + "curvature_flow": 0.33081333333333335, + "curvature_packet": 0.7814133333333333, + "curvature_total": 0.7262133333333334, + "direction_drift_flow": 0.061493333333333344, + "direction_drift_packet_max": 0.6364133333333334, + "direction_drift_packet_mean": 0.4238533333333333, + "direction_drift_packet_median": 0.42192, + "direction_drift_packet_trimmed10_mean": 0.465, + "direction_drift_total": 0.49317333333333335, + "flow_consistency": 0.93628, + "jacobian_flow": 0.09968000000000002, + "jacobian_packet": 0.19810666666666665, + "jacobian_total": 0.14970666666666668, + "kappa2_speed2norm_packet_mean": 0.7016933333333333, + "kappa2_speed2norm_packet_median": 0.6948133333333333, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7352933333333334, + "kinetic_energy": 0.8774533333333334, + "kinetic_flow": 0.95248, + "kinetic_packet": 0.8657466666666668, + "packet_consistency": 0.5899333333333333, + "pna_flow": 0.04108000000000002, + "pna_packet_max": 0.7216399999999998, + "pna_packet_mean": 0.7016933333333333, + "pna_packet_median": 0.6948133333333333, + "pna_packet_trimmed10_mean": 0.7352933333333334, + "terminal_flow": 0.98424, + "terminal_norm": 0.9753466666666667, + "terminal_packet": 0.9600133333333334, + "velocity_flow": 0.93696, + "velocity_flow_t01": 0.9115733333333333, + "velocity_flow_t03": 0.9150133333333332, + "velocity_flow_t05": 0.9239200000000001, + "velocity_flow_t07": 0.9271866666666666, + "velocity_flow_t09": 0.9363866666666666, + "velocity_flow_t10": 0.9356133333333333, + "velocity_packet": 0.65756, + "velocity_packet_t01": 0.8857733333333334, + "velocity_packet_t03": 0.8523066666666667, + "velocity_packet_t05": 0.7685866666666668, + "velocity_packet_t07": 0.6434666666666666, + "velocity_packet_t09": 0.7223599999999999, + "velocity_packet_t10": 0.5245200000000001, + "velocity_total": 0.8098, + "velocity_total_t01": 0.8587466666666667, + "velocity_total_t03": 0.8383866666666666, + "velocity_total_t05": 0.8033600000000001, + "velocity_total_t07": 0.7874533333333332, + "velocity_total_t09": 0.81924, + "velocity_total_t10": 0.7118800000000001 + }, + "ddos-udp_fragmentation": { + "_n": 21.0, + "arc_length": 0.6764666666666667, + "causal_surprisal_flow": 0.5850666666666666, + "causal_surprisal_packet_max": 0.49648571428571425, + "causal_surprisal_packet_mean": 0.4831809523809524, + "causal_surprisal_packet_median": 0.6515047619047618, + "causal_surprisal_packet_trimmed10_mean": 0.4862666666666666, + "causal_surprisal_total": 0.5546190476190477, + "consistency_total": 0.6446380952380952, + "curvature_flow": 0.37159999999999993, + "curvature_packet": 0.5774380952380952, + "curvature_total": 0.5636666666666666, + "direction_drift_flow": 0.2769238095238095, + "direction_drift_packet_max": 0.5904380952380952, + "direction_drift_packet_mean": 0.5261904761904762, + "direction_drift_packet_median": 0.5217809523809523, + "direction_drift_packet_trimmed10_mean": 0.524447619047619, + "direction_drift_total": 0.4401904761904762, + "flow_consistency": 0.6768095238095239, + "jacobian_flow": 0.21300952380952382, + "jacobian_packet": 0.5191666666666667, + "jacobian_total": 0.3716190476190476, + "kappa2_speed2norm_packet_mean": 0.5189809523809523, + "kappa2_speed2norm_packet_median": 0.516, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5268857142857142, + "kinetic_energy": 0.6783809523809523, + "kinetic_flow": 0.6961428571428572, + "kinetic_packet": 0.5376666666666666, + "packet_consistency": 0.4817142857142857, + "pna_flow": 0.3072761904761905, + "pna_packet_max": 0.5430285714285714, + "pna_packet_mean": 0.5189809523809523, + "pna_packet_median": 0.516, + "pna_packet_trimmed10_mean": 0.5268857142857142, + "terminal_flow": 0.7892190476190476, + "terminal_norm": 0.7513142857142857, + "terminal_packet": 0.6345904761904761, + "velocity_flow": 0.6694761904761904, + "velocity_flow_t01": 0.7199714285714285, + "velocity_flow_t03": 0.7235904761904761, + "velocity_flow_t05": 0.7189142857142856, + "velocity_flow_t07": 0.7104380952380952, + "velocity_flow_t09": 0.6850857142857143, + "velocity_flow_t10": 0.6445714285714286, + "velocity_packet": 0.5658285714285715, + "velocity_packet_t01": 0.6678285714285713, + "velocity_packet_t03": 0.6428857142857142, + "velocity_packet_t05": 0.6093333333333333, + "velocity_packet_t07": 0.5414380952380953, + "velocity_packet_t09": 0.5482666666666667, + "velocity_packet_t10": 0.5608571428571428, + "velocity_total": 0.6530761904761905, + "velocity_total_t01": 0.7098190476190476, + "velocity_total_t03": 0.6979809523809524, + "velocity_total_t05": 0.6859428571428572, + "velocity_total_t07": 0.6674761904761904, + "velocity_total_t09": 0.6445904761904762, + "velocity_total_t10": 0.6084761904761905 + }, + "dictionarybruteforce": { + "_n": 21.0, + "arc_length": 0.7409714285714286, + "causal_surprisal_flow": 0.7231619047619048, + "causal_surprisal_packet_max": 0.5928666666666665, + "causal_surprisal_packet_mean": 0.4993619047619048, + "causal_surprisal_packet_median": 0.5088666666666666, + "causal_surprisal_packet_trimmed10_mean": 0.49146666666666666, + "causal_surprisal_total": 0.7116761904761905, + "consistency_total": 0.7455714285714286, + "curvature_flow": 0.5420857142857143, + "curvature_packet": 0.7259428571428571, + "curvature_total": 0.762095238095238, + "direction_drift_flow": 0.15508571428571427, + "direction_drift_packet_max": 0.546695238095238, + "direction_drift_packet_mean": 0.3476380952380952, + "direction_drift_packet_median": 0.3486761904761905, + "direction_drift_packet_trimmed10_mean": 0.36358095238095234, + "direction_drift_total": 0.25235238095238094, + "flow_consistency": 0.7308380952380952, + "jacobian_flow": 0.2479047619047619, + "jacobian_packet": 0.440552380952381, + "jacobian_total": 0.40504761904761905, + "kappa2_speed2norm_packet_mean": 0.6562285714285714, + "kappa2_speed2norm_packet_median": 0.6245619047619047, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6855238095238094, + "kinetic_energy": 0.7396857142857143, + "kinetic_flow": 0.8185047619047618, + "kinetic_packet": 0.627, + "packet_consistency": 0.6082380952380951, + "pna_flow": 0.28090476190476193, + "pna_packet_max": 0.6404857142857143, + "pna_packet_mean": 0.6562285714285714, + "pna_packet_median": 0.6245619047619047, + "pna_packet_trimmed10_mean": 0.6855238095238094, + "terminal_flow": 0.8702761904761904, + "terminal_norm": 0.8011619047619047, + "terminal_packet": 0.7567142857142857, + "velocity_flow": 0.8193809523809524, + "velocity_flow_t01": 0.7909619047619048, + "velocity_flow_t03": 0.8117714285714286, + "velocity_flow_t05": 0.8168190476190476, + "velocity_flow_t07": 0.8131333333333333, + "velocity_flow_t09": 0.8204857142857143, + "velocity_flow_t10": 0.8063619047619048, + "velocity_packet": 0.7020190476190475, + "velocity_packet_t01": 0.7757904761904763, + "velocity_packet_t03": 0.7546761904761905, + "velocity_packet_t05": 0.713152380952381, + "velocity_packet_t07": 0.6612476190476191, + "velocity_packet_t09": 0.7256857142857143, + "velocity_packet_t10": 0.7468095238095238, + "velocity_total": 0.8019047619047618, + "velocity_total_t01": 0.7852190476190477, + "velocity_total_t03": 0.7818952380952381, + "velocity_total_t05": 0.7814571428571429, + "velocity_total_t07": 0.7886666666666666, + "velocity_total_t09": 0.8177238095238095, + "velocity_total_t10": 0.8188 + }, + "dns_spoofing": { + "_n": 165.0, + "arc_length": 0.7543115151515152, + "causal_surprisal_flow": 0.5553769696969697, + "causal_surprisal_packet_max": 0.5527030303030303, + "causal_surprisal_packet_mean": 0.4605296969696969, + "causal_surprisal_packet_median": 0.4196084848484849, + "causal_surprisal_packet_trimmed10_mean": 0.40746424242424245, + "causal_surprisal_total": 0.5164242424242425, + "consistency_total": 0.6606145454545453, + "curvature_flow": 0.5402206060606061, + "curvature_packet": 0.6370230303030303, + "curvature_total": 0.654249696969697, + "direction_drift_flow": 0.18899636363636363, + "direction_drift_packet_max": 0.5459236363636364, + "direction_drift_packet_mean": 0.3434521212121212, + "direction_drift_packet_median": 0.32611151515151515, + "direction_drift_packet_trimmed10_mean": 0.3575369696969697, + "direction_drift_total": 0.24976969696969697, + "flow_consistency": 0.6508860606060607, + "jacobian_flow": 0.23866909090909091, + "jacobian_packet": 0.5267175757575757, + "jacobian_total": 0.3813727272727273, + "kappa2_speed2norm_packet_mean": 0.49646909090909086, + "kappa2_speed2norm_packet_median": 0.5177151515151515, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5054218181818182, + "kinetic_energy": 0.7540060606060607, + "kinetic_flow": 0.712430303030303, + "kinetic_packet": 0.6777987878787879, + "packet_consistency": 0.6228521212121212, + "pna_flow": 0.27938303030303036, + "pna_packet_max": 0.5273709090909091, + "pna_packet_mean": 0.49646909090909086, + "pna_packet_median": 0.5177151515151515, + "pna_packet_trimmed10_mean": 0.5054218181818182, + "terminal_flow": 0.7239624242424242, + "terminal_norm": 0.7378715151515152, + "terminal_packet": 0.7050618181818181, + "velocity_flow": 0.7186812121212123, + "velocity_flow_t01": 0.7217951515151515, + "velocity_flow_t03": 0.730041212121212, + "velocity_flow_t05": 0.7386569696969697, + "velocity_flow_t07": 0.7336133333333335, + "velocity_flow_t09": 0.7377393939393939, + "velocity_flow_t10": 0.7017466666666667, + "velocity_packet": 0.7009224242424242, + "velocity_packet_t01": 0.7141769696969696, + "velocity_packet_t03": 0.7166521212121212, + "velocity_packet_t05": 0.7119830303030303, + "velocity_packet_t07": 0.6887903030303031, + "velocity_packet_t09": 0.7021224242424242, + "velocity_packet_t10": 0.6715551515151514, + "velocity_total": 0.7346024242424242, + "velocity_total_t01": 0.7230351515151515, + "velocity_total_t03": 0.7315430303030303, + "velocity_total_t05": 0.7345648484848485, + "velocity_total_t07": 0.7341781818181817, + "velocity_total_t09": 0.7492739393939393, + "velocity_total_t10": 0.7224533333333334 + }, + "dos-http_flood": { + "_n": 716.0, + "arc_length": 0.966063687150838, + "causal_surprisal_flow": 0.26093379888268153, + "causal_surprisal_packet_max": 0.4114807262569833, + "causal_surprisal_packet_mean": 0.463426815642458, + "causal_surprisal_packet_median": 0.570647905027933, + "causal_surprisal_packet_trimmed10_mean": 0.4465083798882682, + "causal_surprisal_total": 0.21746256983240225, + "consistency_total": 0.7170614525139666, + "curvature_flow": 0.36991005586592174, + "curvature_packet": 0.9525765363128491, + "curvature_total": 0.9010311452513967, + "direction_drift_flow": 0.11266522346368715, + "direction_drift_packet_max": 0.4916241620111732, + "direction_drift_packet_mean": 0.23228854748603353, + "direction_drift_packet_median": 0.23158296089385472, + "direction_drift_packet_trimmed10_mean": 0.24528212290502793, + "direction_drift_total": 0.10613896648044692, + "flow_consistency": 0.6961245810055865, + "jacobian_flow": 0.36764399441340784, + "jacobian_packet": 0.7537818435754189, + "jacobian_total": 0.6618854748603352, + "kappa2_speed2norm_packet_mean": 0.6641835195530726, + "kappa2_speed2norm_packet_median": 0.6802675977653633, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6914536312849163, + "kinetic_energy": 0.9663008379888266, + "kinetic_flow": 0.8735075418994414, + "kinetic_packet": 0.9644203910614525, + "packet_consistency": 0.7664012569832402, + "pna_flow": 0.07323100558659218, + "pna_packet_max": 0.7951414804469273, + "pna_packet_mean": 0.6641835195530726, + "pna_packet_median": 0.6802675977653633, + "pna_packet_trimmed10_mean": 0.6914536312849163, + "terminal_flow": 0.9663027932960894, + "terminal_norm": 0.9870175977653631, + "terminal_packet": 0.9819648044692738, + "velocity_flow": 0.8505717877094972, + "velocity_flow_t01": 0.7706854748603351, + "velocity_flow_t03": 0.817684217877095, + "velocity_flow_t05": 0.8357170391061451, + "velocity_flow_t07": 0.8487656424581005, + "velocity_flow_t09": 0.8550173184357542, + "velocity_flow_t10": 0.8561648044692737, + "velocity_packet": 0.8623145251396648, + "velocity_packet_t01": 0.8961421787709497, + "velocity_packet_t03": 0.8682078212290503, + "velocity_packet_t05": 0.8165150837988827, + "velocity_packet_t07": 0.7920539106145251, + "velocity_packet_t09": 0.9157941340782123, + "velocity_packet_t10": 0.896067877094972, + "velocity_total": 0.9067374301675978, + "velocity_total_t01": 0.8362310055865921, + "velocity_total_t03": 0.8378606145251397, + "velocity_total_t05": 0.8454703910614524, + "velocity_total_t07": 0.8960399441340781, + "velocity_total_t09": 0.931453910614525, + "velocity_total_t10": 0.9303807262569831 + }, + "dos-syn_flood": { + "_n": 844.0, + "arc_length": 0.9848947867298579, + "causal_surprisal_flow": 0.6343850710900474, + "causal_surprisal_packet_max": 0.6283516587677725, + "causal_surprisal_packet_mean": 0.5851785545023698, + "causal_surprisal_packet_median": 0.5218684834123223, + "causal_surprisal_packet_trimmed10_mean": 0.4628722748815166, + "causal_surprisal_total": 0.7144101895734597, + "consistency_total": 0.9701040284360191, + "curvature_flow": 0.21627819905213275, + "curvature_packet": 0.9011694312796208, + "curvature_total": 0.8298516587677724, + "direction_drift_flow": 0.12481303317535544, + "direction_drift_packet_max": 0.3208158767772512, + "direction_drift_packet_mean": 0.08109928909952607, + "direction_drift_packet_median": 0.06794644549763033, + "direction_drift_packet_trimmed10_mean": 0.06539597156398105, + "direction_drift_total": 0.0681281990521327, + "flow_consistency": 0.9639172985781991, + "jacobian_flow": 0.15186658767772512, + "jacobian_packet": 0.5221421800947867, + "jacobian_total": 0.285468009478673, + "kappa2_speed2norm_packet_mean": 0.4835901658767772, + "kappa2_speed2norm_packet_median": 0.49921161137440756, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4339021327014218, + "kinetic_energy": 0.9853516587677724, + "kinetic_flow": 0.922755924170616, + "kinetic_packet": 0.9867478672985781, + "packet_consistency": 0.9146082938388627, + "pna_flow": 0.02758862559241706, + "pna_packet_max": 0.6321270142180094, + "pna_packet_mean": 0.4835901658767772, + "pna_packet_median": 0.49921161137440756, + "pna_packet_trimmed10_mean": 0.4339021327014218, + "terminal_flow": 0.9884616113744077, + "terminal_norm": 0.9962841232227487, + "terminal_packet": 0.9958199052132701, + "velocity_flow": 0.8974997630331752, + "velocity_flow_t01": 0.9051109004739337, + "velocity_flow_t03": 0.8991819905213271, + "velocity_flow_t05": 0.8932810426540284, + "velocity_flow_t07": 0.8968670616113744, + "velocity_flow_t09": 0.8969201421800949, + "velocity_flow_t10": 0.8973284360189573, + "velocity_packet": 0.9625414691943128, + "velocity_packet_t01": 0.9495417061611374, + "velocity_packet_t03": 0.9547623222748816, + "velocity_packet_t05": 0.9618357819905213, + "velocity_packet_t07": 0.9670585308056873, + "velocity_packet_t09": 0.9669836492890996, + "velocity_packet_t10": 0.8746513033175356, + "velocity_total": 0.9402016587677725, + "velocity_total_t01": 0.9324798578199053, + "velocity_total_t03": 0.9351869668246445, + "velocity_total_t05": 0.9406123222748813, + "velocity_total_t07": 0.9450755924170615, + "velocity_total_t09": 0.9419890995260665, + "velocity_total_t10": 0.9319432464454976 + }, + "dos-tcp_flood": { + "_n": 1098.0, + "arc_length": 0.995487431693989, + "causal_surprisal_flow": 0.649420218579235, + "causal_surprisal_packet_max": 0.6178085610200366, + "causal_surprisal_packet_mean": 0.6071242258652094, + "causal_surprisal_packet_median": 0.7708882513661203, + "causal_surprisal_packet_trimmed10_mean": 0.6202626593806922, + "causal_surprisal_total": 0.792160655737705, + "consistency_total": 0.965316393442623, + "curvature_flow": 0.6299306010928962, + "curvature_packet": 0.9705391621129327, + "curvature_total": 0.9531589253187615, + "direction_drift_flow": 0.09437777777777777, + "direction_drift_packet_max": 0.11016438979963569, + "direction_drift_packet_mean": 0.04815510018214937, + "direction_drift_packet_median": 0.05562650273224044, + "direction_drift_packet_trimmed10_mean": 0.05455409836065574, + "direction_drift_total": 0.021897632058287805, + "flow_consistency": 0.9446462659380693, + "jacobian_flow": 0.12495191256830601, + "jacobian_packet": 0.8843202185792349, + "jacobian_total": 0.4604642987249544, + "kappa2_speed2norm_packet_mean": 0.485888160291439, + "kappa2_speed2norm_packet_median": 0.5298374316939891, + "kappa2_speed2norm_packet_trimmed10_mean": 0.469435883424408, + "kinetic_energy": 0.9958426229508196, + "kinetic_flow": 0.9330306010928962, + "kinetic_packet": 0.9982927140255009, + "packet_consistency": 0.9300289617486339, + "pna_flow": 0.10245300546448088, + "pna_packet_max": 0.5521835154826958, + "pna_packet_mean": 0.485888160291439, + "pna_packet_median": 0.5298374316939891, + "pna_packet_trimmed10_mean": 0.469435883424408, + "terminal_flow": 0.986083606557377, + "terminal_norm": 0.9977976320582878, + "terminal_packet": 0.9983712204007286, + "velocity_flow": 0.903959927140255, + "velocity_flow_t01": 0.9205925318761384, + "velocity_flow_t03": 0.9175404371584699, + "velocity_flow_t05": 0.9093147540983606, + "velocity_flow_t07": 0.9051367941712204, + "velocity_flow_t09": 0.8989423497267759, + "velocity_flow_t10": 0.8883555555555555, + "velocity_packet": 0.9610657559198541, + "velocity_packet_t01": 0.8974252276867031, + "velocity_packet_t03": 0.9176548269581057, + "velocity_packet_t05": 0.9442047358834244, + "velocity_packet_t07": 0.9588865209471767, + "velocity_packet_t09": 0.9679974499089254, + "velocity_packet_t10": 0.9518854280510018, + "velocity_total": 0.9517189435336976, + "velocity_total_t01": 0.9378215846994535, + "velocity_total_t03": 0.9383899817850637, + "velocity_total_t05": 0.9422535519125683, + "velocity_total_t07": 0.9544697632058289, + "velocity_total_t09": 0.9638533697632058, + "velocity_total_t10": 0.9515114754098362 + }, + "dos-udp_flood": { + "_n": 177.0, + "arc_length": 0.9936553672316384, + "causal_surprisal_flow": 0.693627118644068, + "causal_surprisal_packet_max": 0.9671909604519775, + "causal_surprisal_packet_mean": 0.5581774011299434, + "causal_surprisal_packet_median": 0.5682203389830508, + "causal_surprisal_packet_trimmed10_mean": 0.4937830508474576, + "causal_surprisal_total": 0.44915932203389836, + "consistency_total": 0.9959649717514124, + "curvature_flow": 0.742742372881356, + "curvature_packet": 0.9877344632768362, + "curvature_total": 0.9872745762711863, + "direction_drift_flow": 0.062154802259887, + "direction_drift_packet_max": 0.5026440677966102, + "direction_drift_packet_mean": 0.0011175141242938014, + "direction_drift_packet_median": 0.005210169491525423, + "direction_drift_packet_trimmed10_mean": 0.0013581920903954856, + "direction_drift_total": 0.004857627118644064, + "flow_consistency": 0.9948779661016949, + "jacobian_flow": 0.028825988700564964, + "jacobian_packet": 0.5977548022598869, + "jacobian_total": 0.18414237288135593, + "kappa2_speed2norm_packet_mean": 0.23298983050847458, + "kappa2_speed2norm_packet_median": 0.16047118644067795, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2040960451977401, + "kinetic_energy": 0.9940101694915254, + "kinetic_flow": 0.9586146892655367, + "kinetic_packet": 0.9998079096045198, + "packet_consistency": 0.9912813559322033, + "pna_flow": 0.07498757062146894, + "pna_packet_max": 0.5419581920903954, + "pna_packet_mean": 0.23298983050847458, + "pna_packet_median": 0.16047118644067795, + "pna_packet_trimmed10_mean": 0.2040960451977401, + "terminal_flow": 0.9944700564971751, + "terminal_norm": 0.9970293785310735, + "terminal_packet": 0.9991638418079096, + "velocity_flow": 0.9777514124293785, + "velocity_flow_t01": 0.9722632768361583, + "velocity_flow_t03": 0.9737694915254237, + "velocity_flow_t05": 0.9759581920903955, + "velocity_flow_t07": 0.9790361581920904, + "velocity_flow_t09": 0.9771062146892654, + "velocity_flow_t10": 0.9739762711864407, + "velocity_packet": 0.9961050847457628, + "velocity_packet_t01": 0.9942248587570621, + "velocity_packet_t03": 0.9939231638418078, + "velocity_packet_t05": 0.9947254237288136, + "velocity_packet_t07": 0.9961909604519775, + "velocity_packet_t09": 0.996702824858757, + "velocity_packet_t10": 0.9957875706214689, + "velocity_total": 0.9440960451977399, + "velocity_total_t01": 0.9393016949152543, + "velocity_total_t03": 0.9398384180790961, + "velocity_total_t05": 0.9408598870056498, + "velocity_total_t07": 0.9473570621468927, + "velocity_total_t09": 0.9712655367231638, + "velocity_total_t10": 0.9583299435028249 + }, + "mirai-greeth_flood": { + "_n": 8.0, + "arc_length": 0.606975, + "causal_surprisal_flow": 0.509925, + "causal_surprisal_packet_max": 0.5432, + "causal_surprisal_packet_mean": 0.5441750000000001, + "causal_surprisal_packet_median": 0.645425, + "causal_surprisal_packet_trimmed10_mean": 0.5075000000000001, + "causal_surprisal_total": 0.528825, + "consistency_total": 0.616475, + "curvature_flow": 0.3535750000000001, + "curvature_packet": 0.530125, + "curvature_total": 0.49529999999999996, + "direction_drift_flow": 0.29457500000000003, + "direction_drift_packet_max": 0.4321125, + "direction_drift_packet_mean": 0.400225, + "direction_drift_packet_median": 0.393, + "direction_drift_packet_trimmed10_mean": 0.43609999999999993, + "direction_drift_total": 0.319075, + "flow_consistency": 0.6025499999999999, + "jacobian_flow": 0.33975, + "jacobian_packet": 0.43745, + "jacobian_total": 0.458125, + "kappa2_speed2norm_packet_mean": 0.466225, + "kappa2_speed2norm_packet_median": 0.4369, + "kappa2_speed2norm_packet_trimmed10_mean": 0.494975, + "kinetic_energy": 0.605225, + "kinetic_flow": 0.596525, + "kinetic_packet": 0.5140999999999999, + "packet_consistency": 0.559025, + "pna_flow": 0.275975, + "pna_packet_max": 0.49349999999999994, + "pna_packet_mean": 0.466225, + "pna_packet_median": 0.4369, + "pna_packet_trimmed10_mean": 0.494975, + "terminal_flow": 0.678825, + "terminal_norm": 0.71405, + "terminal_packet": 0.640075, + "velocity_flow": 0.585175, + "velocity_flow_t01": 0.622125, + "velocity_flow_t03": 0.615975, + "velocity_flow_t05": 0.595225, + "velocity_flow_t07": 0.58435, + "velocity_flow_t09": 0.599775, + "velocity_flow_t10": 0.6159000000000001, + "velocity_packet": 0.516575, + "velocity_packet_t01": 0.5356000000000001, + "velocity_packet_t03": 0.49245, + "velocity_packet_t05": 0.495625, + "velocity_packet_t07": 0.5102249999999999, + "velocity_packet_t09": 0.5304749999999999, + "velocity_packet_t10": 0.6000000000000001, + "velocity_total": 0.579125, + "velocity_total_t01": 0.5718, + "velocity_total_t03": 0.5642, + "velocity_total_t05": 0.562325, + "velocity_total_t07": 0.562675, + "velocity_total_t09": 0.581225, + "velocity_total_t10": 0.6252 + }, + "mirai-greip_flood": { + "_n": 29.0, + "arc_length": 0.910951724137931, + "causal_surprisal_flow": 0.5828965517241379, + "causal_surprisal_packet_max": 0.40968275862068965, + "causal_surprisal_packet_mean": 0.4118206896551724, + "causal_surprisal_packet_median": 0.4476413793103448, + "causal_surprisal_packet_trimmed10_mean": 0.38906896551724135, + "causal_surprisal_total": 0.5336827586206896, + "consistency_total": 0.8158758620689656, + "curvature_flow": 0.39947586206896557, + "curvature_packet": 0.7112965517241379, + "curvature_total": 0.6917862068965517, + "direction_drift_flow": 0.11973793103448276, + "direction_drift_packet_max": 0.3643655172413793, + "direction_drift_packet_mean": 0.23280689655172415, + "direction_drift_packet_median": 0.22413793103448276, + "direction_drift_packet_trimmed10_mean": 0.23857931034482763, + "direction_drift_total": 0.1428551724137931, + "flow_consistency": 0.8316413793103448, + "jacobian_flow": 0.23420689655172416, + "jacobian_packet": 0.446248275862069, + "jacobian_total": 0.3760896551724138, + "kappa2_speed2norm_packet_mean": 0.5144275862068965, + "kappa2_speed2norm_packet_median": 0.5222482758620689, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5240896551724138, + "kinetic_energy": 0.9098344827586207, + "kinetic_flow": 0.8841517241379311, + "kinetic_packet": 0.7622758620689656, + "packet_consistency": 0.5494896551724138, + "pna_flow": 0.12633103448275862, + "pna_packet_max": 0.5241379310344828, + "pna_packet_mean": 0.5144275862068965, + "pna_packet_median": 0.5222482758620689, + "pna_packet_trimmed10_mean": 0.5240896551724138, + "terminal_flow": 0.9354344827586207, + "terminal_norm": 0.9422551724137931, + "terminal_packet": 0.8449517241379311, + "velocity_flow": 0.8555241379310345, + "velocity_flow_t01": 0.8058206896551724, + "velocity_flow_t03": 0.8177379310344828, + "velocity_flow_t05": 0.8323448275862069, + "velocity_flow_t07": 0.8355448275862069, + "velocity_flow_t09": 0.8697034482758621, + "velocity_flow_t10": 0.8572689655172414, + "velocity_packet": 0.7472758620689656, + "velocity_packet_t01": 0.7285655172413793, + "velocity_packet_t03": 0.7311793103448276, + "velocity_packet_t05": 0.729, + "velocity_packet_t07": 0.7046965517241379, + "velocity_packet_t09": 0.7873586206896552, + "velocity_packet_t10": 0.7745448275862069, + "velocity_total": 0.8713103448275863, + "velocity_total_t01": 0.8133310344827587, + "velocity_total_t03": 0.8208344827586207, + "velocity_total_t05": 0.8296413793103449, + "velocity_total_t07": 0.839903448275862, + "velocity_total_t09": 0.9020689655172414, + "velocity_total_t10": 0.8924620689655172 + }, + "mirai-udpplain": { + "_n": 9.0, + "arc_length": 0.8394, + "causal_surprisal_flow": 0.5862222222222222, + "causal_surprisal_packet_max": 0.5258888888888889, + "causal_surprisal_packet_mean": 0.5488666666666666, + "causal_surprisal_packet_median": 0.6767777777777778, + "causal_surprisal_packet_trimmed10_mean": 0.5924666666666666, + "causal_surprisal_total": 0.6389777777777778, + "consistency_total": 0.7278888888888889, + "curvature_flow": 0.4564666666666667, + "curvature_packet": 0.8094222222222223, + "curvature_total": 0.7792, + "direction_drift_flow": 0.18084444444444445, + "direction_drift_packet_max": 0.42935555555555555, + "direction_drift_packet_mean": 0.41988888888888887, + "direction_drift_packet_median": 0.3913333333333333, + "direction_drift_packet_trimmed10_mean": 0.44206666666666666, + "direction_drift_total": 0.32922222222222225, + "flow_consistency": 0.7178666666666667, + "jacobian_flow": 0.13553333333333334, + "jacobian_packet": 0.6325555555555555, + "jacobian_total": 0.3331777777777778, + "kappa2_speed2norm_packet_mean": 0.768, + "kappa2_speed2norm_packet_median": 0.7821777777777777, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7877555555555555, + "kinetic_energy": 0.8399333333333333, + "kinetic_flow": 0.8085333333333333, + "kinetic_packet": 0.7837777777777778, + "packet_consistency": 0.5714222222222222, + "pna_flow": 0.17784444444444444, + "pna_packet_max": 0.7175111111111111, + "pna_packet_mean": 0.768, + "pna_packet_median": 0.7821777777777777, + "pna_packet_trimmed10_mean": 0.7877555555555555, + "terminal_flow": 0.8578222222222222, + "terminal_norm": 0.9344888888888889, + "terminal_packet": 0.9109555555555555, + "velocity_flow": 0.790511111111111, + "velocity_flow_t01": 0.7747999999999999, + "velocity_flow_t03": 0.7832444444444444, + "velocity_flow_t05": 0.7957444444444444, + "velocity_flow_t07": 0.7912444444444444, + "velocity_flow_t09": 0.7866888888888889, + "velocity_flow_t10": 0.7932222222222223, + "velocity_packet": 0.6969777777777777, + "velocity_packet_t01": 0.7618444444444444, + "velocity_packet_t03": 0.7644222222222222, + "velocity_packet_t05": 0.7553777777777777, + "velocity_packet_t07": 0.6882222222222222, + "velocity_packet_t09": 0.7154444444444444, + "velocity_packet_t10": 0.6333777777777777, + "velocity_total": 0.7866666666666666, + "velocity_total_t01": 0.8106888888888888, + "velocity_total_t03": 0.8082222222222222, + "velocity_total_t05": 0.8055111111111112, + "velocity_total_t07": 0.8015555555555555, + "velocity_total_t09": 0.8008, + "velocity_total_t10": 0.7734888888888889 + }, + "mitm-arpspoofing": { + "_n": 135.0, + "arc_length": 0.800762962962963, + "causal_surprisal_flow": 0.5415125925925925, + "causal_surprisal_packet_max": 0.3628414814814815, + "causal_surprisal_packet_mean": 0.33239851851851854, + "causal_surprisal_packet_median": 0.326877037037037, + "causal_surprisal_packet_trimmed10_mean": 0.3206088888888889, + "causal_surprisal_total": 0.5054725925925926, + "consistency_total": 0.6541140740740741, + "curvature_flow": 0.5414459259259259, + "curvature_packet": 0.5991851851851853, + "curvature_total": 0.6098525925925926, + "direction_drift_flow": 0.17976888888888892, + "direction_drift_packet_max": 0.31260444444444446, + "direction_drift_packet_mean": 0.27968000000000004, + "direction_drift_packet_median": 0.2812059259259259, + "direction_drift_packet_trimmed10_mean": 0.29514814814814816, + "direction_drift_total": 0.1975362962962963, + "flow_consistency": 0.6949422222222221, + "jacobian_flow": 0.3570933333333334, + "jacobian_packet": 0.44326074074074073, + "jacobian_total": 0.4755155555555555, + "kappa2_speed2norm_packet_mean": 0.45151555555555556, + "kappa2_speed2norm_packet_median": 0.4568562962962963, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4627703703703704, + "kinetic_energy": 0.8000303703703703, + "kinetic_flow": 0.7570177777777779, + "kinetic_packet": 0.7007688888888889, + "packet_consistency": 0.40100444444444444, + "pna_flow": 0.2435540740740741, + "pna_packet_max": 0.45741481481481483, + "pna_packet_mean": 0.45151555555555556, + "pna_packet_median": 0.4568562962962963, + "pna_packet_trimmed10_mean": 0.4627703703703704, + "terminal_flow": 0.804851111111111, + "terminal_norm": 0.806594074074074, + "terminal_packet": 0.7362503703703703, + "velocity_flow": 0.7546533333333333, + "velocity_flow_t01": 0.7063496296296297, + "velocity_flow_t03": 0.721242962962963, + "velocity_flow_t05": 0.734045925925926, + "velocity_flow_t07": 0.7464785185185185, + "velocity_flow_t09": 0.768214074074074, + "velocity_flow_t10": 0.7620755555555555, + "velocity_packet": 0.6094503703703704, + "velocity_packet_t01": 0.604954074074074, + "velocity_packet_t03": 0.5960281481481482, + "velocity_packet_t05": 0.5759762962962963, + "velocity_packet_t07": 0.5461437037037037, + "velocity_packet_t09": 0.6212992592592593, + "velocity_packet_t10": 0.6822296296296296, + "velocity_total": 0.7701496296296296, + "velocity_total_t01": 0.7224903703703704, + "velocity_total_t03": 0.7257111111111112, + "velocity_total_t05": 0.7356607407407407, + "velocity_total_t07": 0.7540488888888889, + "velocity_total_t09": 0.7900696296296296, + "velocity_total_t10": 0.7901096296296296 + }, + "recon-hostdiscovery": { + "_n": 165.0, + "arc_length": 0.8175733333333335, + "causal_surprisal_flow": 0.3673951515151515, + "causal_surprisal_packet_max": 0.4171127272727273, + "causal_surprisal_packet_mean": 0.4184678787878788, + "causal_surprisal_packet_median": 0.5201878787878788, + "causal_surprisal_packet_trimmed10_mean": 0.4608593939393939, + "causal_surprisal_total": 0.42949575757575753, + "consistency_total": 0.6857078787878788, + "curvature_flow": 0.4339454545454546, + "curvature_packet": 0.6962727272727273, + "curvature_total": 0.665820606060606, + "direction_drift_flow": 0.22785212121212123, + "direction_drift_packet_max": 0.38364606060606055, + "direction_drift_packet_mean": 0.3343957575757576, + "direction_drift_packet_median": 0.3402048484848485, + "direction_drift_packet_trimmed10_mean": 0.36140848484848487, + "direction_drift_total": 0.2227442424242424, + "flow_consistency": 0.6597515151515152, + "jacobian_flow": 0.3748569696969697, + "jacobian_packet": 0.7061866666666667, + "jacobian_total": 0.6431296969696969, + "kappa2_speed2norm_packet_mean": 0.5630545454545454, + "kappa2_speed2norm_packet_median": 0.5726860606060606, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5849551515151514, + "kinetic_energy": 0.8177236363636364, + "kinetic_flow": 0.7425151515151516, + "kinetic_packet": 0.7674824242424244, + "packet_consistency": 0.680129696969697, + "pna_flow": 0.24209212121212123, + "pna_packet_max": 0.5243624242424243, + "pna_packet_mean": 0.5630545454545454, + "pna_packet_median": 0.5726860606060606, + "pna_packet_trimmed10_mean": 0.5849551515151514, + "terminal_flow": 0.7830872727272727, + "terminal_norm": 0.8156024242424244, + "terminal_packet": 0.7938654545454544, + "velocity_flow": 0.7119733333333333, + "velocity_flow_t01": 0.6604363636363636, + "velocity_flow_t03": 0.6956739393939394, + "velocity_flow_t05": 0.7099230303030303, + "velocity_flow_t07": 0.71488, + "velocity_flow_t09": 0.7392121212121211, + "velocity_flow_t10": 0.7094290909090909, + "velocity_packet": 0.6533490909090909, + "velocity_packet_t01": 0.6798290909090908, + "velocity_packet_t03": 0.6710775757575758, + "velocity_packet_t05": 0.6535830303030303, + "velocity_packet_t07": 0.6264036363636363, + "velocity_packet_t09": 0.681209696969697, + "velocity_packet_t10": 0.6052751515151515, + "velocity_total": 0.7555054545454546, + "velocity_total_t01": 0.6900484848484849, + "velocity_total_t03": 0.70288, + "velocity_total_t05": 0.7198145454545455, + "velocity_total_t07": 0.7541709090909091, + "velocity_total_t09": 0.780299393939394, + "velocity_total_t10": 0.7667090909090909 + }, + "recon-osscan": { + "_n": 368.0, + "arc_length": 0.9102875, + "causal_surprisal_flow": 0.3668228260869565, + "causal_surprisal_packet_max": 0.453795652173913, + "causal_surprisal_packet_mean": 0.4464304347826087, + "causal_surprisal_packet_median": 0.5773201086956521, + "causal_surprisal_packet_trimmed10_mean": 0.4607880434782609, + "causal_surprisal_total": 0.3912222826086956, + "consistency_total": 0.8246342391304349, + "curvature_flow": 0.3467385869565217, + "curvature_packet": 0.817554347826087, + "curvature_total": 0.7540244565217391, + "direction_drift_flow": 0.20795788043478258, + "direction_drift_packet_max": 0.40564021739130435, + "direction_drift_packet_mean": 0.27776684782608696, + "direction_drift_packet_median": 0.2839032608695652, + "direction_drift_packet_trimmed10_mean": 0.29084945652173916, + "direction_drift_total": 0.1652766304347826, + "flow_consistency": 0.7908923913043477, + "jacobian_flow": 0.4626244565217391, + "jacobian_packet": 0.748583695652174, + "jacobian_total": 0.7263413043478261, + "kappa2_speed2norm_packet_mean": 0.7066586956521739, + "kappa2_speed2norm_packet_median": 0.7067921195652174, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7155646739130435, + "kinetic_energy": 0.9106478260869566, + "kinetic_flow": 0.8298864130434783, + "kinetic_packet": 0.8888864130434783, + "packet_consistency": 0.7776222826086957, + "pna_flow": 0.14168695652173913, + "pna_packet_max": 0.6721103260869565, + "pna_packet_mean": 0.7066586956521739, + "pna_packet_median": 0.7067921195652174, + "pna_packet_trimmed10_mean": 0.7155646739130435, + "terminal_flow": 0.9085374999999999, + "terminal_norm": 0.9270505434782609, + "terminal_packet": 0.9150733695652173, + "velocity_flow": 0.7838576086956522, + "velocity_flow_t01": 0.6825896739130435, + "velocity_flow_t03": 0.738917391304348, + "velocity_flow_t05": 0.7611701086956522, + "velocity_flow_t07": 0.7778953804347826, + "velocity_flow_t09": 0.8089864130434783, + "velocity_flow_t10": 0.8003114130434783, + "velocity_packet": 0.7548619565217392, + "velocity_packet_t01": 0.7852369565217392, + "velocity_packet_t03": 0.784825543478261, + "velocity_packet_t05": 0.7719527173913043, + "velocity_packet_t07": 0.7467684782608697, + "velocity_packet_t09": 0.78334375, + "velocity_packet_t10": 0.663091304347826, + "velocity_total": 0.8511527173913045, + "velocity_total_t01": 0.7572190217391304, + "velocity_total_t03": 0.765621195652174, + "velocity_total_t05": 0.7940853260869565, + "velocity_total_t07": 0.8430086956521738, + "velocity_total_t09": 0.8755103260869567, + "velocity_total_t10": 0.8677016304347827 + }, + "recon-pingsweep": { + "_n": 8.0, + "arc_length": 0.904375, + "causal_surprisal_flow": 0.58875, + "causal_surprisal_packet_max": 0.538, + "causal_surprisal_packet_mean": 0.49529999999999996, + "causal_surprisal_packet_median": 0.636925, + "causal_surprisal_packet_trimmed10_mean": 0.48897499999999994, + "causal_surprisal_total": 0.547825, + "consistency_total": 0.7802, + "curvature_flow": 0.44542499999999996, + "curvature_packet": 0.7712749999999999, + "curvature_total": 0.71435, + "direction_drift_flow": 0.20377499999999998, + "direction_drift_packet_max": 0.267375, + "direction_drift_packet_mean": 0.12969999999999998, + "direction_drift_packet_median": 0.11014999999999998, + "direction_drift_packet_trimmed10_mean": 0.13024999999999998, + "direction_drift_total": 0.12840000000000001, + "flow_consistency": 0.7746500000000001, + "jacobian_flow": 0.340575, + "jacobian_packet": 0.358525, + "jacobian_total": 0.34597500000000003, + "kappa2_speed2norm_packet_mean": 0.5607750000000001, + "kappa2_speed2norm_packet_median": 0.5496, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5551750000000001, + "kinetic_energy": 0.9036000000000001, + "kinetic_flow": 0.8434999999999999, + "kinetic_packet": 0.86695, + "packet_consistency": 0.7051249999999999, + "pna_flow": 0.13947500000000002, + "pna_packet_max": 0.5419999999999999, + "pna_packet_mean": 0.5607750000000001, + "pna_packet_median": 0.5496, + "pna_packet_trimmed10_mean": 0.5551750000000001, + "terminal_flow": 0.8720249999999999, + "terminal_norm": 0.9556, + "terminal_packet": 0.96465, + "velocity_flow": 0.8025249999999999, + "velocity_flow_t01": 0.7395, + "velocity_flow_t03": 0.750575, + "velocity_flow_t05": 0.766675, + "velocity_flow_t07": 0.769325, + "velocity_flow_t09": 0.82205, + "velocity_flow_t10": 0.828325, + "velocity_packet": 0.8532, + "velocity_packet_t01": 0.716225, + "velocity_packet_t03": 0.725025, + "velocity_packet_t05": 0.74475, + "velocity_packet_t07": 0.761925, + "velocity_packet_t09": 0.882, + "velocity_packet_t10": 0.836375, + "velocity_total": 0.853375, + "velocity_total_t01": 0.7654, + "velocity_total_t03": 0.769725, + "velocity_total_t05": 0.7766500000000001, + "velocity_total_t07": 0.8262, + "velocity_total_t09": 0.8660749999999999, + "velocity_total_t10": 0.878925 + }, + "recon-portscan": { + "_n": 370.0, + "arc_length": 0.9139416216216216, + "causal_surprisal_flow": 0.3304118918918919, + "causal_surprisal_packet_max": 0.4523016216216217, + "causal_surprisal_packet_mean": 0.4385054054054054, + "causal_surprisal_packet_median": 0.5548637837837838, + "causal_surprisal_packet_trimmed10_mean": 0.4502194594594594, + "causal_surprisal_total": 0.3560372972972974, + "consistency_total": 0.8411740540540541, + "curvature_flow": 0.3301356756756757, + "curvature_packet": 0.8396721621621621, + "curvature_total": 0.7795991891891892, + "direction_drift_flow": 0.20929513513513515, + "direction_drift_packet_max": 0.42499891891891894, + "direction_drift_packet_mean": 0.2574386486486486, + "direction_drift_packet_median": 0.26383837837837837, + "direction_drift_packet_trimmed10_mean": 0.2697027027027027, + "direction_drift_total": 0.15561945945945949, + "flow_consistency": 0.8194583783783784, + "jacobian_flow": 0.47689405405405405, + "jacobian_packet": 0.770747027027027, + "jacobian_total": 0.7559172972972973, + "kappa2_speed2norm_packet_mean": 0.7246491891891891, + "kappa2_speed2norm_packet_median": 0.7345913513513513, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7337494594594595, + "kinetic_energy": 0.9143659459459459, + "kinetic_flow": 0.8367983783783784, + "kinetic_packet": 0.8975454054054053, + "packet_consistency": 0.773865945945946, + "pna_flow": 0.13405405405405407, + "pna_packet_max": 0.6971583783783784, + "pna_packet_mean": 0.7246491891891891, + "pna_packet_median": 0.7345913513513513, + "pna_packet_trimmed10_mean": 0.7337494594594595, + "terminal_flow": 0.9115551351351352, + "terminal_norm": 0.9235345945945945, + "terminal_packet": 0.9147864864864865, + "velocity_flow": 0.7902075675675676, + "velocity_flow_t01": 0.6769962162162163, + "velocity_flow_t03": 0.7499205405405406, + "velocity_flow_t05": 0.7725772972972974, + "velocity_flow_t07": 0.7854394594594594, + "velocity_flow_t09": 0.8095091891891892, + "velocity_flow_t10": 0.8006075675675675, + "velocity_packet": 0.770872972972973, + "velocity_packet_t01": 0.7966394594594596, + "velocity_packet_t03": 0.7978356756756757, + "velocity_packet_t05": 0.7818016216216216, + "velocity_packet_t07": 0.7512913513513514, + "velocity_packet_t09": 0.8029032432432432, + "velocity_packet_t10": 0.7086983783783782, + "velocity_total": 0.8549178378378379, + "velocity_total_t01": 0.7751810810810811, + "velocity_total_t03": 0.7833243243243243, + "velocity_total_t05": 0.8046697297297296, + "velocity_total_t07": 0.8537594594594594, + "velocity_total_t09": 0.8767318918918919, + "velocity_total_t10": 0.8646189189189188 + }, + "sqlinjection": { + "_n": 11.0, + "arc_length": 0.6714, + "causal_surprisal_flow": 0.5070727272727272, + "causal_surprisal_packet_max": 0.3996909090909091, + "causal_surprisal_packet_mean": 0.39039999999999997, + "causal_surprisal_packet_median": 0.41727272727272724, + "causal_surprisal_packet_trimmed10_mean": 0.4034, + "causal_surprisal_total": 0.5195818181818181, + "consistency_total": 0.6303272727272726, + "curvature_flow": 0.47996363636363637, + "curvature_packet": 0.5388545454545455, + "curvature_total": 0.5751818181818182, + "direction_drift_flow": 0.273, + "direction_drift_packet_max": 0.3628909090909091, + "direction_drift_packet_mean": 0.3396363636363636, + "direction_drift_packet_median": 0.3544909090909091, + "direction_drift_packet_trimmed10_mean": 0.3581454545454545, + "direction_drift_total": 0.27303636363636363, + "flow_consistency": 0.7050181818181818, + "jacobian_flow": 0.43181818181818177, + "jacobian_packet": 0.39941818181818184, + "jacobian_total": 0.4368727272727273, + "kappa2_speed2norm_packet_mean": 0.5095090909090909, + "kappa2_speed2norm_packet_median": 0.5365272727272727, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5022727272727273, + "kinetic_energy": 0.6723636363636364, + "kinetic_flow": 0.6462181818181818, + "kinetic_packet": 0.5543454545454545, + "packet_consistency": 0.48118181818181816, + "pna_flow": 0.3376363636363636, + "pna_packet_max": 0.44343636363636363, + "pna_packet_mean": 0.5095090909090909, + "pna_packet_median": 0.5365272727272727, + "pna_packet_trimmed10_mean": 0.5022727272727273, + "terminal_flow": 0.7303272727272727, + "terminal_norm": 0.7119454545454545, + "terminal_packet": 0.5969636363636364, + "velocity_flow": 0.6545090909090909, + "velocity_flow_t01": 0.6123454545454545, + "velocity_flow_t03": 0.6146181818181817, + "velocity_flow_t05": 0.6233636363636363, + "velocity_flow_t07": 0.6243090909090909, + "velocity_flow_t09": 0.6657090909090909, + "velocity_flow_t10": 0.6482727272727273, + "velocity_packet": 0.6119090909090908, + "velocity_packet_t01": 0.6386000000000001, + "velocity_packet_t03": 0.6205272727272726, + "velocity_packet_t05": 0.6073636363636363, + "velocity_packet_t07": 0.5844363636363636, + "velocity_packet_t09": 0.5804727272727273, + "velocity_packet_t10": 0.5303818181818181, + "velocity_total": 0.6850181818181817, + "velocity_total_t01": 0.6814363636363635, + "velocity_total_t03": 0.690509090909091, + "velocity_total_t05": 0.6859454545454546, + "velocity_total_t07": 0.6657818181818181, + "velocity_total_t09": 0.6830545454545454, + "velocity_total_t10": 0.6506363636363636 + }, + "uploading_attack": { + "_n": 3.0, + "arc_length": 0.9012666666666667, + "causal_surprisal_flow": 0.6123333333333334, + "causal_surprisal_packet_max": 0.15159999999999998, + "causal_surprisal_packet_mean": 0.11939999999999998, + "causal_surprisal_packet_median": 0.18113333333333337, + "causal_surprisal_packet_trimmed10_mean": 0.07766666666666666, + "causal_surprisal_total": 0.6504666666666666, + "consistency_total": 0.6928000000000001, + "curvature_flow": 0.5149333333333332, + "curvature_packet": 0.564, + "curvature_total": 0.5951333333333333, + "direction_drift_flow": 0.1579333333333333, + "direction_drift_packet_max": 0.207, + "direction_drift_packet_mean": 0.18266666666666667, + "direction_drift_packet_median": 0.2867333333333333, + "direction_drift_packet_trimmed10_mean": 0.1260666666666667, + "direction_drift_total": 0.11873333333333332, + "flow_consistency": 0.7748, + "jacobian_flow": 0.31093333333333334, + "jacobian_packet": 0.36239999999999994, + "jacobian_total": 0.41446666666666665, + "kappa2_speed2norm_packet_mean": 0.4103333333333333, + "kappa2_speed2norm_packet_median": 0.40306666666666663, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3212, + "kinetic_energy": 0.8986666666666666, + "kinetic_flow": 0.8432666666666667, + "kinetic_packet": 0.7512, + "packet_consistency": 0.2902, + "pna_flow": 0.13426666666666667, + "pna_packet_max": 0.43939999999999996, + "pna_packet_mean": 0.4103333333333333, + "pna_packet_median": 0.40306666666666663, + "pna_packet_trimmed10_mean": 0.3212, + "terminal_flow": 0.9765333333333333, + "terminal_norm": 0.982, + "terminal_packet": 0.8745999999999999, + "velocity_flow": 0.8247333333333333, + "velocity_flow_t01": 0.7832666666666668, + "velocity_flow_t03": 0.7971333333333332, + "velocity_flow_t05": 0.8087333333333333, + "velocity_flow_t07": 0.8208, + "velocity_flow_t09": 0.8532666666666667, + "velocity_flow_t10": 0.8437999999999999, + "velocity_packet": 0.667, + "velocity_packet_t01": 0.6607333333333334, + "velocity_packet_t03": 0.6091333333333333, + "velocity_packet_t05": 0.5994, + "velocity_packet_t07": 0.5761333333333333, + "velocity_packet_t09": 0.7823333333333332, + "velocity_packet_t10": 0.8536, + "velocity_total": 0.8896666666666667, + "velocity_total_t01": 0.8134666666666667, + "velocity_total_t03": 0.8163999999999999, + "velocity_total_t05": 0.8239333333333333, + "velocity_total_t07": 0.8702000000000001, + "velocity_total_t09": 0.9233333333333333, + "velocity_total_t10": 0.9340666666666667 + }, + "vulnerabilityscan": { + "_n": 568.0, + "arc_length": 0.7896001760563379, + "causal_surprisal_flow": 0.37931338028169015, + "causal_surprisal_packet_max": 0.4236720070422535, + "causal_surprisal_packet_mean": 0.40785950704225354, + "causal_surprisal_packet_median": 0.45916760563380277, + "causal_surprisal_packet_trimmed10_mean": 0.40543767605633807, + "causal_surprisal_total": 0.3882424295774648, + "consistency_total": 0.6821038732394366, + "curvature_flow": 0.40513978873239437, + "curvature_packet": 0.6338228873239437, + "curvature_total": 0.6026165492957746, + "direction_drift_flow": 0.2786088028169014, + "direction_drift_packet_max": 0.3726714788732394, + "direction_drift_packet_mean": 0.30886478873239437, + "direction_drift_packet_median": 0.31284084507042254, + "direction_drift_packet_trimmed10_mean": 0.31501478873239436, + "direction_drift_total": 0.2522552816901409, + "flow_consistency": 0.6827515845070423, + "jacobian_flow": 0.4965281690140845, + "jacobian_packet": 0.6143084507042254, + "jacobian_total": 0.629556338028169, + "kappa2_speed2norm_packet_mean": 0.5395408450704225, + "kappa2_speed2norm_packet_median": 0.5461239436619718, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5453642605633803, + "kinetic_energy": 0.7899234154929577, + "kinetic_flow": 0.7375971830985916, + "kinetic_packet": 0.7644235915492957, + "packet_consistency": 0.6041408450704226, + "pna_flow": 0.2441549295774648, + "pna_packet_max": 0.5204235915492957, + "pna_packet_mean": 0.5395408450704225, + "pna_packet_median": 0.5461239436619718, + "pna_packet_trimmed10_mean": 0.5453642605633803, + "terminal_flow": 0.791326056338028, + "terminal_norm": 0.8139521126760564, + "terminal_packet": 0.7980387323943663, + "velocity_flow": 0.6985950704225351, + "velocity_flow_t01": 0.5741542253521127, + "velocity_flow_t03": 0.6347823943661971, + "velocity_flow_t05": 0.6605739436619719, + "velocity_flow_t07": 0.6742609154929579, + "velocity_flow_t09": 0.7134521126760562, + "velocity_flow_t10": 0.7172781690140846, + "velocity_packet": 0.6582753521126761, + "velocity_packet_t01": 0.6383651408450703, + "velocity_packet_t03": 0.6400545774647888, + "velocity_packet_t05": 0.6341031690140846, + "velocity_packet_t07": 0.6233431338028169, + "velocity_packet_t09": 0.6807058098591549, + "velocity_packet_t10": 0.6602207746478873, + "velocity_total": 0.7245499999999999, + "velocity_total_t01": 0.6422961267605634, + "velocity_total_t03": 0.64795, + "velocity_total_t05": 0.658187323943662, + "velocity_total_t07": 0.6995605633802817, + "velocity_total_t09": 0.7544161971830986, + "velocity_total_t10": 0.752900352112676 + }, + "xss": { + "_n": 10.0, + "arc_length": 0.75782, + "causal_surprisal_flow": 0.62634, + "causal_surprisal_packet_max": 0.54782, + "causal_surprisal_packet_mean": 0.39324, + "causal_surprisal_packet_median": 0.42054, + "causal_surprisal_packet_trimmed10_mean": 0.35172000000000003, + "causal_surprisal_total": 0.57182, + "consistency_total": 0.73252, + "curvature_flow": 0.53832, + "curvature_packet": 0.75626, + "curvature_total": 0.6969799999999999, + "direction_drift_flow": 0.18202, + "direction_drift_packet_max": 0.58564, + "direction_drift_packet_mean": 0.4477, + "direction_drift_packet_median": 0.4428, + "direction_drift_packet_trimmed10_mean": 0.4147, + "direction_drift_total": 0.35778, + "flow_consistency": 0.71972, + "jacobian_flow": 0.19930000000000003, + "jacobian_packet": 0.5729, + "jacobian_total": 0.41042, + "kappa2_speed2norm_packet_mean": 0.65422, + "kappa2_speed2norm_packet_median": 0.65684, + "kappa2_speed2norm_packet_trimmed10_mean": 0.66384, + "kinetic_energy": 0.76058, + "kinetic_flow": 0.7575799999999999, + "kinetic_packet": 0.6470799999999999, + "packet_consistency": 0.69486, + "pna_flow": 0.23626000000000003, + "pna_packet_max": 0.59628, + "pna_packet_mean": 0.65422, + "pna_packet_median": 0.65684, + "pna_packet_trimmed10_mean": 0.66384, + "terminal_flow": 0.8490800000000001, + "terminal_norm": 0.81494, + "terminal_packet": 0.7334999999999999, + "velocity_flow": 0.74038, + "velocity_flow_t01": 0.7498400000000001, + "velocity_flow_t03": 0.7486, + "velocity_flow_t05": 0.7484, + "velocity_flow_t07": 0.7647999999999999, + "velocity_flow_t09": 0.76776, + "velocity_flow_t10": 0.7035000000000001, + "velocity_packet": 0.69082, + "velocity_packet_t01": 0.73216, + "velocity_packet_t03": 0.6860200000000001, + "velocity_packet_t05": 0.67054, + "velocity_packet_t07": 0.65616, + "velocity_packet_t09": 0.75034, + "velocity_packet_t10": 0.68122, + "velocity_total": 0.74256, + "velocity_total_t01": 0.75346, + "velocity_total_t03": 0.74112, + "velocity_total_t05": 0.7358600000000001, + "velocity_total_t07": 0.74674, + "velocity_total_t09": 0.7838799999999999, + "velocity_total_t10": 0.69798 + } + }, + "classes": [ + "backdoor_malware", + "commandinjection", + "ddos-ack_fragmentation", + "ddos-http_flood", + "ddos-icmp_flood", + "ddos-icmp_fragmentation", + "ddos-pshack_flood", + "ddos-rstfinflood", + "ddos-slowloris", + "ddos-syn_flood", + "ddos-synonymousip_flood", + "ddos-tcp_flood", + "ddos-udp_flood", + "ddos-udp_fragmentation", + "dictionarybruteforce", + "dns_spoofing", + "dos-http_flood", + "dos-syn_flood", + "dos-tcp_flood", + "dos-udp_flood", + "mirai-greeth_flood", + "mirai-greip_flood", + "mirai-udpplain", + "mitm-arpspoofing", + "recon-hostdiscovery", + "recon-osscan", + "recon-pingsweep", + "recon-portscan", + "sqlinjection", + "uploading_attack", + "vulnerabilityscan", + "xss" + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed43/config.yaml b/artifacts/route_comparison/baseline_ciciot2023_seed43/config.yaml new file mode 100644 index 0000000..d065df0 --- /dev/null +++ b/artifacts/route_comparison/baseline_ciciot2023_seed43/config.yaml @@ -0,0 +1,38 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 43 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_flow: 0.3 +lambda_packet: 0.3 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packet_mask_ratio: 0.5 +packet_preprocess: mixed_dequant +reference_mode: null +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed43 +seed: 43 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed43/history.json b/artifacts/route_comparison/baseline_ciciot2023_seed43/history.json new file mode 100644 index 0000000..ae43f36 --- /dev/null +++ b/artifacts/route_comparison/baseline_ciciot2023_seed43/history.json @@ -0,0 +1,243 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 2.2950437649702415, + 1.868574362534743, + 1.5989740567329602, + 1.431444987272605, + 1.312388456784762, + 1.233403850824405, + 1.1754338450920887, + 1.1244850143408165, + 1.0910462874632616, + 1.0685801276793847, + 1.0530799459188411, + 1.039206529274965, + 1.0202739880635188, + 1.0113844886804237, + 1.0095995924411676, + 1.007806081038255, + 0.9922090019935217, + 0.9931535995923556, + 0.9797547719417474, + 0.9674079632147764, + 0.9683467929179852, + 0.9629691808651655, + 0.9522877916311606, + 0.9441315531730652, + 0.9388539592425028, + 0.9517488449047773, + 0.9351213482710031, + 0.9298509130111108, + 0.9205140975805429, + 0.9184152346390945, + 0.9260153204966814, + 0.9210653243920742, + 0.9169268470544082, + 0.9252040768281008, + 0.9107780624658633, + 0.9040293953357599, + 0.9060221268580511, + 0.9034078961763626, + 0.9015775001966037, + 0.8977480163941016, + 0.894438739006336, + 0.8916474382082621, + 0.8986679101601626, + 0.8854305759454385, + 0.8926842961555872, + 0.8909683838868753, + 0.8924757440884908, + 0.8875587857686557, + 0.887593116515722, + 0.8881614483319796 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.699147255, + "auroc_curvature_flow": 0.1187566, + "auroc_curvature_packet": 0.20594331999999999, + "auroc_curvature_total": 0.12222093249999999, + "auroc_kappa2_speed2norm_packet_mean": 0.097364915, + "auroc_kappa2_speed2norm_packet_median": 0.10098897999999999, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.0939558625, + "auroc_kinetic_energy": 0.6445772275, + "auroc_kinetic_flow": 0.55212014, + "auroc_kinetic_packet": 0.715959885, + "auroc_terminal_flow": 0.9286379975000001, + "auroc_terminal_norm": 0.9432774825, + "auroc_terminal_packet": 0.910265545, + "auroc_velocity_flow": 0.7759631749999999, + "auroc_velocity_packet": 0.920632875, + "auroc_velocity_total": 0.91305936 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.8945969375, + "auroc_curvature_flow": 0.1538181825, + "auroc_curvature_packet": 0.5029852349999999, + "auroc_curvature_total": 0.2816076075, + "auroc_kappa2_speed2norm_packet_mean": 0.23579329999999998, + "auroc_kappa2_speed2norm_packet_median": 0.2344097875, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.2244808525, + "auroc_kinetic_energy": 0.8920637499999999, + "auroc_kinetic_flow": 0.84161964, + "auroc_kinetic_packet": 0.84781178, + "auroc_terminal_flow": 0.93787127, + "auroc_terminal_norm": 0.9534941375, + "auroc_terminal_packet": 0.9252923575, + "auroc_velocity_flow": 0.8306795574999999, + "auroc_velocity_packet": 0.8527189799999999, + "auroc_velocity_total": 0.896010405 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9244657275, + "auroc_curvature_flow": 0.19600490999999998, + "auroc_curvature_packet": 0.6113834975, + "auroc_curvature_total": 0.51163853, + "auroc_kappa2_speed2norm_packet_mean": 0.3295299725, + "auroc_kappa2_speed2norm_packet_median": 0.31607635749999996, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.3128781525, + "auroc_kinetic_energy": 0.92329632, + "auroc_kinetic_flow": 0.87467819, + "auroc_kinetic_packet": 0.8799545950000001, + "auroc_terminal_flow": 0.9346840350000001, + "auroc_terminal_norm": 0.9539439525000001, + "auroc_terminal_packet": 0.9415775599999999, + "auroc_velocity_flow": 0.857640935, + "auroc_velocity_packet": 0.9205819474999999, + "auroc_velocity_total": 0.9204792825 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.93741445, + "auroc_curvature_flow": 0.3338793775, + "auroc_curvature_packet": 0.7103826574999998, + "auroc_curvature_total": 0.6432187725, + "auroc_kappa2_speed2norm_packet_mean": 0.32808229250000004, + "auroc_kappa2_speed2norm_packet_median": 0.31972844999999994, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.3165096675, + "auroc_kinetic_energy": 0.9370513225, + "auroc_kinetic_flow": 0.8798084775, + "auroc_kinetic_packet": 0.9260167875, + "auroc_terminal_flow": 0.9369507174999999, + "auroc_terminal_norm": 0.95813708, + "auroc_terminal_packet": 0.947514365, + "auroc_velocity_flow": 0.864571035, + "auroc_velocity_packet": 0.919957015, + "auroc_velocity_total": 0.9209536174999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9398892025, + "auroc_curvature_flow": 0.44002931749999996, + "auroc_curvature_packet": 0.7350127875, + "auroc_curvature_total": 0.6912322300000001, + "auroc_kappa2_speed2norm_packet_mean": 0.37970512500000003, + "auroc_kappa2_speed2norm_packet_median": 0.37325295999999997, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.3690063775, + "auroc_kinetic_energy": 0.9396714625, + "auroc_kinetic_flow": 0.885755735, + "auroc_kinetic_packet": 0.9318806875000001, + "auroc_terminal_flow": 0.9350286, + "auroc_terminal_norm": 0.9603808925, + "auroc_terminal_packet": 0.9518623049999999, + "auroc_velocity_flow": 0.8692447400000001, + "auroc_velocity_packet": 0.9252954525000001, + "auroc_velocity_total": 0.9225248100000001 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed43/model.pt b/artifacts/route_comparison/baseline_ciciot2023_seed43/model.pt new file mode 100644 index 0000000..94e164a Binary files /dev/null and b/artifacts/route_comparison/baseline_ciciot2023_seed43/model.pt differ diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed43/phase1.log b/artifacts/route_comparison/baseline_ciciot2023_seed43/phase1.log new file mode 100644 index 0000000..cbfa9da --- /dev/null +++ b/artifacts/route_comparison/baseline_ciciot2023_seed43/phase1.log @@ -0,0 +1,134 @@ +[config] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed43/config.yaml +[model] T=64 flow_dim=20 packet_dim=9 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets_source=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] using external flow features D=20 +[data] rows total=8,193,621 keep len>=2: 3,797,530 +[data] benign=97,045 attack=20,000 -> train=77,636 val=10,000 +[data] train=77,636 val=10,000 attack=20,000 +[eval] scoring val=5,000 and attack=10,000 +/home/chy/mambafortrafficmodeling/.venv/lib/python3.14/site-packages/torch/autograd/graph.py:869: UserWarning: Attempting to run cuBLAS, but there was no current CUDA context! Attempting to set the primary context... (Triggered internally at /pytorch/aten/src/ATen/cuda/CublasHandlePool.cpp:335.) + return Variable._execution_engine.run_backward( # Calls into the C++ engine to run the backward pass +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done in 12.2s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] attack done in 22.3s +[eval] score keys: 57 first 5: ['arc_length', 'causal_surprisal_flow', 'causal_surprisal_packet_max', 'causal_surprisal_packet_mean', 'causal_surprisal_packet_median'] +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed43/phase1_summary.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed43/phase1_scores.npz + +=== overall AUROC (sorted desc) === + terminal_norm AUROC=0.9600 AUPRC=0.9815 + terminal_packet AUROC=0.9507 AUPRC=0.9771 + arc_length AUROC=0.9435 AUPRC=0.9693 + kinetic_energy AUROC=0.9432 AUPRC=0.9693 + velocity_total_t09 AUROC=0.9370 AUPRC=0.9463 + velocity_total_t10 AUROC=0.9356 AUPRC=0.9490 + terminal_flow AUROC=0.9340 AUPRC=0.9614 + velocity_packet_t09 AUROC=0.9335 AUPRC=0.9665 + kinetic_packet AUROC=0.9285 AUPRC=0.9674 + velocity_packet AUROC=0.9276 AUPRC=0.9611 + velocity_packet_t10 AUROC=0.9271 AUPRC=0.9666 + velocity_total AUROC=0.9268 AUPRC=0.9379 + consistency_total AUROC=0.9215 AUPRC=0.9558 + velocity_total_t07 AUROC=0.9212 AUPRC=0.9350 + velocity_packet_t07 AUROC=0.9178 AUPRC=0.9560 + velocity_total_t05 AUROC=0.9024 AUPRC=0.9219 + flow_consistency AUROC=0.8973 AUPRC=0.9453 + kinetic_flow AUROC=0.8908 AUPRC=0.8893 + velocity_packet_t05 AUROC=0.8883 AUPRC=0.9328 + velocity_flow_t09 AUROC=0.8862 AUPRC=0.8757 + velocity_total_t03 AUROC=0.8850 AUPRC=0.9114 + velocity_flow_t10 AUROC=0.8846 AUPRC=0.8733 + velocity_total_t01 AUROC=0.8782 AUPRC=0.9080 + velocity_flow AUROC=0.8741 AUPRC=0.8689 + velocity_flow_t07 AUROC=0.8703 AUPRC=0.8693 + velocity_packet_t03 AUROC=0.8673 AUPRC=0.9135 + velocity_packet_t01 AUROC=0.8562 AUPRC=0.8992 + velocity_flow_t05 AUROC=0.8438 AUPRC=0.8576 + velocity_flow_t03 AUROC=0.8289 AUPRC=0.8547 + velocity_flow_t01 AUROC=0.8231 AUPRC=0.8524 + packet_consistency AUROC=0.7774 AUPRC=0.8895 + curvature_packet AUROC=0.6182 AUPRC=0.7438 + jacobian_packet AUROC=0.5966 AUPRC=0.7933 + curvature_total AUROC=0.5450 AUPRC=0.6988 + causal_surprisal_flow AUROC=0.4978 AUPRC=0.6213 + causal_surprisal_packet_max AUROC=0.4797 AUPRC=0.6083 + causal_surprisal_total AUROC=0.4709 AUPRC=0.6254 + causal_surprisal_packet_mean AUROC=0.4117 AUPRC=0.5757 + jacobian_total AUROC=0.3695 AUPRC=0.6578 + causal_surprisal_packet_trimmed10_mean AUROC=0.3322 AUPRC=0.5646 + causal_surprisal_packet_median AUROC=0.3005 AUPRC=0.5646 + pna_packet_max AUROC=0.2747 AUPRC=0.5503 + curvature_flow AUROC=0.2553 AUPRC=0.5427 + kappa2_speed2norm_packet_mean AUROC=0.2033 AUPRC=0.5206 + pna_packet_mean AUROC=0.2033 AUPRC=0.5206 + kappa2_speed2norm_packet_median AUROC=0.1974 AUPRC=0.5174 + pna_packet_median AUROC=0.1974 AUPRC=0.5174 + kappa2_speed2norm_packet_trimmed10_mean AUROC=0.1939 AUPRC=0.5177 + pna_packet_trimmed10_mean AUROC=0.1939 AUPRC=0.5177 + jacobian_flow AUROC=0.1631 AUPRC=0.4881 + direction_drift_packet_max AUROC=0.1574 AUPRC=0.5080 + direction_drift_flow AUROC=0.1100 AUPRC=0.4722 + direction_drift_packet_median AUROC=0.0943 AUPRC=0.4711 + direction_drift_packet_trimmed10_mean AUROC=0.0905 AUPRC=0.4694 + direction_drift_packet_mean AUROC=0.0902 AUPRC=0.4700 + direction_drift_total AUROC=0.0771 AUPRC=0.4655 + pna_flow AUROC=0.0675 AUPRC=0.4619 diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed43/phase1_scores.npz b/artifacts/route_comparison/baseline_ciciot2023_seed43/phase1_scores.npz new file mode 100644 index 0000000..a6e9043 Binary files /dev/null and b/artifacts/route_comparison/baseline_ciciot2023_seed43/phase1_scores.npz differ diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed43/phase1_summary.json b/artifacts/route_comparison/baseline_ciciot2023_seed43/phase1_summary.json new file mode 100644 index 0000000..8a332b5 --- /dev/null +++ b/artifacts/route_comparison/baseline_ciciot2023_seed43/phase1_summary.json @@ -0,0 +1,2293 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed43", + "config": { + "T": 64, + "attack_cap": 20000, + "batch_size": 256, + "benign_label": "normal", + "d_model": 128, + "data_seed": 43, + "device": "auto", + "epochs": 50, + "eval_batch_size": 512, + "eval_every": 10, + "eval_n": 20000, + "eval_n_steps": 8, + "flow_features_align": "auto", + "flow_features_path": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet", + "flows_parquet": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet", + "grad_clip": 1.0, + "lambda_flow": 0.3, + "lambda_packet": 0.3, + "lr": 0.0003, + "min_len": 2, + "mlp_ratio": 4.0, + "n_heads": 4, + "n_layers": 4, + "n_train": 10000, + "num_workers": 0, + "packet_mask_ratio": 0.5, + "packet_preprocess": "mixed_dequant", + "reference_mode": null, + "save_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed43", + "seed": 43, + "sigma": 0.1, + "source_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "time_dim": 64, + "token_dim": null, + "train_ratio": 0.8, + "use_ot": true, + "val_cap": 10000, + "weight_decay": 0.01 + }, + "n_val": 5000, + "n_atk": 10000, + "n_score_keys": 57, + "overall": { + "arc_length": { + "auroc": 0.9435292399999999, + "auprc": 0.9692990678370209 + }, + "causal_surprisal_flow": { + "auroc": 0.49781495000000003, + "auprc": 0.6213249854341704 + }, + "causal_surprisal_packet_max": { + "auroc": 0.47974083, + "auprc": 0.6083306406631723 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.41168639, + "auprc": 0.5757127309878074 + }, + "causal_surprisal_packet_median": { + "auroc": 0.30054515, + "auprc": 0.5645732931132952 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.33218643999999997, + "auprc": 0.564572983155804 + }, + "causal_surprisal_total": { + "auroc": 0.47093767000000003, + "auprc": 0.6253663191604206 + }, + "consistency_total": { + "auroc": 0.92152416, + "auprc": 0.9557954302219689 + }, + "curvature_flow": { + "auroc": 0.25526627, + "auprc": 0.5426906541235881 + }, + "curvature_packet": { + "auroc": 0.61822863, + "auprc": 0.7437971907724519 + }, + "curvature_total": { + "auroc": 0.54498698, + "auprc": 0.6987728424478132 + }, + "direction_drift_flow": { + "auroc": 0.10997728, + "auprc": 0.472166547510116 + }, + "direction_drift_packet_max": { + "auroc": 0.15742066000000002, + "auprc": 0.5080145250288411 + }, + "direction_drift_packet_mean": { + "auroc": 0.09017852000000001, + "auprc": 0.469993501001589 + }, + "direction_drift_packet_median": { + "auroc": 0.09425802999999999, + "auprc": 0.4711294508633868 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.0904899, + "auprc": 0.46941089373728917 + }, + "direction_drift_total": { + "auroc": 0.07709447999999999, + "auprc": 0.4654845220031333 + }, + "flow_consistency": { + "auroc": 0.89725332, + "auprc": 0.9453067054967619 + }, + "jacobian_flow": { + "auroc": 0.16310883999999998, + "auprc": 0.4881306079932467 + }, + "jacobian_packet": { + "auroc": 0.59664688, + "auprc": 0.79326483055366 + }, + "jacobian_total": { + "auroc": 0.36948707000000003, + "auprc": 0.6577624439518036 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.2033052, + "auprc": 0.5205545288784557 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.19744162, + "auprc": 0.517374099860817 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.19390969, + "auprc": 0.5177355890499058 + }, + "kinetic_energy": { + "auroc": 0.9432423000000001, + "auprc": 0.9692659007481593 + }, + "kinetic_flow": { + "auroc": 0.8908330000000001, + "auprc": 0.8892858045458525 + }, + "kinetic_packet": { + "auroc": 0.92852548, + "auprc": 0.9673605636192588 + }, + "packet_consistency": { + "auroc": 0.7773767599999999, + "auprc": 0.8894867602480774 + }, + "pna_flow": { + "auroc": 0.06747348, + "auprc": 0.4619427909518728 + }, + "pna_packet_max": { + "auroc": 0.27471230999999996, + "auprc": 0.5502762685996132 + }, + "pna_packet_mean": { + "auroc": 0.2033052, + "auprc": 0.5205545288784557 + }, + "pna_packet_median": { + "auroc": 0.19744162, + "auprc": 0.517374099860817 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.19390969, + "auprc": 0.5177355890499058 + }, + "terminal_flow": { + "auroc": 0.93399552, + "auprc": 0.9614181438925067 + }, + "terminal_norm": { + "auroc": 0.9599963800000001, + "auprc": 0.9814673360334152 + }, + "terminal_packet": { + "auroc": 0.9507029399999999, + "auprc": 0.977071111554133 + }, + "velocity_flow": { + "auroc": 0.87410956, + "auprc": 0.8688800635992687 + }, + "velocity_flow_t01": { + "auroc": 0.82311148, + "auprc": 0.8523578283462288 + }, + "velocity_flow_t03": { + "auroc": 0.8289385199999999, + "auprc": 0.854744259010866 + }, + "velocity_flow_t05": { + "auroc": 0.8438427199999999, + "auprc": 0.8575992750572111 + }, + "velocity_flow_t07": { + "auroc": 0.87033777, + "auprc": 0.8693489621125359 + }, + "velocity_flow_t09": { + "auroc": 0.8862068399999999, + "auprc": 0.8757296481256689 + }, + "velocity_flow_t10": { + "auroc": 0.88463378, + "auprc": 0.8733255421436692 + }, + "velocity_packet": { + "auroc": 0.9276212, + "auprc": 0.961063942490798 + }, + "velocity_packet_t01": { + "auroc": 0.8562093299999999, + "auprc": 0.8992455950228804 + }, + "velocity_packet_t03": { + "auroc": 0.86728549, + "auprc": 0.9135345679526669 + }, + "velocity_packet_t05": { + "auroc": 0.88832854, + "auprc": 0.9327777580513678 + }, + "velocity_packet_t07": { + "auroc": 0.9178384399999999, + "auprc": 0.9559847296799289 + }, + "velocity_packet_t09": { + "auroc": 0.93354019, + "auprc": 0.9664904803103352 + }, + "velocity_packet_t10": { + "auroc": 0.92706288, + "auprc": 0.9666184840582799 + }, + "velocity_total": { + "auroc": 0.9268445899999999, + "auprc": 0.9379078238513971 + }, + "velocity_total_t01": { + "auroc": 0.87815448, + "auprc": 0.90800077796983 + }, + "velocity_total_t03": { + "auroc": 0.88500124, + "auprc": 0.9113725526707219 + }, + "velocity_total_t05": { + "auroc": 0.90236614, + "auprc": 0.921881550427565 + }, + "velocity_total_t07": { + "auroc": 0.92119725, + "auprc": 0.9350014383176435 + }, + "velocity_total_t09": { + "auroc": 0.9370244999999999, + "auprc": 0.9463361940797502 + }, + "velocity_total_t10": { + "auroc": 0.93555818, + "auprc": 0.9489951254769822 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 9.0, + "arc_length": 0.8512222222222222, + "causal_surprisal_flow": 0.6517555555555554, + "causal_surprisal_packet_max": 0.4978, + "causal_surprisal_packet_mean": 0.4795333333333333, + "causal_surprisal_packet_median": 0.45453333333333334, + "causal_surprisal_packet_trimmed10_mean": 0.4416444444444444, + "causal_surprisal_total": 0.5554666666666667, + "consistency_total": 0.6071555555555557, + "curvature_flow": 0.5186222222222223, + "curvature_packet": 0.6726888888888889, + "curvature_total": 0.6565555555555556, + "direction_drift_flow": 0.1792444444444444, + "direction_drift_packet_max": 0.2828, + "direction_drift_packet_mean": 0.1562222222222222, + "direction_drift_packet_median": 0.19448888888888888, + "direction_drift_packet_trimmed10_mean": 0.18395555555555554, + "direction_drift_total": 0.13982222222222224, + "flow_consistency": 0.6230222222222221, + "jacobian_flow": 0.3158444444444444, + "jacobian_packet": 0.2742222222222222, + "jacobian_total": 0.34477777777777774, + "kappa2_speed2norm_packet_mean": 0.4820444444444444, + "kappa2_speed2norm_packet_median": 0.46904444444444443, + "kappa2_speed2norm_packet_trimmed10_mean": 0.49233333333333335, + "kinetic_energy": 0.8473555555555555, + "kinetic_flow": 0.8489777777777778, + "kinetic_packet": 0.7635111111111111, + "packet_consistency": 0.4735555555555555, + "pna_flow": 0.15093333333333334, + "pna_packet_max": 0.4936222222222222, + "pna_packet_mean": 0.4820444444444444, + "pna_packet_median": 0.46904444444444443, + "pna_packet_trimmed10_mean": 0.49233333333333335, + "terminal_flow": 0.9235111111111111, + "terminal_norm": 0.9112444444444445, + "terminal_packet": 0.844288888888889, + "velocity_flow": 0.8171777777777778, + "velocity_flow_t01": 0.6931777777777777, + "velocity_flow_t03": 0.7188888888888889, + "velocity_flow_t05": 0.7593333333333333, + "velocity_flow_t07": 0.7963111111111111, + "velocity_flow_t09": 0.8640888888888889, + "velocity_flow_t10": 0.8554, + "velocity_packet": 0.7783111111111111, + "velocity_packet_t01": 0.6414444444444445, + "velocity_packet_t03": 0.6534888888888888, + "velocity_packet_t05": 0.6747777777777777, + "velocity_packet_t07": 0.7428444444444445, + "velocity_packet_t09": 0.8301777777777779, + "velocity_packet_t10": 0.8517555555555556, + "velocity_total": 0.859111111111111, + "velocity_total_t01": 0.6765111111111111, + "velocity_total_t03": 0.7395555555555555, + "velocity_total_t05": 0.7799111111111111, + "velocity_total_t07": 0.8223111111111111, + "velocity_total_t09": 0.9174666666666667, + "velocity_total_t10": 0.8927111111111111 + }, + "browserhijacking": { + "_n": 3.0, + "arc_length": 0.9308000000000001, + "causal_surprisal_flow": 0.5096, + "causal_surprisal_packet_max": 0.3731333333333333, + "causal_surprisal_packet_mean": 0.21706666666666666, + "causal_surprisal_packet_median": 0.22379999999999997, + "causal_surprisal_packet_trimmed10_mean": 0.19899999999999998, + "causal_surprisal_total": 0.3371333333333333, + "consistency_total": 0.9480000000000001, + "curvature_flow": 0.5487333333333333, + "curvature_packet": 0.4618, + "curvature_total": 0.5134666666666666, + "direction_drift_flow": 0.2624666666666666, + "direction_drift_packet_max": 0.23539999999999994, + "direction_drift_packet_mean": 0.22799999999999998, + "direction_drift_packet_median": 0.23633333333333334, + "direction_drift_packet_trimmed10_mean": 0.24039999999999997, + "direction_drift_total": 0.18353333333333335, + "flow_consistency": 0.9141333333333332, + "jacobian_flow": 0.34419999999999995, + "jacobian_packet": 0.3607333333333333, + "jacobian_total": 0.42233333333333334, + "kappa2_speed2norm_packet_mean": 0.2502, + "kappa2_speed2norm_packet_median": 0.2794, + "kappa2_speed2norm_packet_trimmed10_mean": 0.24839999999999995, + "kinetic_energy": 0.9295333333333333, + "kinetic_flow": 0.8285333333333333, + "kinetic_packet": 0.8920666666666667, + "packet_consistency": 0.7002666666666666, + "pna_flow": 0.30619999999999997, + "pna_packet_max": 0.29079999999999995, + "pna_packet_mean": 0.2502, + "pna_packet_median": 0.2794, + "pna_packet_trimmed10_mean": 0.24839999999999995, + "terminal_flow": 0.8013333333333332, + "terminal_norm": 0.8447333333333333, + "terminal_packet": 0.8602666666666666, + "velocity_flow": 0.7515333333333333, + "velocity_flow_t01": 0.6514, + "velocity_flow_t03": 0.6766666666666666, + "velocity_flow_t05": 0.7221333333333333, + "velocity_flow_t07": 0.7342, + "velocity_flow_t09": 0.8001333333333334, + "velocity_flow_t10": 0.8205333333333333, + "velocity_packet": 0.7557999999999999, + "velocity_packet_t01": 0.6098, + "velocity_packet_t03": 0.5983999999999999, + "velocity_packet_t05": 0.5746666666666667, + "velocity_packet_t07": 0.6769333333333333, + "velocity_packet_t09": 0.7361333333333333, + "velocity_packet_t10": 0.8033333333333333, + "velocity_total": 0.7762, + "velocity_total_t01": 0.6302666666666666, + "velocity_total_t03": 0.6932666666666666, + "velocity_total_t05": 0.7144, + "velocity_total_t07": 0.7331333333333333, + "velocity_total_t09": 0.7898666666666667, + "velocity_total_t10": 0.8128666666666666 + }, + "commandinjection": { + "_n": 13.0, + "arc_length": 0.8118, + "causal_surprisal_flow": 0.6074923076923077, + "causal_surprisal_packet_max": 0.5001692307692307, + "causal_surprisal_packet_mean": 0.3548615384615385, + "causal_surprisal_packet_median": 0.25683076923076925, + "causal_surprisal_packet_trimmed10_mean": 0.27987692307692313, + "causal_surprisal_total": 0.4478307692307692, + "consistency_total": 0.6930000000000001, + "curvature_flow": 0.5624461538461538, + "curvature_packet": 0.7184615384615385, + "curvature_total": 0.7167846153846154, + "direction_drift_flow": 0.13995384615384615, + "direction_drift_packet_max": 0.3289846153846154, + "direction_drift_packet_mean": 0.3143846153846154, + "direction_drift_packet_median": 0.3255538461538462, + "direction_drift_packet_trimmed10_mean": 0.30023076923076925, + "direction_drift_total": 0.25035384615384615, + "flow_consistency": 0.6862307692307692, + "jacobian_flow": 0.13372307692307692, + "jacobian_packet": 0.3120923076923077, + "jacobian_total": 0.18653846153846154, + "kappa2_speed2norm_packet_mean": 0.5214769230769232, + "kappa2_speed2norm_packet_median": 0.5293076923076924, + "kappa2_speed2norm_packet_trimmed10_mean": 0.519123076923077, + "kinetic_energy": 0.8068307692307692, + "kinetic_flow": 0.8402000000000001, + "kinetic_packet": 0.674523076923077, + "packet_consistency": 0.5097692307692308, + "pna_flow": 0.17120000000000002, + "pna_packet_max": 0.551276923076923, + "pna_packet_mean": 0.5214769230769232, + "pna_packet_median": 0.5293076923076924, + "pna_packet_trimmed10_mean": 0.519123076923077, + "terminal_flow": 0.8617846153846155, + "terminal_norm": 0.8561846153846154, + "terminal_packet": 0.7774230769230769, + "velocity_flow": 0.8433384615384615, + "velocity_flow_t01": 0.8428, + "velocity_flow_t03": 0.8411846153846154, + "velocity_flow_t05": 0.8390923076923077, + "velocity_flow_t07": 0.8393692307692308, + "velocity_flow_t09": 0.8672153846153847, + "velocity_flow_t10": 0.8645846153846154, + "velocity_packet": 0.7108461538461538, + "velocity_packet_t01": 0.7454923076923077, + "velocity_packet_t03": 0.7305999999999999, + "velocity_packet_t05": 0.7223384615384616, + "velocity_packet_t07": 0.687876923076923, + "velocity_packet_t09": 0.7104, + "velocity_packet_t10": 0.7296615384615385, + "velocity_total": 0.8412000000000001, + "velocity_total_t01": 0.8261538461538461, + "velocity_total_t03": 0.8255076923076924, + "velocity_total_t05": 0.8283384615384616, + "velocity_total_t07": 0.8325692307692307, + "velocity_total_t09": 0.8606769230769231, + "velocity_total_t10": 0.8525230769230769 + }, + "ddos-ack_fragmentation": { + "_n": 316.0, + "arc_length": 0.9834784810126582, + "causal_surprisal_flow": 0.30823132911392404, + "causal_surprisal_packet_max": 0.3112854430379747, + "causal_surprisal_packet_mean": 0.30116740506329115, + "causal_surprisal_packet_median": 0.3801113924050633, + "causal_surprisal_packet_trimmed10_mean": 0.31967151898734175, + "causal_surprisal_total": 0.3591025316455696, + "consistency_total": 0.9602626582278481, + "curvature_flow": 0.13044430379746835, + "curvature_packet": 0.9614034810126583, + "curvature_total": 0.8458246835443037, + "direction_drift_flow": 0.1188740506329114, + "direction_drift_packet_max": 0.07643132911392406, + "direction_drift_packet_mean": 0.0730382911392405, + "direction_drift_packet_median": 0.08779113924050633, + "direction_drift_packet_trimmed10_mean": 0.08410443037974684, + "direction_drift_total": 0.040062025316455696, + "flow_consistency": 0.9562981012658227, + "jacobian_flow": 0.028406962025316458, + "jacobian_packet": 0.8997993670886075, + "jacobian_total": 0.3307430379746836, + "kappa2_speed2norm_packet_mean": 0.3232867088607595, + "kappa2_speed2norm_packet_median": 0.34119556962025316, + "kappa2_speed2norm_packet_trimmed10_mean": 0.34115569620253167, + "kinetic_energy": 0.9833341772151898, + "kinetic_flow": 0.9253139240506327, + "kinetic_packet": 0.9772101265822786, + "packet_consistency": 0.9537835443037974, + "pna_flow": 0.024432278481012665, + "pna_packet_max": 0.30476898734177216, + "pna_packet_mean": 0.3232867088607595, + "pna_packet_median": 0.34119556962025316, + "pna_packet_trimmed10_mean": 0.34115569620253167, + "terminal_flow": 0.990503164556962, + "terminal_norm": 0.990959493670886, + "terminal_packet": 0.985156329113924, + "velocity_flow": 0.9077082278481012, + "velocity_flow_t01": 0.9435113924050632, + "velocity_flow_t03": 0.935459493670886, + "velocity_flow_t05": 0.9253702531645569, + "velocity_flow_t07": 0.9119911392405063, + "velocity_flow_t09": 0.9022183544303798, + "velocity_flow_t10": 0.8916000000000001, + "velocity_packet": 0.97631582278481, + "velocity_packet_t01": 0.9500582278481012, + "velocity_packet_t03": 0.9529151898734177, + "velocity_packet_t05": 0.9654215189873417, + "velocity_packet_t07": 0.9770348101265823, + "velocity_packet_t09": 0.9794303797468354, + "velocity_packet_t10": 0.9679905063291139, + "velocity_total": 0.9791386075949368, + "velocity_total_t01": 0.9817981012658227, + "velocity_total_t03": 0.9796050632911393, + "velocity_total_t05": 0.9792658227848101, + "velocity_total_t07": 0.980359493670886, + "velocity_total_t09": 0.9782113924050633, + "velocity_total_t10": 0.9741829113924051 + }, + "ddos-http_flood": { + "_n": 915.0, + "arc_length": 0.9613562841530054, + "causal_surprisal_flow": 0.4919993442622951, + "causal_surprisal_packet_max": 0.34746469945355196, + "causal_surprisal_packet_mean": 0.32474360655737705, + "causal_surprisal_packet_median": 0.3056904918032787, + "causal_surprisal_packet_trimmed10_mean": 0.28836808743169395, + "causal_surprisal_total": 0.4646354098360656, + "consistency_total": 0.9635809836065574, + "curvature_flow": 0.28460918032786886, + "curvature_packet": 0.6692286338797814, + "curvature_total": 0.5875656830601093, + "direction_drift_flow": 0.12657234972677595, + "direction_drift_packet_max": 0.19885136612021856, + "direction_drift_packet_mean": 0.09499737704918033, + "direction_drift_packet_median": 0.09341508196721313, + "direction_drift_packet_trimmed10_mean": 0.09371868852459016, + "direction_drift_total": 0.08551562841530055, + "flow_consistency": 0.9470043715846995, + "jacobian_flow": 0.25112087431693986, + "jacobian_packet": 0.6291547540983606, + "jacobian_total": 0.48551442622950813, + "kappa2_speed2norm_packet_mean": 0.3130074316939891, + "kappa2_speed2norm_packet_median": 0.3116574863387978, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3098601092896175, + "kinetic_energy": 0.9610939890710383, + "kinetic_flow": 0.8917809836065573, + "kinetic_packet": 0.9552572677595629, + "packet_consistency": 0.8040698360655738, + "pna_flow": 0.053186666666666674, + "pna_packet_max": 0.3408987978142077, + "pna_packet_mean": 0.3130074316939891, + "pna_packet_median": 0.3116574863387978, + "pna_packet_trimmed10_mean": 0.3098601092896175, + "terminal_flow": 0.9700784699453554, + "terminal_norm": 0.991686994535519, + "terminal_packet": 0.9853079781420765, + "velocity_flow": 0.8750218579234972, + "velocity_flow_t01": 0.7406511475409836, + "velocity_flow_t03": 0.7660786885245902, + "velocity_flow_t05": 0.8350153005464481, + "velocity_flow_t07": 0.8702360655737704, + "velocity_flow_t09": 0.8951628415300548, + "velocity_flow_t10": 0.897311038251366, + "velocity_packet": 0.9401713661202186, + "velocity_packet_t01": 0.8561667759562842, + "velocity_packet_t03": 0.8488557377049181, + "velocity_packet_t05": 0.8825104918032788, + "velocity_packet_t07": 0.9339374863387979, + "velocity_packet_t09": 0.9531503825136612, + "velocity_packet_t10": 0.9289025136612021, + "velocity_total": 0.9384128961748633, + "velocity_total_t01": 0.8582977049180328, + "velocity_total_t03": 0.8714751912568305, + "velocity_total_t05": 0.9087809836065573, + "velocity_total_t07": 0.9310853551912569, + "velocity_total_t09": 0.9571193442622951, + "velocity_total_t10": 0.9534972677595629 + }, + "ddos-icmp_flood": { + "_n": 20.0, + "arc_length": 0.65821, + "causal_surprisal_flow": 0.40739000000000003, + "causal_surprisal_packet_max": 0.42707000000000006, + "causal_surprisal_packet_mean": 0.42939, + "causal_surprisal_packet_median": 0.41011999999999993, + "causal_surprisal_packet_trimmed10_mean": 0.43002999999999997, + "causal_surprisal_total": 0.43702, + "consistency_total": 0.60938, + "curvature_flow": 0.37922999999999996, + "curvature_packet": 0.56583, + "curvature_total": 0.54089, + "direction_drift_flow": 0.21026999999999998, + "direction_drift_packet_max": 0.32266, + "direction_drift_packet_mean": 0.38059, + "direction_drift_packet_median": 0.41721, + "direction_drift_packet_trimmed10_mean": 0.40693999999999997, + "direction_drift_total": 0.24329, + "flow_consistency": 0.6215700000000001, + "jacobian_flow": 0.43035, + "jacobian_packet": 0.50289, + "jacobian_total": 0.49310000000000004, + "kappa2_speed2norm_packet_mean": 0.47127, + "kappa2_speed2norm_packet_median": 0.4849, + "kappa2_speed2norm_packet_trimmed10_mean": 0.48228, + "kinetic_energy": 0.66069, + "kinetic_flow": 0.6228, + "kinetic_packet": 0.61789, + "packet_consistency": 0.57297, + "pna_flow": 0.42921000000000004, + "pna_packet_max": 0.45844999999999997, + "pna_packet_mean": 0.47127, + "pna_packet_median": 0.4849, + "pna_packet_trimmed10_mean": 0.48228, + "terminal_flow": 0.6881999999999999, + "terminal_norm": 0.73634, + "terminal_packet": 0.7154900000000001, + "velocity_flow": 0.61141, + "velocity_flow_t01": 0.59117, + "velocity_flow_t03": 0.5981799999999999, + "velocity_flow_t05": 0.60511, + "velocity_flow_t07": 0.6197699999999999, + "velocity_flow_t09": 0.66117, + "velocity_flow_t10": 0.5887800000000001, + "velocity_packet": 0.5673100000000001, + "velocity_packet_t01": 0.5824499999999999, + "velocity_packet_t03": 0.57833, + "velocity_packet_t05": 0.57693, + "velocity_packet_t07": 0.5898800000000001, + "velocity_packet_t09": 0.57816, + "velocity_packet_t10": 0.56077, + "velocity_total": 0.59797, + "velocity_total_t01": 0.6005900000000001, + "velocity_total_t03": 0.59789, + "velocity_total_t05": 0.60397, + "velocity_total_t07": 0.6194500000000001, + "velocity_total_t09": 0.66528, + "velocity_total_t10": 0.58065 + }, + "ddos-icmp_fragmentation": { + "_n": 38.0, + "arc_length": 0.7982473684210526, + "causal_surprisal_flow": 0.506878947368421, + "causal_surprisal_packet_max": 0.3867578947368421, + "causal_surprisal_packet_mean": 0.3748736842105263, + "causal_surprisal_packet_median": 0.3793578947368421, + "causal_surprisal_packet_trimmed10_mean": 0.3653263157894736, + "causal_surprisal_total": 0.5390894736842105, + "consistency_total": 0.7929684210526315, + "curvature_flow": 0.45343684210526314, + "curvature_packet": 0.631078947368421, + "curvature_total": 0.640421052631579, + "direction_drift_flow": 0.2217105263157895, + "direction_drift_packet_max": 0.3417631578947369, + "direction_drift_packet_mean": 0.42733421052631576, + "direction_drift_packet_median": 0.4442131578947368, + "direction_drift_packet_trimmed10_mean": 0.44723421052631573, + "direction_drift_total": 0.3029052631578947, + "flow_consistency": 0.8181105263157894, + "jacobian_flow": 0.3783789473684211, + "jacobian_packet": 0.43149473684210526, + "jacobian_total": 0.4461578947368421, + "kappa2_speed2norm_packet_mean": 0.5128315789473684, + "kappa2_speed2norm_packet_median": 0.5251473684210526, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5309368421052632, + "kinetic_energy": 0.7981263157894737, + "kinetic_flow": 0.7209842105263159, + "kinetic_packet": 0.7391473684210527, + "packet_consistency": 0.4341736842105263, + "pna_flow": 0.24825789473684207, + "pna_packet_max": 0.46447894736842105, + "pna_packet_mean": 0.5128315789473684, + "pna_packet_median": 0.5251473684210526, + "pna_packet_trimmed10_mean": 0.5309368421052632, + "terminal_flow": 0.8138947368421053, + "terminal_norm": 0.8478736842105262, + "terminal_packet": 0.7743026315789474, + "velocity_flow": 0.7268684210526316, + "velocity_flow_t01": 0.6479210526315788, + "velocity_flow_t03": 0.6764684210526315, + "velocity_flow_t05": 0.6969052631578948, + "velocity_flow_t07": 0.717257894736842, + "velocity_flow_t09": 0.7595526315789474, + "velocity_flow_t10": 0.7547736842105263, + "velocity_packet": 0.5802421052631579, + "velocity_packet_t01": 0.5772736842105263, + "velocity_packet_t03": 0.5675842105263158, + "velocity_packet_t05": 0.5599421052631579, + "velocity_packet_t07": 0.5531736842105264, + "velocity_packet_t09": 0.5593, + "velocity_packet_t10": 0.6211052631578947, + "velocity_total": 0.7539684210526316, + "velocity_total_t01": 0.6617421052631579, + "velocity_total_t03": 0.6756263157894737, + "velocity_total_t05": 0.7065421052631579, + "velocity_total_t07": 0.741742105263158, + "velocity_total_t09": 0.7773315789473684, + "velocity_total_t10": 0.7429210526315789 + }, + "ddos-pshack_flood": { + "_n": 1046.0, + "arc_length": 0.9869346080305927, + "causal_surprisal_flow": 0.5530145315487571, + "causal_surprisal_packet_max": 0.5445665391969408, + "causal_surprisal_packet_mean": 0.40352198852772464, + "causal_surprisal_packet_median": 0.15204665391969407, + "causal_surprisal_packet_trimmed10_mean": 0.22847399617590824, + "causal_surprisal_total": 0.487606500956023, + "consistency_total": 0.9440151051625238, + "curvature_flow": 0.374834034416826, + "curvature_packet": 0.6693286806883364, + "curvature_total": 0.6265254302103251, + "direction_drift_flow": 0.03953422562141491, + "direction_drift_packet_max": 0.07975812619502869, + "direction_drift_packet_mean": 0.009898661567877637, + "direction_drift_packet_median": 0.010279349904397703, + "direction_drift_packet_trimmed10_mean": 0.010642447418738047, + "direction_drift_total": 0.0053535372848948415, + "flow_consistency": 0.839685277246654, + "jacobian_flow": 0.02887418738049713, + "jacobian_packet": 0.39160124282982794, + "jacobian_total": 0.1409925430210325, + "kappa2_speed2norm_packet_mean": 0.08332390057361377, + "kappa2_speed2norm_packet_median": 0.06254216061185469, + "kappa2_speed2norm_packet_trimmed10_mean": 0.06586883365200766, + "kinetic_energy": 0.9866885277246653, + "kinetic_flow": 0.9557325047801147, + "kinetic_packet": 0.9850437858508606, + "packet_consistency": 0.8431207456978967, + "pna_flow": 0.0315, + "pna_packet_max": 0.1967013384321224, + "pna_packet_mean": 0.08332390057361377, + "pna_packet_median": 0.06254216061185469, + "pna_packet_trimmed10_mean": 0.06586883365200766, + "terminal_flow": 0.9068439770554494, + "terminal_norm": 0.9833598470363288, + "terminal_packet": 0.9847533460803058, + "velocity_flow": 0.9367422562141491, + "velocity_flow_t01": 0.9424822179732314, + "velocity_flow_t03": 0.946831931166348, + "velocity_flow_t05": 0.9414546845124283, + "velocity_flow_t07": 0.9422446462715104, + "velocity_flow_t09": 0.9381220841300192, + "velocity_flow_t10": 0.9321942638623327, + "velocity_packet": 0.9931158699808795, + "velocity_packet_t01": 0.9742837476099427, + "velocity_packet_t03": 0.9816944550669217, + "velocity_packet_t05": 0.9877795411089867, + "velocity_packet_t07": 0.9920191204588911, + "velocity_packet_t09": 0.9926697896749522, + "velocity_packet_t10": 0.9956210325047801, + "velocity_total": 0.9819355640535374, + "velocity_total_t01": 0.9725304015296367, + "velocity_total_t03": 0.9757434034416826, + "velocity_total_t05": 0.9784395793499044, + "velocity_total_t07": 0.9803233269598471, + "velocity_total_t09": 0.9823118546845124, + "velocity_total_t10": 0.9850787762906309 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "arc_length": 0.5284, + "causal_surprisal_flow": 0.4293, + "causal_surprisal_packet_max": 0.4575, + "causal_surprisal_packet_mean": 0.5393, + "causal_surprisal_packet_median": 0.7088, + "causal_surprisal_packet_trimmed10_mean": 0.5721, + "causal_surprisal_total": 0.4585, + "consistency_total": 0.9108999999999999, + "curvature_flow": 0.10139999999999999, + "curvature_packet": 0.21600000000000003, + "curvature_total": 0.1265, + "direction_drift_flow": 0.7066000000000001, + "direction_drift_packet_max": 0.32689999999999997, + "direction_drift_packet_mean": 0.5556, + "direction_drift_packet_median": 0.5745, + "direction_drift_packet_trimmed10_mean": 0.6015, + "direction_drift_total": 0.49350000000000005, + "flow_consistency": 0.7931999999999999, + "jacobian_flow": 0.4759, + "jacobian_packet": 0.7781, + "jacobian_total": 0.7581, + "kappa2_speed2norm_packet_mean": 0.1078, + "kappa2_speed2norm_packet_median": 0.11009999999999998, + "kappa2_speed2norm_packet_trimmed10_mean": 0.10870000000000002, + "kinetic_energy": 0.5255000000000001, + "kinetic_flow": 0.21059999999999995, + "kinetic_packet": 0.6321, + "packet_consistency": 0.9342, + "pna_flow": 0.1921, + "pna_packet_max": 0.13540000000000002, + "pna_packet_mean": 0.1078, + "pna_packet_median": 0.11009999999999998, + "pna_packet_trimmed10_mean": 0.10870000000000002, + "terminal_flow": 0.4632, + "terminal_norm": 0.5863, + "terminal_packet": 0.5908, + "velocity_flow": 0.46830000000000005, + "velocity_flow_t01": 0.456, + "velocity_flow_t03": 0.45299999999999996, + "velocity_flow_t05": 0.4403, + "velocity_flow_t07": 0.42250000000000004, + "velocity_flow_t09": 0.44289999999999996, + "velocity_flow_t10": 0.6294, + "velocity_packet": 0.4143, + "velocity_packet_t01": 0.2399, + "velocity_packet_t03": 0.23329999999999995, + "velocity_packet_t05": 0.22169999999999995, + "velocity_packet_t07": 0.21400000000000002, + "velocity_packet_t09": 0.3652, + "velocity_packet_t10": 0.5596, + "velocity_total": 0.47450000000000003, + "velocity_total_t01": 0.41440000000000005, + "velocity_total_t03": 0.40990000000000004, + "velocity_total_t05": 0.39490000000000003, + "velocity_total_t07": 0.369, + "velocity_total_t09": 0.42729999999999996, + "velocity_total_t10": 0.6536000000000001 + }, + "ddos-slowloris": { + "_n": 314.0, + "arc_length": 0.8421127388535032, + "causal_surprisal_flow": 0.7253382165605096, + "causal_surprisal_packet_max": 0.6458522292993631, + "causal_surprisal_packet_mean": 0.6198961783439492, + "causal_surprisal_packet_median": 0.6069796178343949, + "causal_surprisal_packet_trimmed10_mean": 0.5632675159235669, + "causal_surprisal_total": 0.6142019108280256, + "consistency_total": 0.9266248407643314, + "curvature_flow": 0.3886404458598726, + "curvature_packet": 0.8401270700636942, + "curvature_total": 0.8140267515923566, + "direction_drift_flow": 0.17417898089171976, + "direction_drift_packet_max": 0.5810987261146496, + "direction_drift_packet_mean": 0.37494203821656047, + "direction_drift_packet_median": 0.33461464968152865, + "direction_drift_packet_trimmed10_mean": 0.3338477707006369, + "direction_drift_total": 0.38613503184713377, + "flow_consistency": 0.929376433121019, + "jacobian_flow": 0.22254012738853501, + "jacobian_packet": 0.23230063694267516, + "jacobian_total": 0.21160509554140128, + "kappa2_speed2norm_packet_mean": 0.6905509554140128, + "kappa2_speed2norm_packet_median": 0.6603286624203822, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6651917197452228, + "kinetic_energy": 0.8385019108280254, + "kinetic_flow": 0.8684662420382167, + "kinetic_packet": 0.7775312101910828, + "packet_consistency": 0.6690019108280254, + "pna_flow": 0.09731337579617835, + "pna_packet_max": 0.7397070063694268, + "pna_packet_mean": 0.6905509554140128, + "pna_packet_median": 0.6603286624203822, + "pna_packet_trimmed10_mean": 0.6651917197452228, + "terminal_flow": 0.9432420382165605, + "terminal_norm": 0.9379426751592356, + "terminal_packet": 0.910968789808917, + "velocity_flow": 0.8531070063694268, + "velocity_flow_t01": 0.8012471337579619, + "velocity_flow_t03": 0.8085678343949044, + "velocity_flow_t05": 0.8227273885350318, + "velocity_flow_t07": 0.8453968152866242, + "velocity_flow_t09": 0.8732222929936305, + "velocity_flow_t10": 0.8796585987261146, + "velocity_packet": 0.8484579617834396, + "velocity_packet_t01": 0.8591936305732485, + "velocity_packet_t03": 0.865559872611465, + "velocity_packet_t05": 0.8650414012738854, + "velocity_packet_t07": 0.8201815286624203, + "velocity_packet_t09": 0.841392356687898, + "velocity_packet_t10": 0.8129436305732485, + "velocity_total": 0.8683802547770701, + "velocity_total_t01": 0.8192853503184715, + "velocity_total_t03": 0.8336929936305734, + "velocity_total_t05": 0.8476751592356687, + "velocity_total_t07": 0.8571834394904458, + "velocity_total_t09": 0.8766999999999999, + "velocity_total_t10": 0.8754573248407643 + }, + "ddos-syn_flood": { + "_n": 1141.0, + "arc_length": 0.9812678352322523, + "causal_surprisal_flow": 0.5602576687116565, + "causal_surprisal_packet_max": 0.5840119193689746, + "causal_surprisal_packet_mean": 0.48800140227870287, + "causal_surprisal_packet_median": 0.2218851884312007, + "causal_surprisal_packet_trimmed10_mean": 0.28532883435582823, + "causal_surprisal_total": 0.5128106923751096, + "consistency_total": 0.9851740578439966, + "curvature_flow": 0.08243733567046452, + "curvature_packet": 0.5539704645048203, + "curvature_total": 0.43629938650306743, + "direction_drift_flow": 0.06420648553900087, + "direction_drift_packet_max": 0.012967572304995621, + "direction_drift_packet_mean": 0.006568799298860655, + "direction_drift_packet_median": 0.013077826468010516, + "direction_drift_packet_trimmed10_mean": 0.007683260297984224, + "direction_drift_total": 0.004516564417177915, + "flow_consistency": 0.9765212971078001, + "jacobian_flow": 0.027733742331288346, + "jacobian_packet": 0.6109506573181419, + "jacobian_total": 0.19023733567046447, + "kappa2_speed2norm_packet_mean": 0.05410552147239264, + "kappa2_speed2norm_packet_median": 0.05294934268185802, + "kappa2_speed2norm_packet_trimmed10_mean": 0.04549272567922875, + "kinetic_energy": 0.9809160385626644, + "kinetic_flow": 0.9286697633654688, + "kinetic_packet": 0.9778744960560912, + "packet_consistency": 0.9353109553023664, + "pna_flow": 0.014946187554776523, + "pna_packet_max": 0.10349167397020156, + "pna_packet_mean": 0.05410552147239264, + "pna_packet_median": 0.05294934268185802, + "pna_packet_trimmed10_mean": 0.04549272567922875, + "terminal_flow": 0.9887305872042069, + "terminal_norm": 0.9955994741454864, + "terminal_packet": 0.9880865907099035, + "velocity_flow": 0.9218273444347065, + "velocity_flow_t01": 0.929232953549518, + "velocity_flow_t03": 0.9212357581069238, + "velocity_flow_t05": 0.9182117440841366, + "velocity_flow_t07": 0.9222592462751971, + "velocity_flow_t09": 0.9249144609991236, + "velocity_flow_t10": 0.9250103418054338, + "velocity_packet": 0.9873561787905348, + "velocity_packet_t01": 0.9517219982471515, + "velocity_packet_t03": 0.9639195442594216, + "velocity_packet_t05": 0.9746913234005258, + "velocity_packet_t07": 0.9864780017528484, + "velocity_packet_t09": 0.9900930762489044, + "velocity_packet_t10": 0.9878156003505697, + "velocity_total": 0.9753859772129712, + "velocity_total_t01": 0.9538737949167395, + "velocity_total_t03": 0.9587801928133217, + "velocity_total_t05": 0.9672292725679229, + "velocity_total_t07": 0.974895004382121, + "velocity_total_t09": 0.9785354951796669, + "velocity_total_t10": 0.978895004382121 + }, + "ddos-synonymousip_flood": { + "_n": 182.0, + "arc_length": 0.9771395604395604, + "causal_surprisal_flow": 0.43867912087912087, + "causal_surprisal_packet_max": 0.6463747252747253, + "causal_surprisal_packet_mean": 0.44071098901098893, + "causal_surprisal_packet_median": 0.13363626373626375, + "causal_surprisal_packet_trimmed10_mean": 0.2386824175824176, + "causal_surprisal_total": 0.009358241758241763, + "consistency_total": 0.9946670329670331, + "curvature_flow": 4.835164835164852e-05, + "curvature_packet": 0.9114912087912087, + "curvature_total": 0.8847120879120879, + "direction_drift_flow": 0.013324175824175827, + "direction_drift_packet_max": 0.08877362637362637, + "direction_drift_packet_mean": 0.008092307692307697, + "direction_drift_packet_median": 0.019104945054945047, + "direction_drift_packet_trimmed10_mean": 0.0071978021978021944, + "direction_drift_total": 0.019361538461538458, + "flow_consistency": 0.9947593406593407, + "jacobian_flow": 0.00500219780219781, + "jacobian_packet": 0.3956648351648352, + "jacobian_total": 0.16622197802197802, + "kappa2_speed2norm_packet_mean": 0.3912714285714286, + "kappa2_speed2norm_packet_median": 0.3151417582417583, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3291472527472527, + "kinetic_energy": 0.9791659340659342, + "kinetic_flow": 0.8753967032967033, + "kinetic_packet": 0.9970703296703296, + "packet_consistency": 0.7029824175824175, + "pna_flow": 0.0008901098901098897, + "pna_packet_max": 0.8636197802197801, + "pna_packet_mean": 0.3912714285714286, + "pna_packet_median": 0.3151417582417583, + "pna_packet_trimmed10_mean": 0.3291472527472527, + "terminal_flow": 0.9984538461538462, + "terminal_norm": 0.9994714285714286, + "terminal_packet": 0.9971846153846153, + "velocity_flow": 0.8807494505494505, + "velocity_flow_t01": 0.8736835164835165, + "velocity_flow_t03": 0.8778978021978021, + "velocity_flow_t05": 0.8810274725274726, + "velocity_flow_t07": 0.8801131868131868, + "velocity_flow_t09": 0.8812065934065935, + "velocity_flow_t10": 0.8813450549450549, + "velocity_packet": 0.9846065934065934, + "velocity_packet_t01": 0.9573626373626374, + "velocity_packet_t03": 0.9687791208791209, + "velocity_packet_t05": 0.9825351648351648, + "velocity_packet_t07": 0.9893307692307692, + "velocity_packet_t09": 0.9820373626373627, + "velocity_packet_t10": 0.9251747252747252, + "velocity_total": 0.9147307692307692, + "velocity_total_t01": 0.8839582417582417, + "velocity_total_t03": 0.8961021978021978, + "velocity_total_t05": 0.9139593406593408, + "velocity_total_t07": 0.9304857142857142, + "velocity_total_t09": 0.9182142857142856, + "velocity_total_t10": 0.8455802197802198 + }, + "ddos-tcp_flood": { + "_n": 1224.0, + "arc_length": 0.9937535947712418, + "causal_surprisal_flow": 0.5497156862745098, + "causal_surprisal_packet_max": 0.5373227124183007, + "causal_surprisal_packet_mean": 0.4381294117647059, + "causal_surprisal_packet_median": 0.182940522875817, + "causal_surprisal_packet_trimmed10_mean": 0.4015557189542484, + "causal_surprisal_total": 0.49849330065359476, + "consistency_total": 0.8994597222222223, + "curvature_flow": 0.16650408496732025, + "curvature_packet": 0.6264394607843138, + "curvature_total": 0.5294107843137255, + "direction_drift_flow": 0.03599607843137255, + "direction_drift_packet_max": 0.03243921568627452, + "direction_drift_packet_mean": 0.011002614379084969, + "direction_drift_packet_median": 0.019275653594771243, + "direction_drift_packet_trimmed10_mean": 0.012553758169934634, + "direction_drift_total": 0.008446977124183006, + "flow_consistency": 0.8321083333333333, + "jacobian_flow": 0.03004330065359477, + "jacobian_packet": 0.7190229575163399, + "jacobian_total": 0.295115522875817, + "kappa2_speed2norm_packet_mean": 0.045123856209150326, + "kappa2_speed2norm_packet_median": 0.04513962418300653, + "kappa2_speed2norm_packet_trimmed10_mean": 0.0437264705882353, + "kinetic_energy": 0.9937831699346406, + "kinetic_flow": 0.9553217320261438, + "kinetic_packet": 0.97511977124183, + "packet_consistency": 0.5790911764705883, + "pna_flow": 0.016037908496732027, + "pna_packet_max": 0.0852857026143791, + "pna_packet_mean": 0.045123856209150326, + "pna_packet_median": 0.04513962418300653, + "pna_packet_trimmed10_mean": 0.0437264705882353, + "terminal_flow": 0.9122589052287581, + "terminal_norm": 0.9852808823529411, + "terminal_packet": 0.9825186274509804, + "velocity_flow": 0.9337956699346406, + "velocity_flow_t01": 0.9405727124183005, + "velocity_flow_t03": 0.9425118464052287, + "velocity_flow_t05": 0.9391794117647059, + "velocity_flow_t07": 0.9378029411764705, + "velocity_flow_t09": 0.9345573529411764, + "velocity_flow_t10": 0.9290790032679739, + "velocity_packet": 0.9870143790849674, + "velocity_packet_t01": 0.8987710784313725, + "velocity_packet_t03": 0.9220433006535947, + "velocity_packet_t05": 0.9452281045751634, + "velocity_packet_t07": 0.975897385620915, + "velocity_packet_t09": 0.9901129084967321, + "velocity_packet_t10": 0.9959504901960783, + "velocity_total": 0.9795308006535949, + "velocity_total_t01": 0.9608714052287581, + "velocity_total_t03": 0.9648789215686275, + "velocity_total_t05": 0.9703205882352941, + "velocity_total_t07": 0.9759651960784314, + "velocity_total_t09": 0.982097385620915, + "velocity_total_t10": 0.9853962418300654 + }, + "ddos-udp_flood": { + "_n": 10.0, + "arc_length": 0.97336, + "causal_surprisal_flow": 0.89624, + "causal_surprisal_packet_max": 0.7090000000000001, + "causal_surprisal_packet_mean": 0.56178, + "causal_surprisal_packet_median": 0.31366000000000005, + "causal_surprisal_packet_trimmed10_mean": 0.36957999999999996, + "causal_surprisal_total": 0.58484, + "consistency_total": 0.96236, + "curvature_flow": 0.14812, + "curvature_packet": 0.9813999999999999, + "curvature_total": 0.9654399999999999, + "direction_drift_flow": 0.09313999999999999, + "direction_drift_packet_max": 0.8981, + "direction_drift_packet_mean": 0.73288, + "direction_drift_packet_median": 0.6157999999999999, + "direction_drift_packet_trimmed10_mean": 0.687, + "direction_drift_total": 0.7671199999999999, + "flow_consistency": 0.97538, + "jacobian_flow": 0.18190000000000003, + "jacobian_packet": 0.6644599999999999, + "jacobian_total": 0.28618, + "kappa2_speed2norm_packet_mean": 0.8823799999999999, + "kappa2_speed2norm_packet_median": 0.8211799999999999, + "kappa2_speed2norm_packet_trimmed10_mean": 0.87812, + "kinetic_energy": 0.97554, + "kinetic_flow": 0.94984, + "kinetic_packet": 0.9936, + "packet_consistency": 0.76324, + "pna_flow": 0.02852000000000004, + "pna_packet_max": 0.9246000000000001, + "pna_packet_mean": 0.8823799999999999, + "pna_packet_median": 0.8211799999999999, + "pna_packet_trimmed10_mean": 0.87812, + "terminal_flow": 0.98794, + "terminal_norm": 0.9953000000000001, + "terminal_packet": 0.9938199999999999, + "velocity_flow": 0.93828, + "velocity_flow_t01": 0.9323799999999999, + "velocity_flow_t03": 0.93304, + "velocity_flow_t05": 0.9343999999999999, + "velocity_flow_t07": 0.9379199999999999, + "velocity_flow_t09": 0.94172, + "velocity_flow_t10": 0.9386, + "velocity_packet": 0.8462, + "velocity_packet_t01": 0.9016799999999999, + "velocity_packet_t03": 0.9068999999999999, + "velocity_packet_t05": 0.9227200000000001, + "velocity_packet_t07": 0.94816, + "velocity_packet_t09": 0.8998400000000001, + "velocity_packet_t10": 0.5953600000000001, + "velocity_total": 0.86878, + "velocity_total_t01": 0.89366, + "velocity_total_t03": 0.89104, + "velocity_total_t05": 0.89366, + "velocity_total_t07": 0.89748, + "velocity_total_t09": 0.86456, + "velocity_total_t10": 0.6689 + }, + "ddos-udp_fragmentation": { + "_n": 26.0, + "arc_length": 0.7460692307692307, + "causal_surprisal_flow": 0.6309923076923076, + "causal_surprisal_packet_max": 0.5507461538461539, + "causal_surprisal_packet_mean": 0.4486076923076924, + "causal_surprisal_packet_median": 0.42126153846153847, + "causal_surprisal_packet_trimmed10_mean": 0.39893076923076926, + "causal_surprisal_total": 0.5441692307692307, + "consistency_total": 0.7094230769230769, + "curvature_flow": 0.2736230769230769, + "curvature_packet": 0.6501307692307692, + "curvature_total": 0.6281384615384615, + "direction_drift_flow": 0.2892461538461538, + "direction_drift_packet_max": 0.5586846153846154, + "direction_drift_packet_mean": 0.3838615384615385, + "direction_drift_packet_median": 0.3472692307692308, + "direction_drift_packet_trimmed10_mean": 0.3809461538461538, + "direction_drift_total": 0.37460000000000004, + "flow_consistency": 0.7358307692307692, + "jacobian_flow": 0.1851769230769231, + "jacobian_packet": 0.5084307692307692, + "jacobian_total": 0.3382846153846154, + "kappa2_speed2norm_packet_mean": 0.5359230769230768, + "kappa2_speed2norm_packet_median": 0.5451076923076923, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5532, + "kinetic_energy": 0.7460923076923076, + "kinetic_flow": 0.7424538461538461, + "kinetic_packet": 0.6393230769230768, + "packet_consistency": 0.5941461538461539, + "pna_flow": 0.23231538461538465, + "pna_packet_max": 0.5516461538461539, + "pna_packet_mean": 0.5359230769230768, + "pna_packet_median": 0.5451076923076923, + "pna_packet_trimmed10_mean": 0.5532, + "terminal_flow": 0.8366769230769231, + "terminal_norm": 0.8172307692307692, + "terminal_packet": 0.7169307692307693, + "velocity_flow": 0.7377846153846155, + "velocity_flow_t01": 0.7789846153846154, + "velocity_flow_t03": 0.7759076923076922, + "velocity_flow_t05": 0.7701384615384615, + "velocity_flow_t07": 0.7601846153846155, + "velocity_flow_t09": 0.7294692307692309, + "velocity_flow_t10": 0.7044923076923078, + "velocity_packet": 0.7155692307692307, + "velocity_packet_t01": 0.703, + "velocity_packet_t03": 0.6986, + "velocity_packet_t05": 0.6832692307692307, + "velocity_packet_t07": 0.6735846153846153, + "velocity_packet_t09": 0.6881153846153846, + "velocity_packet_t10": 0.6316230769230768, + "velocity_total": 0.7365076923076923, + "velocity_total_t01": 0.7516692307692308, + "velocity_total_t03": 0.7450461538461538, + "velocity_total_t05": 0.7401076923076924, + "velocity_total_t07": 0.7249307692307693, + "velocity_total_t09": 0.7070307692307692, + "velocity_total_t10": 0.6760076923076923 + }, + "dictionarybruteforce": { + "_n": 19.0, + "arc_length": 0.7731684210526315, + "causal_surprisal_flow": 0.5808105263157894, + "causal_surprisal_packet_max": 0.39588421052631584, + "causal_surprisal_packet_mean": 0.35322105263157894, + "causal_surprisal_packet_median": 0.3018105263157895, + "causal_surprisal_packet_trimmed10_mean": 0.2866526315789473, + "causal_surprisal_total": 0.49577894736842104, + "consistency_total": 0.6028210526315789, + "curvature_flow": 0.5677157894736842, + "curvature_packet": 0.6261473684210526, + "curvature_total": 0.6510947368421053, + "direction_drift_flow": 0.20261052631578946, + "direction_drift_packet_max": 0.40813684210526313, + "direction_drift_packet_mean": 0.2954842105263158, + "direction_drift_packet_median": 0.3301368421052632, + "direction_drift_packet_trimmed10_mean": 0.3108947368421053, + "direction_drift_total": 0.24133684210526316, + "flow_consistency": 0.6583157894736842, + "jacobian_flow": 0.2578315789473684, + "jacobian_packet": 0.38223157894736837, + "jacobian_total": 0.32845263157894733, + "kappa2_speed2norm_packet_mean": 0.489978947368421, + "kappa2_speed2norm_packet_median": 0.5073684210526316, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5118263157894737, + "kinetic_energy": 0.7698947368421053, + "kinetic_flow": 0.7721263157894735, + "kinetic_packet": 0.594021052631579, + "packet_consistency": 0.3647894736842105, + "pna_flow": 0.24718947368421054, + "pna_packet_max": 0.48514736842105266, + "pna_packet_mean": 0.489978947368421, + "pna_packet_median": 0.5073684210526316, + "pna_packet_trimmed10_mean": 0.5118263157894737, + "terminal_flow": 0.8252315789473684, + "terminal_norm": 0.7919578947368421, + "terminal_packet": 0.6230210526315789, + "velocity_flow": 0.7639894736842104, + "velocity_flow_t01": 0.7216, + "velocity_flow_t03": 0.7256210526315789, + "velocity_flow_t05": 0.7365368421052632, + "velocity_flow_t07": 0.7501789473684211, + "velocity_flow_t09": 0.7943368421052632, + "velocity_flow_t10": 0.7785157894736842, + "velocity_packet": 0.6643263157894737, + "velocity_packet_t01": 0.6366315789473684, + "velocity_packet_t03": 0.6334315789473683, + "velocity_packet_t05": 0.6097894736842105, + "velocity_packet_t07": 0.5855473684210527, + "velocity_packet_t09": 0.6676421052631578, + "velocity_packet_t10": 0.7366421052631579, + "velocity_total": 0.7666842105263157, + "velocity_total_t01": 0.6978210526315789, + "velocity_total_t03": 0.7111473684210526, + "velocity_total_t05": 0.7217894736842105, + "velocity_total_t07": 0.7426526315789475, + "velocity_total_t09": 0.7888736842105263, + "velocity_total_t10": 0.7800526315789473 + }, + "dns_spoofing": { + "_n": 185.0, + "arc_length": 0.7427751351351353, + "causal_surprisal_flow": 0.5408810810810811, + "causal_surprisal_packet_max": 0.43336216216216217, + "causal_surprisal_packet_mean": 0.35724702702702704, + "causal_surprisal_packet_median": 0.3290502702702703, + "causal_surprisal_packet_trimmed10_mean": 0.30608270270270266, + "causal_surprisal_total": 0.4534172972972973, + "consistency_total": 0.7041308108108107, + "curvature_flow": 0.5501697297297298, + "curvature_packet": 0.5392378378378379, + "curvature_total": 0.5632745945945946, + "direction_drift_flow": 0.3002335135135135, + "direction_drift_packet_max": 0.47701837837837846, + "direction_drift_packet_mean": 0.3347318918918919, + "direction_drift_packet_median": 0.3222518918918919, + "direction_drift_packet_trimmed10_mean": 0.3356843243243244, + "direction_drift_total": 0.30703243243243244, + "flow_consistency": 0.6741275675675675, + "jacobian_flow": 0.26476, + "jacobian_packet": 0.48194378378378383, + "jacobian_total": 0.4101881081081081, + "kappa2_speed2norm_packet_mean": 0.3804216216216217, + "kappa2_speed2norm_packet_median": 0.38960000000000006, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3891291891891892, + "kinetic_energy": 0.7407924324324324, + "kinetic_flow": 0.7261502702702702, + "kinetic_packet": 0.669505945945946, + "packet_consistency": 0.6179567567567568, + "pna_flow": 0.2967118918918919, + "pna_packet_max": 0.41018378378378384, + "pna_packet_mean": 0.3804216216216217, + "pna_packet_median": 0.38960000000000006, + "pna_packet_trimmed10_mean": 0.3891291891891892, + "terminal_flow": 0.7532854054054056, + "terminal_norm": 0.7517005405405406, + "terminal_packet": 0.7009821621621621, + "velocity_flow": 0.7189016216216216, + "velocity_flow_t01": 0.6874486486486486, + "velocity_flow_t03": 0.6964594594594595, + "velocity_flow_t05": 0.7072010810810812, + "velocity_flow_t07": 0.7206032432432432, + "velocity_flow_t09": 0.738705945945946, + "velocity_flow_t10": 0.7323875675675676, + "velocity_packet": 0.6861654054054054, + "velocity_packet_t01": 0.6320443243243243, + "velocity_packet_t03": 0.632572972972973, + "velocity_packet_t05": 0.6354108108108109, + "velocity_packet_t07": 0.6584302702702702, + "velocity_packet_t09": 0.7018691891891892, + "velocity_packet_t10": 0.6877156756756757, + "velocity_total": 0.7225610810810812, + "velocity_total_t01": 0.6868475675675676, + "velocity_total_t03": 0.6941383783783783, + "velocity_total_t05": 0.7063805405405406, + "velocity_total_t07": 0.7196324324324324, + "velocity_total_t09": 0.7424248648648648, + "velocity_total_t10": 0.7343902702702703 + }, + "dos-http_flood": { + "_n": 704.0, + "arc_length": 0.9717073863636363, + "causal_surprisal_flow": 0.22865426136363634, + "causal_surprisal_packet_max": 0.23545880681818182, + "causal_surprisal_packet_mean": 0.21199588068181818, + "causal_surprisal_packet_median": 0.1917805397727273, + "causal_surprisal_packet_trimmed10_mean": 0.17834701704545453, + "causal_surprisal_total": 0.1869478693181818, + "consistency_total": 0.9354571022727273, + "curvature_flow": 0.2169572443181818, + "curvature_packet": 0.5025255681818183, + "curvature_total": 0.42359943181818177, + "direction_drift_flow": 0.12017159090909091, + "direction_drift_packet_max": 0.17440255681818181, + "direction_drift_packet_mean": 0.06584431818181818, + "direction_drift_packet_median": 0.06891420454545455, + "direction_drift_packet_trimmed10_mean": 0.06619119318181818, + "direction_drift_total": 0.05274488636363637, + "flow_consistency": 0.910918465909091, + "jacobian_flow": 0.3178840909090909, + "jacobian_packet": 0.7311636363636365, + "jacobian_total": 0.6286650568181817, + "kappa2_speed2norm_packet_mean": 0.215871875, + "kappa2_speed2norm_packet_median": 0.20501392045454547, + "kappa2_speed2norm_packet_trimmed10_mean": 0.21111448863636362, + "kinetic_energy": 0.971471875, + "kinetic_flow": 0.900784090909091, + "kinetic_packet": 0.9638872159090909, + "packet_consistency": 0.9018806818181818, + "pna_flow": 0.03831903409090909, + "pna_packet_max": 0.2695173295454545, + "pna_packet_mean": 0.215871875, + "pna_packet_median": 0.20501392045454547, + "pna_packet_trimmed10_mean": 0.21111448863636362, + "terminal_flow": 0.9769360795454546, + "terminal_norm": 0.9903482954545454, + "terminal_packet": 0.9834176136363637, + "velocity_flow": 0.8612624999999999, + "velocity_flow_t01": 0.6596428977272727, + "velocity_flow_t03": 0.674365625, + "velocity_flow_t05": 0.7106852272727273, + "velocity_flow_t07": 0.85026875, + "velocity_flow_t09": 0.8930181818181818, + "velocity_flow_t10": 0.8994434659090909, + "velocity_packet": 0.9561215909090908, + "velocity_packet_t01": 0.8903241477272728, + "velocity_packet_t03": 0.8766164772727273, + "velocity_packet_t05": 0.8982603693181819, + "velocity_packet_t07": 0.9510360795454545, + "velocity_packet_t09": 0.9631744318181816, + "velocity_packet_t10": 0.9437875, + "velocity_total": 0.9428943181818182, + "velocity_total_t01": 0.8175897727272727, + "velocity_total_t03": 0.8252539772727273, + "velocity_total_t05": 0.8758517045454546, + "velocity_total_t07": 0.931912215909091, + "velocity_total_t09": 0.9672161931818182, + "velocity_total_t10": 0.9690971590909091 + }, + "dos-syn_flood": { + "_n": 874.0, + "arc_length": 0.9741965675057208, + "causal_surprisal_flow": 0.5834471395881007, + "causal_surprisal_packet_max": 0.6187546910755151, + "causal_surprisal_packet_mean": 0.5226425629290617, + "causal_surprisal_packet_median": 0.3544691075514874, + "causal_surprisal_packet_trimmed10_mean": 0.3768106407322655, + "causal_surprisal_total": 0.6385258581235698, + "consistency_total": 0.9870846681922196, + "curvature_flow": 0.08480297482837529, + "curvature_packet": 0.5064088100686499, + "curvature_total": 0.4120102974828375, + "direction_drift_flow": 0.09968386727688787, + "direction_drift_packet_max": 0.03502013729977117, + "direction_drift_packet_mean": 0.010915331807780326, + "direction_drift_packet_median": 0.02942814645308925, + "direction_drift_packet_trimmed10_mean": 0.01255743707093821, + "direction_drift_total": 0.009874599542334099, + "flow_consistency": 0.9840919908466819, + "jacobian_flow": 0.1433897025171625, + "jacobian_packet": 0.5033937070938215, + "jacobian_total": 0.29257551487414185, + "kappa2_speed2norm_packet_mean": 0.1203, + "kappa2_speed2norm_packet_median": 0.10530491990846683, + "kappa2_speed2norm_packet_trimmed10_mean": 0.08032883295194508, + "kinetic_energy": 0.9741514874141877, + "kinetic_flow": 0.89723295194508, + "kinetic_packet": 0.9757796338672768, + "packet_consistency": 0.9768151029748283, + "pna_flow": 0.018901601830663615, + "pna_packet_max": 0.344033409610984, + "pna_packet_mean": 0.1203, + "pna_packet_median": 0.10530491990846683, + "pna_packet_trimmed10_mean": 0.08032883295194508, + "terminal_flow": 0.9892961098398169, + "terminal_norm": 0.9969050343249427, + "terminal_packet": 0.9935011441647598, + "velocity_flow": 0.8935, + "velocity_flow_t01": 0.8860812356979404, + "velocity_flow_t03": 0.8835061784897026, + "velocity_flow_t05": 0.8886212814645309, + "velocity_flow_t07": 0.8920009153318077, + "velocity_flow_t09": 0.8980854691075515, + "velocity_flow_t10": 0.9034487414187641, + "velocity_packet": 0.9844096109839816, + "velocity_packet_t01": 0.9177910755148742, + "velocity_packet_t03": 0.9479212814645308, + "velocity_packet_t05": 0.976407780320366, + "velocity_packet_t07": 0.987745995423341, + "velocity_packet_t09": 0.9833732265446224, + "velocity_packet_t10": 0.9708573226544623, + "velocity_total": 0.9565858123569795, + "velocity_total_t01": 0.9364075514874143, + "velocity_total_t03": 0.942600457665904, + "velocity_total_t05": 0.9488771167048056, + "velocity_total_t07": 0.957687414187643, + "velocity_total_t09": 0.9602102974828375, + "velocity_total_t10": 0.9607963386727688 + }, + "dos-tcp_flood": { + "_n": 1076.0, + "arc_length": 0.9859096654275092, + "causal_surprisal_flow": 0.5832418215613382, + "causal_surprisal_packet_max": 0.46009674721189586, + "causal_surprisal_packet_mean": 0.4195131970260223, + "causal_surprisal_packet_median": 0.3851145910780669, + "causal_surprisal_packet_trimmed10_mean": 0.3613460037174721, + "causal_surprisal_total": 0.6087224907063198, + "consistency_total": 0.9712659851301116, + "curvature_flow": 0.46890381040892193, + "curvature_packet": 0.6800908921933085, + "curvature_total": 0.678364033457249, + "direction_drift_flow": 0.07151579925650559, + "direction_drift_packet_max": 0.07748420074349442, + "direction_drift_packet_mean": 0.035056133828996285, + "direction_drift_packet_median": 0.03958289962825279, + "direction_drift_packet_trimmed10_mean": 0.03867760223048327, + "direction_drift_total": 0.02099907063197026, + "flow_consistency": 0.9661475836431226, + "jacobian_flow": 0.09902137546468401, + "jacobian_packet": 0.6672602230483271, + "jacobian_total": 0.40712964684014874, + "kappa2_speed2norm_packet_mean": 0.14698122676579925, + "kappa2_speed2norm_packet_median": 0.15136180297397772, + "kappa2_speed2norm_packet_trimmed10_mean": 0.13251830855018587, + "kinetic_energy": 0.9860146840148699, + "kinetic_flow": 0.9163479553903346, + "kinetic_packet": 0.9744981412639404, + "packet_consistency": 0.7105657063197025, + "pna_flow": 0.06857955390334572, + "pna_packet_max": 0.21027881040892193, + "pna_packet_mean": 0.14698122676579925, + "pna_packet_median": 0.15136180297397772, + "pna_packet_trimmed10_mean": 0.13251830855018587, + "terminal_flow": 0.9700648698884757, + "terminal_norm": 0.9942585501858736, + "terminal_packet": 0.9938953531598512, + "velocity_flow": 0.9097016728624534, + "velocity_flow_t01": 0.913164498141264, + "velocity_flow_t03": 0.90558624535316, + "velocity_flow_t05": 0.9050985130111524, + "velocity_flow_t07": 0.9089923791821561, + "velocity_flow_t09": 0.9117407063197027, + "velocity_flow_t10": 0.9101492565055763, + "velocity_packet": 0.9721678438661709, + "velocity_packet_t01": 0.7687088289962826, + "velocity_packet_t03": 0.8209059479553902, + "velocity_packet_t05": 0.8837078066914499, + "velocity_packet_t07": 0.9506802973977696, + "velocity_packet_t09": 0.9762622676579925, + "velocity_packet_t10": 0.9904923791821562, + "velocity_total": 0.9628920074349443, + "velocity_total_t01": 0.9421035315985131, + "velocity_total_t03": 0.9456739776951674, + "velocity_total_t05": 0.9512799256505576, + "velocity_total_t07": 0.9579728624535316, + "velocity_total_t09": 0.9681031598513011, + "velocity_total_t10": 0.9760224907063196 + }, + "dos-udp_flood": { + "_n": 201.0, + "arc_length": 0.9731044776119403, + "causal_surprisal_flow": 0.6135860696517413, + "causal_surprisal_packet_max": 0.6889592039800996, + "causal_surprisal_packet_mean": 0.3037134328358209, + "causal_surprisal_packet_median": 0.03247661691542288, + "causal_surprisal_packet_trimmed10_mean": 0.03905074626865672, + "causal_surprisal_total": 0.40874726368159203, + "consistency_total": 0.995971144278607, + "curvature_flow": 0.16959303482587065, + "curvature_packet": 0.7178656716417909, + "curvature_total": 0.6917213930348259, + "direction_drift_flow": 0.06515422885572139, + "direction_drift_packet_max": 0.8513074626865672, + "direction_drift_packet_mean": 0.00737313432835822, + "direction_drift_packet_median": 0.010821890547263693, + "direction_drift_packet_trimmed10_mean": 0.004046766169154217, + "direction_drift_total": 0.01590248756218906, + "flow_consistency": 0.995873631840796, + "jacobian_flow": 0.0398, + "jacobian_packet": 0.19812039800995027, + "jacobian_total": 0.13038208955223882, + "kappa2_speed2norm_packet_mean": 0.06686666666666667, + "kappa2_speed2norm_packet_median": 0.04682388059701492, + "kappa2_speed2norm_packet_trimmed10_mean": 0.05242089552238806, + "kinetic_energy": 0.9727800995024876, + "kinetic_flow": 0.976807960199005, + "kinetic_packet": 0.9941412935323384, + "packet_consistency": 0.32170746268656714, + "pna_flow": 0.01273731343283583, + "pna_packet_max": 0.3853343283582089, + "pna_packet_mean": 0.06686666666666667, + "pna_packet_median": 0.04682388059701492, + "pna_packet_trimmed10_mean": 0.05242089552238806, + "terminal_flow": 0.9914736318407961, + "terminal_norm": 0.9621621890547264, + "terminal_packet": 0.9500925373134329, + "velocity_flow": 0.9609004975124378, + "velocity_flow_t01": 0.9568358208955223, + "velocity_flow_t03": 0.9591144278606967, + "velocity_flow_t05": 0.9600845771144279, + "velocity_flow_t07": 0.9621990049751245, + "velocity_flow_t09": 0.962636815920398, + "velocity_flow_t10": 0.95818407960199, + "velocity_packet": 0.9955223880597015, + "velocity_packet_t01": 0.9770278606965175, + "velocity_packet_t03": 0.9842019900497513, + "velocity_packet_t05": 0.9909243781094528, + "velocity_packet_t07": 0.9943492537313433, + "velocity_packet_t09": 0.9951124378109453, + "velocity_packet_t10": 0.9979890547263681, + "velocity_total": 0.9440238805970149, + "velocity_total_t01": 0.9215701492537314, + "velocity_total_t03": 0.9288059701492538, + "velocity_total_t05": 0.9384338308457711, + "velocity_total_t07": 0.941652736318408, + "velocity_total_t09": 0.9568646766169153, + "velocity_total_t10": 0.9664517412935323 + }, + "mirai-greeth_flood": { + "_n": 16.0, + "arc_length": 0.5563374999999999, + "causal_surprisal_flow": 0.5197875, + "causal_surprisal_packet_max": 0.47521250000000004, + "causal_surprisal_packet_mean": 0.4693875, + "causal_surprisal_packet_median": 0.4412125, + "causal_surprisal_packet_trimmed10_mean": 0.44994999999999996, + "causal_surprisal_total": 0.5172375, + "consistency_total": 0.6091, + "curvature_flow": 0.4123125000000001, + "curvature_packet": 0.558875, + "curvature_total": 0.52555, + "direction_drift_flow": 0.4507250000000001, + "direction_drift_packet_max": 0.453575, + "direction_drift_packet_mean": 0.46323749999999997, + "direction_drift_packet_median": 0.49775, + "direction_drift_packet_trimmed10_mean": 0.4770375, + "direction_drift_total": 0.4537, + "flow_consistency": 0.5586625, + "jacobian_flow": 0.2596125, + "jacobian_packet": 0.5076875000000001, + "jacobian_total": 0.42629999999999996, + "kappa2_speed2norm_packet_mean": 0.47672499999999995, + "kappa2_speed2norm_packet_median": 0.4941375, + "kappa2_speed2norm_packet_trimmed10_mean": 0.48919999999999997, + "kinetic_energy": 0.5569249999999999, + "kinetic_flow": 0.5455375, + "kinetic_packet": 0.54805, + "packet_consistency": 0.5797625, + "pna_flow": 0.400575, + "pna_packet_max": 0.4841, + "pna_packet_mean": 0.47672499999999995, + "pna_packet_median": 0.4941375, + "pna_packet_trimmed10_mean": 0.48919999999999997, + "terminal_flow": 0.5976625, + "terminal_norm": 0.5922375, + "terminal_packet": 0.5846250000000001, + "velocity_flow": 0.5260875, + "velocity_flow_t01": 0.5700375000000001, + "velocity_flow_t03": 0.5643250000000001, + "velocity_flow_t05": 0.55845, + "velocity_flow_t07": 0.564775, + "velocity_flow_t09": 0.5580375, + "velocity_flow_t10": 0.5452375, + "velocity_packet": 0.5188875, + "velocity_packet_t01": 0.5249, + "velocity_packet_t03": 0.5182, + "velocity_packet_t05": 0.5161250000000001, + "velocity_packet_t07": 0.5309999999999999, + "velocity_packet_t09": 0.5818749999999999, + "velocity_packet_t10": 0.5532374999999999, + "velocity_total": 0.5457, + "velocity_total_t01": 0.5613625, + "velocity_total_t03": 0.556875, + "velocity_total_t05": 0.562925, + "velocity_total_t07": 0.5730625, + "velocity_total_t09": 0.5751875, + "velocity_total_t10": 0.5470750000000001 + }, + "mirai-greip_flood": { + "_n": 25.0, + "arc_length": 0.896648, + "causal_surprisal_flow": 0.571768, + "causal_surprisal_packet_max": 0.501432, + "causal_surprisal_packet_mean": 0.43764000000000003, + "causal_surprisal_packet_median": 0.415312, + "causal_surprisal_packet_trimmed10_mean": 0.41332, + "causal_surprisal_total": 0.546584, + "consistency_total": 0.855224, + "curvature_flow": 0.41619199999999995, + "curvature_packet": 0.715336, + "curvature_total": 0.69628, + "direction_drift_flow": 0.14615999999999998, + "direction_drift_packet_max": 0.339408, + "direction_drift_packet_mean": 0.19751200000000002, + "direction_drift_packet_median": 0.20579999999999998, + "direction_drift_packet_trimmed10_mean": 0.21949600000000002, + "direction_drift_total": 0.11536, + "flow_consistency": 0.84564, + "jacobian_flow": 0.23037600000000003, + "jacobian_packet": 0.366936, + "jacobian_total": 0.312872, + "kappa2_speed2norm_packet_mean": 0.46217600000000003, + "kappa2_speed2norm_packet_median": 0.481056, + "kappa2_speed2norm_packet_trimmed10_mean": 0.478968, + "kinetic_energy": 0.896048, + "kinetic_flow": 0.831224, + "kinetic_packet": 0.784984, + "packet_consistency": 0.526568, + "pna_flow": 0.14964, + "pna_packet_max": 0.490904, + "pna_packet_mean": 0.46217600000000003, + "pna_packet_median": 0.481056, + "pna_packet_trimmed10_mean": 0.478968, + "terminal_flow": 0.9104, + "terminal_norm": 0.9439440000000001, + "terminal_packet": 0.8882319999999999, + "velocity_flow": 0.8221200000000001, + "velocity_flow_t01": 0.757496, + "velocity_flow_t03": 0.774664, + "velocity_flow_t05": 0.7869919999999999, + "velocity_flow_t07": 0.810128, + "velocity_flow_t09": 0.835712, + "velocity_flow_t10": 0.842048, + "velocity_packet": 0.769432, + "velocity_packet_t01": 0.720024, + "velocity_packet_t03": 0.731584, + "velocity_packet_t05": 0.7394559999999999, + "velocity_packet_t07": 0.744208, + "velocity_packet_t09": 0.780904, + "velocity_packet_t10": 0.7738320000000001, + "velocity_total": 0.854088, + "velocity_total_t01": 0.772968, + "velocity_total_t03": 0.789472, + "velocity_total_t05": 0.8100719999999999, + "velocity_total_t07": 0.847424, + "velocity_total_t09": 0.871848, + "velocity_total_t10": 0.8559599999999999 + }, + "mirai-udpplain": { + "_n": 8.0, + "arc_length": 0.895775, + "causal_surprisal_flow": 0.542575, + "causal_surprisal_packet_max": 0.532775, + "causal_surprisal_packet_mean": 0.480925, + "causal_surprisal_packet_median": 0.428825, + "causal_surprisal_packet_trimmed10_mean": 0.46567499999999995, + "causal_surprisal_total": 0.54965, + "consistency_total": 0.63835, + "curvature_flow": 0.360475, + "curvature_packet": 0.66365, + "curvature_total": 0.6695500000000001, + "direction_drift_flow": 0.20982499999999998, + "direction_drift_packet_max": 0.5388, + "direction_drift_packet_mean": 0.4368250000000001, + "direction_drift_packet_median": 0.451925, + "direction_drift_packet_trimmed10_mean": 0.42605000000000004, + "direction_drift_total": 0.412275, + "flow_consistency": 0.680075, + "jacobian_flow": 0.160375, + "jacobian_packet": 0.5778, + "jacobian_total": 0.3827, + "kappa2_speed2norm_packet_mean": 0.5619999999999999, + "kappa2_speed2norm_packet_median": 0.5357, + "kappa2_speed2norm_packet_trimmed10_mean": 0.559725, + "kinetic_energy": 0.8936, + "kinetic_flow": 0.867625, + "kinetic_packet": 0.5976999999999999, + "packet_consistency": 0.54165, + "pna_flow": 0.156775, + "pna_packet_max": 0.550775, + "pna_packet_mean": 0.5619999999999999, + "pna_packet_median": 0.5357, + "pna_packet_trimmed10_mean": 0.559725, + "terminal_flow": 0.89725, + "terminal_norm": 0.8763500000000001, + "terminal_packet": 0.711925, + "velocity_flow": 0.8054, + "velocity_flow_t01": 0.7164499999999999, + "velocity_flow_t03": 0.735925, + "velocity_flow_t05": 0.767925, + "velocity_flow_t07": 0.792125, + "velocity_flow_t09": 0.8220000000000001, + "velocity_flow_t10": 0.8245250000000001, + "velocity_packet": 0.7355, + "velocity_packet_t01": 0.6964, + "velocity_packet_t03": 0.6952750000000001, + "velocity_packet_t05": 0.69595, + "velocity_packet_t07": 0.70075, + "velocity_packet_t09": 0.7554500000000001, + "velocity_packet_t10": 0.7666999999999999, + "velocity_total": 0.838925, + "velocity_total_t01": 0.7498250000000001, + "velocity_total_t03": 0.758925, + "velocity_total_t05": 0.764125, + "velocity_total_t07": 0.802725, + "velocity_total_t09": 0.8425499999999999, + "velocity_total_t10": 0.8586 + }, + "mitm-arpspoofing": { + "_n": 137.0, + "arc_length": 0.7457138686131387, + "causal_surprisal_flow": 0.5391240875912409, + "causal_surprisal_packet_max": 0.37053576642335767, + "causal_surprisal_packet_mean": 0.3634233576642336, + "causal_surprisal_packet_median": 0.3377532846715328, + "causal_surprisal_packet_trimmed10_mean": 0.3234671532846715, + "causal_surprisal_total": 0.48913138686131397, + "consistency_total": 0.6939343065693431, + "curvature_flow": 0.5830802919708029, + "curvature_packet": 0.5989270072992702, + "curvature_total": 0.6203240875912409, + "direction_drift_flow": 0.18977518248175185, + "direction_drift_packet_max": 0.3067686131386861, + "direction_drift_packet_mean": 0.2756817518248175, + "direction_drift_packet_median": 0.2824262773722628, + "direction_drift_packet_trimmed10_mean": 0.2925547445255474, + "direction_drift_total": 0.20347007299270073, + "flow_consistency": 0.7244218978102189, + "jacobian_flow": 0.3230890510948905, + "jacobian_packet": 0.3819956204379562, + "jacobian_total": 0.41440583941605835, + "kappa2_speed2norm_packet_mean": 0.5174058394160583, + "kappa2_speed2norm_packet_median": 0.5228277372262773, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5368364963503649, + "kinetic_energy": 0.7437262773722627, + "kinetic_flow": 0.7458291970802919, + "kinetic_packet": 0.6433240875912409, + "packet_consistency": 0.4620883211678831, + "pna_flow": 0.25439708029197083, + "pna_packet_max": 0.48447299270072985, + "pna_packet_mean": 0.5174058394160583, + "pna_packet_median": 0.5228277372262773, + "pna_packet_trimmed10_mean": 0.5368364963503649, + "terminal_flow": 0.8122197080291971, + "terminal_norm": 0.7993678832116788, + "terminal_packet": 0.6899693430656935, + "velocity_flow": 0.7580591240875912, + "velocity_flow_t01": 0.6702686131386861, + "velocity_flow_t03": 0.6835343065693431, + "velocity_flow_t05": 0.7073372262773722, + "velocity_flow_t07": 0.7599182481751824, + "velocity_flow_t09": 0.8110218978102189, + "velocity_flow_t10": 0.7884364963503651, + "velocity_packet": 0.6081036496350365, + "velocity_packet_t01": 0.5940386861313869, + "velocity_packet_t03": 0.5944087591240876, + "velocity_packet_t05": 0.5907357664233577, + "velocity_packet_t07": 0.5893693430656934, + "velocity_packet_t09": 0.6122321167883211, + "velocity_packet_t10": 0.6010613138686132, + "velocity_total": 0.7760248175182481, + "velocity_total_t01": 0.6705956204379562, + "velocity_total_t03": 0.6897970802919707, + "velocity_total_t05": 0.7120919708029196, + "velocity_total_t07": 0.7712919708029197, + "velocity_total_t09": 0.8160583941605839, + "velocity_total_t10": 0.7813109489051095 + }, + "recon-hostdiscovery": { + "_n": 163.0, + "arc_length": 0.7756319018404908, + "causal_surprisal_flow": 0.3505349693251534, + "causal_surprisal_packet_max": 0.43607975460122694, + "causal_surprisal_packet_mean": 0.4685803680981595, + "causal_surprisal_packet_median": 0.571160736196319, + "causal_surprisal_packet_trimmed10_mean": 0.5158993865030674, + "causal_surprisal_total": 0.42612147239263803, + "consistency_total": 0.7606662576687118, + "curvature_flow": 0.29213006134969327, + "curvature_packet": 0.43700613496932517, + "curvature_total": 0.3448822085889571, + "direction_drift_flow": 0.31575766871165645, + "direction_drift_packet_max": 0.25553619631901836, + "direction_drift_packet_mean": 0.2596723926380368, + "direction_drift_packet_median": 0.26820981595092025, + "direction_drift_packet_trimmed10_mean": 0.2767852760736196, + "direction_drift_total": 0.23406257668711655, + "flow_consistency": 0.7458748466257669, + "jacobian_flow": 0.4007042944785276, + "jacobian_packet": 0.7620680981595093, + "jacobian_total": 0.6966503067484663, + "kappa2_speed2norm_packet_mean": 0.2635558282208589, + "kappa2_speed2norm_packet_median": 0.26601349693251536, + "kappa2_speed2norm_packet_trimmed10_mean": 0.27397546012269935, + "kinetic_energy": 0.7752478527607363, + "kinetic_flow": 0.6837239263803682, + "kinetic_packet": 0.7668110429447852, + "packet_consistency": 0.7709325153374232, + "pna_flow": 0.24538895705521474, + "pna_packet_max": 0.26258895705521473, + "pna_packet_mean": 0.2635558282208589, + "pna_packet_median": 0.26601349693251536, + "pna_packet_trimmed10_mean": 0.27397546012269935, + "terminal_flow": 0.7709263803680981, + "terminal_norm": 0.8155116564417177, + "terminal_packet": 0.8123116564417179, + "velocity_flow": 0.6799619631901841, + "velocity_flow_t01": 0.5538319018404908, + "velocity_flow_t03": 0.5741312883435582, + "velocity_flow_t05": 0.6134515337423313, + "velocity_flow_t07": 0.6726171779141104, + "velocity_flow_t09": 0.7079742331288343, + "velocity_flow_t10": 0.6973153374233129, + "velocity_packet": 0.7309239263803681, + "velocity_packet_t01": 0.6368631901840491, + "velocity_packet_t03": 0.6292564417177913, + "velocity_packet_t05": 0.6427644171779142, + "velocity_packet_t07": 0.7079889570552147, + "velocity_packet_t09": 0.7601141104294478, + "velocity_packet_t10": 0.7446699386503067, + "velocity_total": 0.7455730061349694, + "velocity_total_t01": 0.6405092024539877, + "velocity_total_t03": 0.6500920245398772, + "velocity_total_t05": 0.6852343558282209, + "velocity_total_t07": 0.7346687116564418, + "velocity_total_t09": 0.767361963190184, + "velocity_total_t10": 0.7644171779141103 + }, + "recon-osscan": { + "_n": 352.0, + "arc_length": 0.9080051136363637, + "causal_surprisal_flow": 0.3493113636363636, + "causal_surprisal_packet_max": 0.36744147727272725, + "causal_surprisal_packet_mean": 0.36662215909090906, + "causal_surprisal_packet_median": 0.43374318181818183, + "causal_surprisal_packet_trimmed10_mean": 0.3907647727272727, + "causal_surprisal_total": 0.3824323863636364, + "consistency_total": 0.8901619318181818, + "curvature_flow": 0.21089999999999998, + "curvature_packet": 0.4814721590909091, + "curvature_total": 0.34112698863636365, + "direction_drift_flow": 0.18756136363636366, + "direction_drift_packet_max": 0.24069431818181816, + "direction_drift_packet_mean": 0.20537045454545452, + "direction_drift_packet_median": 0.20851647727272726, + "direction_drift_packet_trimmed10_mean": 0.20657272727272727, + "direction_drift_total": 0.15966136363636363, + "flow_consistency": 0.8887596590909093, + "jacobian_flow": 0.38994517045454546, + "jacobian_packet": 0.7554448863636363, + "jacobian_total": 0.6902803977272727, + "kappa2_speed2norm_packet_mean": 0.27074488636363636, + "kappa2_speed2norm_packet_median": 0.2694767045454545, + "kappa2_speed2norm_packet_trimmed10_mean": 0.27280625, + "kinetic_energy": 0.90779375, + "kinetic_flow": 0.8333147727272728, + "kinetic_packet": 0.8736931818181818, + "packet_consistency": 0.8389255681818183, + "pna_flow": 0.10865113636363637, + "pna_packet_max": 0.2814579545454545, + "pna_packet_mean": 0.27074488636363636, + "pna_packet_median": 0.2694767045454545, + "pna_packet_trimmed10_mean": 0.27280625, + "terminal_flow": 0.918628409090909, + "terminal_norm": 0.9287636363636362, + "terminal_packet": 0.9134292613636363, + "velocity_flow": 0.7937585227272727, + "velocity_flow_t01": 0.6082318181818183, + "velocity_flow_t03": 0.6438954545454545, + "velocity_flow_t05": 0.69868125, + "velocity_flow_t07": 0.774153409090909, + "velocity_flow_t09": 0.8319755681818182, + "velocity_flow_t10": 0.8284954545454545, + "velocity_packet": 0.8538732954545454, + "velocity_packet_t01": 0.758665340909091, + "velocity_packet_t03": 0.7453678977272727, + "velocity_packet_t05": 0.7565954545454545, + "velocity_packet_t07": 0.8204926136363637, + "velocity_packet_t09": 0.8738838068181818, + "velocity_packet_t10": 0.8636926136363637, + "velocity_total": 0.8759022727272727, + "velocity_total_t01": 0.7455181818181816, + "velocity_total_t03": 0.7576409090909091, + "velocity_total_t05": 0.8028051136363636, + "velocity_total_t07": 0.8578653409090911, + "velocity_total_t09": 0.9010630681818181, + "velocity_total_t10": 0.899959090909091 + }, + "recon-pingsweep": { + "_n": 4.0, + "arc_length": 0.963, + "causal_surprisal_flow": 0.6129, + "causal_surprisal_packet_max": 0.57275, + "causal_surprisal_packet_mean": 0.5751499999999999, + "causal_surprisal_packet_median": 0.50725, + "causal_surprisal_packet_trimmed10_mean": 0.57675, + "causal_surprisal_total": 0.6285000000000001, + "consistency_total": 0.9, + "curvature_flow": 0.23019999999999996, + "curvature_packet": 0.7391000000000001, + "curvature_total": 0.61355, + "direction_drift_flow": 0.1692, + "direction_drift_packet_max": 0.3645, + "direction_drift_packet_mean": 0.34125, + "direction_drift_packet_median": 0.31720000000000004, + "direction_drift_packet_trimmed10_mean": 0.3044, + "direction_drift_total": 0.35285, + "flow_consistency": 0.8769, + "jacobian_flow": 0.356, + "jacobian_packet": 0.30535, + "jacobian_total": 0.31605000000000005, + "kappa2_speed2norm_packet_mean": 0.47665, + "kappa2_speed2norm_packet_median": 0.4941, + "kappa2_speed2norm_packet_trimmed10_mean": 0.46195, + "kinetic_energy": 0.9626, + "kinetic_flow": 0.8733500000000001, + "kinetic_packet": 0.98245, + "packet_consistency": 0.83675, + "pna_flow": 0.06150000000000003, + "pna_packet_max": 0.46415, + "pna_packet_mean": 0.47665, + "pna_packet_median": 0.4941, + "pna_packet_trimmed10_mean": 0.46195, + "terminal_flow": 0.9361, + "terminal_norm": 0.9913000000000001, + "terminal_packet": 0.9893, + "velocity_flow": 0.8191, + "velocity_flow_t01": 0.6552, + "velocity_flow_t03": 0.66625, + "velocity_flow_t05": 0.67825, + "velocity_flow_t07": 0.7043499999999999, + "velocity_flow_t09": 0.85245, + "velocity_flow_t10": 0.86925, + "velocity_packet": 0.9084, + "velocity_packet_t01": 0.68335, + "velocity_packet_t03": 0.7152499999999999, + "velocity_packet_t05": 0.7436, + "velocity_packet_t07": 0.7524500000000001, + "velocity_packet_t09": 0.9547, + "velocity_packet_t10": 0.9681, + "velocity_total": 0.8959999999999999, + "velocity_total_t01": 0.67745, + "velocity_total_t03": 0.6943, + "velocity_total_t05": 0.7151, + "velocity_total_t07": 0.7834000000000001, + "velocity_total_t09": 0.9199499999999999, + "velocity_total_t10": 0.93825 + }, + "recon-portscan": { + "_n": 385.0, + "arc_length": 0.9191698701298702, + "causal_surprisal_flow": 0.2637080519480519, + "causal_surprisal_packet_max": 0.3419849350649351, + "causal_surprisal_packet_mean": 0.35769038961038957, + "causal_surprisal_packet_median": 0.43348051948051947, + "causal_surprisal_packet_trimmed10_mean": 0.3896046753246753, + "causal_surprisal_total": 0.31461558441558435, + "consistency_total": 0.8905755844155845, + "curvature_flow": 0.18821506493506493, + "curvature_packet": 0.476092987012987, + "curvature_total": 0.31707792207792207, + "direction_drift_flow": 0.17092675324675324, + "direction_drift_packet_max": 0.19411064935064937, + "direction_drift_packet_mean": 0.16319376623376625, + "direction_drift_packet_median": 0.16830441558441558, + "direction_drift_packet_trimmed10_mean": 0.16580727272727272, + "direction_drift_total": 0.11790493506493507, + "flow_consistency": 0.89232987012987, + "jacobian_flow": 0.3813020779220779, + "jacobian_packet": 0.7829184415584416, + "jacobian_total": 0.7178425974025975, + "kappa2_speed2norm_packet_mean": 0.22572467532467533, + "kappa2_speed2norm_packet_median": 0.22898181818181818, + "kappa2_speed2norm_packet_trimmed10_mean": 0.22780935064935065, + "kinetic_energy": 0.9187225974025973, + "kinetic_flow": 0.8425532467532467, + "kinetic_packet": 0.8834031168831168, + "packet_consistency": 0.8506477922077922, + "pna_flow": 0.08384727272727273, + "pna_packet_max": 0.23432051948051946, + "pna_packet_mean": 0.22572467532467533, + "pna_packet_median": 0.22898181818181818, + "pna_packet_trimmed10_mean": 0.22780935064935065, + "terminal_flow": 0.9293812987012986, + "terminal_norm": 0.9390971428571427, + "terminal_packet": 0.9290685714285712, + "velocity_flow": 0.8084171428571428, + "velocity_flow_t01": 0.6035672727272727, + "velocity_flow_t03": 0.6232815584415585, + "velocity_flow_t05": 0.6823522077922077, + "velocity_flow_t07": 0.7845984415584416, + "velocity_flow_t09": 0.8394296103896104, + "velocity_flow_t10": 0.8412041558441559, + "velocity_packet": 0.8598451948051948, + "velocity_packet_t01": 0.7714161038961038, + "velocity_packet_t03": 0.7590275324675325, + "velocity_packet_t05": 0.771531948051948, + "velocity_packet_t07": 0.8400514285714287, + "velocity_packet_t09": 0.8838264935064936, + "velocity_packet_t10": 0.8812399999999999, + "velocity_total": 0.8934000000000001, + "velocity_total_t01": 0.7588363636363635, + "velocity_total_t03": 0.7690877922077923, + "velocity_total_t05": 0.8178498701298701, + "velocity_total_t07": 0.8763579220779221, + "velocity_total_t09": 0.9153231168831168, + "velocity_total_t10": 0.9180264935064935 + }, + "sqlinjection": { + "_n": 11.0, + "arc_length": 0.7398909090909092, + "causal_surprisal_flow": 0.7149818181818182, + "causal_surprisal_packet_max": 0.6772545454545454, + "causal_surprisal_packet_mean": 0.5762, + "causal_surprisal_packet_median": 0.4579636363636363, + "causal_surprisal_packet_trimmed10_mean": 0.4765636363636364, + "causal_surprisal_total": 0.6016181818181818, + "consistency_total": 0.7256727272727272, + "curvature_flow": 0.5106363636363637, + "curvature_packet": 0.7550181818181818, + "curvature_total": 0.7268181818181819, + "direction_drift_flow": 0.24723636363636364, + "direction_drift_packet_max": 0.5918363636363636, + "direction_drift_packet_mean": 0.35096363636363637, + "direction_drift_packet_median": 0.3352909090909091, + "direction_drift_packet_trimmed10_mean": 0.3125272727272727, + "direction_drift_total": 0.41158181818181816, + "flow_consistency": 0.6703090909090909, + "jacobian_flow": 0.38536363636363635, + "jacobian_packet": 0.26709090909090905, + "jacobian_total": 0.2861454545454546, + "kappa2_speed2norm_packet_mean": 0.6283636363636363, + "kappa2_speed2norm_packet_median": 0.5521636363636364, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6007454545454546, + "kinetic_energy": 0.7401272727272727, + "kinetic_flow": 0.7629272727272727, + "kinetic_packet": 0.6717454545454545, + "packet_consistency": 0.6283090909090909, + "pna_flow": 0.28047272727272726, + "pna_packet_max": 0.6595636363636364, + "pna_packet_mean": 0.6283636363636363, + "pna_packet_median": 0.5521636363636364, + "pna_packet_trimmed10_mean": 0.6007454545454546, + "terminal_flow": 0.7919636363636363, + "terminal_norm": 0.8419636363636364, + "terminal_packet": 0.8248363636363636, + "velocity_flow": 0.7211818181818181, + "velocity_flow_t01": 0.7410363636363636, + "velocity_flow_t03": 0.7364909090909091, + "velocity_flow_t05": 0.7265454545454546, + "velocity_flow_t07": 0.7175272727272728, + "velocity_flow_t09": 0.7334181818181817, + "velocity_flow_t10": 0.6883818181818182, + "velocity_packet": 0.7691818181818183, + "velocity_packet_t01": 0.7298363636363637, + "velocity_packet_t03": 0.7356545454545453, + "velocity_packet_t05": 0.749, + "velocity_packet_t07": 0.7282, + "velocity_packet_t09": 0.7437636363636364, + "velocity_packet_t10": 0.7723272727272728, + "velocity_total": 0.7410545454545454, + "velocity_total_t01": 0.7268181818181818, + "velocity_total_t03": 0.7245090909090909, + "velocity_total_t05": 0.7312545454545455, + "velocity_total_t07": 0.7354545454545454, + "velocity_total_t09": 0.7451454545454546, + "velocity_total_t10": 0.7268727272727272 + }, + "uploading_attack": { + "_n": 2.0, + "arc_length": 0.6555, + "causal_surprisal_flow": 0.7387, + "causal_surprisal_packet_max": 0.4253, + "causal_surprisal_packet_mean": 0.3328, + "causal_surprisal_packet_median": 0.05780000000000002, + "causal_surprisal_packet_trimmed10_mean": 0.1437, + "causal_surprisal_total": 0.5222, + "consistency_total": 0.24280000000000002, + "curvature_flow": 0.4256, + "curvature_packet": 0.6389, + "curvature_total": 0.5647, + "direction_drift_flow": 0.057099999999999984, + "direction_drift_packet_max": 0.5771999999999999, + "direction_drift_packet_mean": 0.19619999999999999, + "direction_drift_packet_median": 0.2793, + "direction_drift_packet_trimmed10_mean": 0.20280000000000004, + "direction_drift_total": 0.25749999999999995, + "flow_consistency": 0.369, + "jacobian_flow": 0.03920000000000001, + "jacobian_packet": 0.27879999999999994, + "jacobian_total": 0.07879999999999998, + "kappa2_speed2norm_packet_mean": 0.5128, + "kappa2_speed2norm_packet_median": 0.5029, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5196000000000001, + "kinetic_energy": 0.6481, + "kinetic_flow": 0.9415, + "kinetic_packet": 0.5045999999999999, + "packet_consistency": 0.48750000000000004, + "pna_flow": 0.046599999999999975, + "pna_packet_max": 0.6121, + "pna_packet_mean": 0.5128, + "pna_packet_median": 0.5029, + "pna_packet_trimmed10_mean": 0.5196000000000001, + "terminal_flow": 0.7872999999999999, + "terminal_norm": 0.5975, + "terminal_packet": 0.4551, + "velocity_flow": 0.944, + "velocity_flow_t01": 0.9385, + "velocity_flow_t03": 0.9405, + "velocity_flow_t05": 0.939, + "velocity_flow_t07": 0.9419, + "velocity_flow_t09": 0.9423, + "velocity_flow_t10": 0.9396, + "velocity_packet": 0.8278000000000001, + "velocity_packet_t01": 0.9102, + "velocity_packet_t03": 0.9013, + "velocity_packet_t05": 0.8505, + "velocity_packet_t07": 0.773, + "velocity_packet_t09": 0.9182, + "velocity_packet_t10": 0.8379999999999999, + "velocity_total": 0.9179999999999999, + "velocity_total_t01": 0.9194, + "velocity_total_t03": 0.9201, + "velocity_total_t05": 0.9175000000000001, + "velocity_total_t07": 0.9133, + "velocity_total_t09": 0.9287, + "velocity_total_t10": 0.9277999999999998 + }, + "vulnerabilityscan": { + "_n": 567.0, + "arc_length": 0.7635724867724868, + "causal_surprisal_flow": 0.4052860670194004, + "causal_surprisal_packet_max": 0.4557216931216932, + "causal_surprisal_packet_mean": 0.4647802469135802, + "causal_surprisal_packet_median": 0.5026483245149912, + "causal_surprisal_packet_trimmed10_mean": 0.48014074074074076, + "causal_surprisal_total": 0.44816402116402115, + "consistency_total": 0.7343874779541446, + "curvature_flow": 0.3644359788359788, + "curvature_packet": 0.556826102292769, + "curvature_total": 0.4789347442680776, + "direction_drift_flow": 0.2742989417989418, + "direction_drift_packet_max": 0.35289629629629626, + "direction_drift_packet_mean": 0.3337686067019401, + "direction_drift_packet_median": 0.3370481481481481, + "direction_drift_packet_trimmed10_mean": 0.3280306878306878, + "direction_drift_total": 0.30104708994708995, + "flow_consistency": 0.7362571428571428, + "jacobian_flow": 0.44914038800705464, + "jacobian_packet": 0.5926008818342152, + "jacobian_total": 0.5574557319223986, + "kappa2_speed2norm_packet_mean": 0.432031746031746, + "kappa2_speed2norm_packet_median": 0.429815873015873, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4309559082892416, + "kinetic_energy": 0.7636805996472663, + "kinetic_flow": 0.7215442680776013, + "kinetic_packet": 0.7434814814814813, + "packet_consistency": 0.6676539682539682, + "pna_flow": 0.2584416225749559, + "pna_packet_max": 0.42351534391534396, + "pna_packet_mean": 0.432031746031746, + "pna_packet_median": 0.429815873015873, + "pna_packet_trimmed10_mean": 0.4309559082892416, + "terminal_flow": 0.7711527336860668, + "terminal_norm": 0.7943562610229277, + "terminal_packet": 0.783689594356261, + "velocity_flow": 0.68979012345679, + "velocity_flow_t01": 0.5694246913580248, + "velocity_flow_t03": 0.5823188712522046, + "velocity_flow_t05": 0.6035174603174602, + "velocity_flow_t07": 0.6608828924162258, + "velocity_flow_t09": 0.719657848324515, + "velocity_flow_t10": 0.7182395061728394, + "velocity_packet": 0.7058627865961199, + "velocity_packet_t01": 0.6481940035273368, + "velocity_packet_t03": 0.6467848324514991, + "velocity_packet_t05": 0.6593414462081129, + "velocity_packet_t07": 0.6918765432098765, + "velocity_packet_t09": 0.720474074074074, + "velocity_packet_t10": 0.7076790123456791, + "velocity_total": 0.7376867724867725, + "velocity_total_t01": 0.6373291005291005, + "velocity_total_t03": 0.6460924162257495, + "velocity_total_t05": 0.6732553791887125, + "velocity_total_t07": 0.7160035273368607, + "velocity_total_t09": 0.7586938271604937, + "velocity_total_t10": 0.7528479717813051 + }, + "xss": { + "_n": 12.0, + "arc_length": 0.7263166666666666, + "causal_surprisal_flow": 0.5465333333333333, + "causal_surprisal_packet_max": 0.4436833333333333, + "causal_surprisal_packet_mean": 0.36819999999999997, + "causal_surprisal_packet_median": 0.3353499999999999, + "causal_surprisal_packet_trimmed10_mean": 0.3188333333333333, + "causal_surprisal_total": 0.49598333333333333, + "consistency_total": 0.6594333333333333, + "curvature_flow": 0.4703833333333333, + "curvature_packet": 0.64195, + "curvature_total": 0.6266833333333334, + "direction_drift_flow": 0.154, + "direction_drift_packet_max": 0.3454833333333333, + "direction_drift_packet_mean": 0.35445, + "direction_drift_packet_median": 0.3712333333333333, + "direction_drift_packet_trimmed10_mean": 0.36955, + "direction_drift_total": 0.26558333333333334, + "flow_consistency": 0.7098833333333333, + "jacobian_flow": 0.3304, + "jacobian_packet": 0.31448333333333334, + "jacobian_total": 0.3456166666666667, + "kappa2_speed2norm_packet_mean": 0.46996666666666664, + "kappa2_speed2norm_packet_median": 0.5090166666666667, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4835333333333333, + "kinetic_energy": 0.7253833333333333, + "kinetic_flow": 0.73685, + "kinetic_packet": 0.64785, + "packet_consistency": 0.6132666666666666, + "pna_flow": 0.21564166666666665, + "pna_packet_max": 0.4557333333333333, + "pna_packet_mean": 0.46996666666666664, + "pna_packet_median": 0.5090166666666667, + "pna_packet_trimmed10_mean": 0.4835333333333333, + "terminal_flow": 0.7968666666666667, + "terminal_norm": 0.8009833333333334, + "terminal_packet": 0.7105499999999999, + "velocity_flow": 0.7685000000000001, + "velocity_flow_t01": 0.7296833333333334, + "velocity_flow_t03": 0.7312333333333334, + "velocity_flow_t05": 0.7343999999999999, + "velocity_flow_t07": 0.7591333333333333, + "velocity_flow_t09": 0.8146333333333333, + "velocity_flow_t10": 0.8064, + "velocity_packet": 0.6577500000000001, + "velocity_packet_t01": 0.6583, + "velocity_packet_t03": 0.6356333333333333, + "velocity_packet_t05": 0.6215, + "velocity_packet_t07": 0.6145833333333334, + "velocity_packet_t09": 0.67805, + "velocity_packet_t10": 0.7099666666666666, + "velocity_total": 0.7674666666666666, + "velocity_total_t01": 0.7131666666666666, + "velocity_total_t03": 0.7091500000000001, + "velocity_total_t05": 0.7117, + "velocity_total_t07": 0.7378166666666667, + "velocity_total_t09": 0.8111333333333333, + "velocity_total_t10": 0.8013333333333333 + } + }, + "classes": [ + "backdoor_malware", + "browserhijacking", + "commandinjection", + "ddos-ack_fragmentation", + "ddos-http_flood", + "ddos-icmp_flood", + "ddos-icmp_fragmentation", + "ddos-pshack_flood", + "ddos-rstfinflood", + "ddos-slowloris", + "ddos-syn_flood", + "ddos-synonymousip_flood", + "ddos-tcp_flood", + "ddos-udp_flood", + "ddos-udp_fragmentation", + "dictionarybruteforce", + "dns_spoofing", + "dos-http_flood", + "dos-syn_flood", + "dos-tcp_flood", + "dos-udp_flood", + "mirai-greeth_flood", + "mirai-greip_flood", + "mirai-udpplain", + "mitm-arpspoofing", + "recon-hostdiscovery", + "recon-osscan", + "recon-pingsweep", + "recon-portscan", + "sqlinjection", + "uploading_attack", + "vulnerabilityscan", + "xss" + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed44/config.yaml b/artifacts/route_comparison/baseline_ciciot2023_seed44/config.yaml new file mode 100644 index 0000000..acd2a1f --- /dev/null +++ b/artifacts/route_comparison/baseline_ciciot2023_seed44/config.yaml @@ -0,0 +1,38 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 44 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_flow: 0.3 +lambda_packet: 0.3 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packet_mask_ratio: 0.5 +packet_preprocess: mixed_dequant +reference_mode: null +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed44 +seed: 44 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed44/history.json b/artifacts/route_comparison/baseline_ciciot2023_seed44/history.json new file mode 100644 index 0000000..5a0798f --- /dev/null +++ b/artifacts/route_comparison/baseline_ciciot2023_seed44/history.json @@ -0,0 +1,243 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 2.375404718594673, + 1.9514228166678014, + 1.678226929444533, + 1.5021482981168306, + 1.3728312467917418, + 1.2696377314054048, + 1.2202828388947706, + 1.1491697491743627, + 1.142391067284804, + 1.096346602990077, + 1.0863738289246192, + 1.0739134152730305, + 1.048566616498507, + 1.0427031547595293, + 1.0283890244288323, + 1.0062713943994963, + 1.0273569516646557, + 0.9906778687085861, + 0.9895921685756781, + 0.9751735329627991, + 0.9695049661856431, + 0.9612080240860964, + 0.9661574348425254, + 0.9572103283344171, + 0.9415634870529175, + 0.9376634435775952, + 0.9386195326462771, + 0.942052410199092, + 0.9331942475759066, + 0.9246900280316671, + 0.9301107984322768, + 0.9164953461060157, + 0.9201939961849115, + 0.9154176926001524, + 0.9058437316845624, + 0.9158417582511902, + 0.905217999067062, + 0.9068028819866669, + 0.905818352332482, + 0.9015335944982675, + 0.8985590567955604, + 0.8966997571480579, + 0.8985175352830154, + 0.897866272009336, + 0.902957450120877, + 0.9023116842294351, + 0.8925206859906515, + 0.8902736122791584, + 0.8955088838552817, + 0.9001929973944639 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.8641139675000001, + "auroc_curvature_flow": 0.15094789, + "auroc_curvature_packet": 0.38574797250000004, + "auroc_curvature_total": 0.3059942525, + "auroc_kappa2_speed2norm_packet_mean": 0.261677055, + "auroc_kappa2_speed2norm_packet_median": 0.28860930500000004, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.2421784475, + "auroc_kinetic_energy": 0.8440496825000001, + "auroc_kinetic_flow": 0.8068983, + "auroc_kinetic_packet": 0.648253375, + "auroc_terminal_flow": 0.9400431899999999, + "auroc_terminal_norm": 0.95233693, + "auroc_terminal_packet": 0.92638951, + "auroc_velocity_flow": 0.820763685, + "auroc_velocity_packet": 0.826075315, + "auroc_velocity_total": 0.9007554200000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9330450749999999, + "auroc_curvature_flow": 0.18348835749999998, + "auroc_curvature_packet": 0.698837065, + "auroc_curvature_total": 0.5346139799999999, + "auroc_kappa2_speed2norm_packet_mean": 0.30640312999999997, + "auroc_kappa2_speed2norm_packet_median": 0.30790228499999994, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.29016759000000003, + "auroc_kinetic_energy": 0.9321751775, + "auroc_kinetic_flow": 0.8575061725, + "auroc_kinetic_packet": 0.9275522175, + "auroc_terminal_flow": 0.9303275625, + "auroc_terminal_norm": 0.9495913775, + "auroc_terminal_packet": 0.9372237975000001, + "auroc_velocity_flow": 0.847185455, + "auroc_velocity_packet": 0.90088886, + "auroc_velocity_total": 0.9121146849999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9379000099999999, + "auroc_curvature_flow": 0.47254423749999996, + "auroc_curvature_packet": 0.876885015, + "auroc_curvature_total": 0.8379526525000001, + "auroc_kappa2_speed2norm_packet_mean": 0.6049240149999999, + "auroc_kappa2_speed2norm_packet_median": 0.6052114025, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.60159161, + "auroc_kinetic_energy": 0.9377802474999999, + "auroc_kinetic_flow": 0.8849569325, + "auroc_kinetic_packet": 0.93078343, + "auroc_terminal_flow": 0.9439595525000001, + "auroc_terminal_norm": 0.9550663750000001, + "auroc_terminal_packet": 0.9419539350000001, + "auroc_velocity_flow": 0.8638444175000001, + "auroc_velocity_packet": 0.9146016975, + "auroc_velocity_total": 0.9177311349999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9360916650000001, + "auroc_curvature_flow": 0.501332595, + "auroc_curvature_packet": 0.9002687949999999, + "auroc_curvature_total": 0.872131905, + "auroc_kappa2_speed2norm_packet_mean": 0.63047471, + "auroc_kappa2_speed2norm_packet_median": 0.6218162225, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.6273267275000001, + "auroc_kinetic_energy": 0.9358137950000001, + "auroc_kinetic_flow": 0.88791457, + "auroc_kinetic_packet": 0.92805297, + "auroc_terminal_flow": 0.9408362825, + "auroc_terminal_norm": 0.956355745, + "auroc_terminal_packet": 0.94754797, + "auroc_velocity_flow": 0.8697484825, + "auroc_velocity_packet": 0.90902496, + "auroc_velocity_total": 0.917970425 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9430537700000001, + "auroc_curvature_flow": 0.6117466250000001, + "auroc_curvature_packet": 0.911016305, + "auroc_curvature_total": 0.8913783550000001, + "auroc_kappa2_speed2norm_packet_mean": 0.6579762275, + "auroc_kappa2_speed2norm_packet_median": 0.649384215, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.65570636, + "auroc_kinetic_energy": 0.9431445175000001, + "auroc_kinetic_flow": 0.89144018, + "auroc_kinetic_packet": 0.9391872600000001, + "auroc_terminal_flow": 0.9442437625, + "auroc_terminal_norm": 0.9599741549999999, + "auroc_terminal_packet": 0.9520035724999999, + "auroc_velocity_flow": 0.8695564625000001, + "auroc_velocity_packet": 0.9135123100000001, + "auroc_velocity_total": 0.9172896825000001 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed44/model.pt b/artifacts/route_comparison/baseline_ciciot2023_seed44/model.pt new file mode 100644 index 0000000..5b45cb4 Binary files /dev/null and b/artifacts/route_comparison/baseline_ciciot2023_seed44/model.pt differ diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed44/phase1.log b/artifacts/route_comparison/baseline_ciciot2023_seed44/phase1.log new file mode 100644 index 0000000..7d039d6 --- /dev/null +++ b/artifacts/route_comparison/baseline_ciciot2023_seed44/phase1.log @@ -0,0 +1,134 @@ +[config] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed44/config.yaml +[model] T=64 flow_dim=20 packet_dim=9 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets_source=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] using external flow features D=20 +[data] rows total=8,193,621 keep len>=2: 3,797,530 +[data] benign=97,045 attack=20,000 -> train=77,636 val=10,000 +[data] train=77,636 val=10,000 attack=20,000 +[eval] scoring val=5,000 and attack=10,000 +/home/chy/mambafortrafficmodeling/.venv/lib/python3.14/site-packages/torch/autograd/graph.py:869: UserWarning: Attempting to run cuBLAS, but there was no current CUDA context! Attempting to set the primary context... (Triggered internally at /pytorch/aten/src/ATen/cuda/CublasHandlePool.cpp:335.) + return Variable._execution_engine.run_backward( # Calls into the C++ engine to run the backward pass +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done in 12.0s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] attack done in 22.7s +[eval] score keys: 57 first 5: ['arc_length', 'causal_surprisal_flow', 'causal_surprisal_packet_max', 'causal_surprisal_packet_mean', 'causal_surprisal_packet_median'] +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed44/phase1_summary.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed44/phase1_scores.npz + +=== overall AUROC (sorted desc) === + terminal_norm AUROC=0.9600 AUPRC=0.9819 + terminal_packet AUROC=0.9531 AUPRC=0.9788 + terminal_flow AUROC=0.9453 AUPRC=0.9699 + kinetic_energy AUROC=0.9448 AUPRC=0.9693 + arc_length AUROC=0.9448 AUPRC=0.9691 + kinetic_packet AUROC=0.9430 AUPRC=0.9760 + velocity_total_t09 AUROC=0.9283 AUPRC=0.9401 + velocity_packet_t09 AUROC=0.9223 AUPRC=0.9611 + velocity_total_t10 AUROC=0.9208 AUPRC=0.9318 + consistency_total AUROC=0.9183 AUPRC=0.9537 + velocity_total AUROC=0.9166 AUPRC=0.9301 + flow_consistency AUROC=0.9164 AUPRC=0.9505 + velocity_total_t07 AUROC=0.9131 AUPRC=0.9317 + velocity_packet AUROC=0.9128 AUPRC=0.9505 + curvature_packet AUROC=0.9072 AUPRC=0.9557 + velocity_packet_t07 AUROC=0.9058 AUPRC=0.9513 + velocity_total_t05 AUROC=0.8972 AUPRC=0.9184 + velocity_packet_t10 AUROC=0.8939 AUPRC=0.9446 + velocity_packet_t05 AUROC=0.8935 AUPRC=0.9292 + kinetic_flow AUROC=0.8906 AUPRC=0.8968 + velocity_total_t03 AUROC=0.8828 AUPRC=0.9077 + velocity_packet_t03 AUROC=0.8820 AUPRC=0.9118 + velocity_total_t01 AUROC=0.8762 AUPRC=0.9024 + velocity_flow_t09 AUROC=0.8733 AUPRC=0.8689 + velocity_flow_t10 AUROC=0.8708 AUPRC=0.8664 + curvature_total AUROC=0.8700 AUPRC=0.9326 + velocity_flow_t03 AUROC=0.8700 AUPRC=0.8809 + velocity_flow AUROC=0.8687 AUPRC=0.8694 + velocity_flow_t05 AUROC=0.8676 AUPRC=0.8753 + velocity_packet_t01 AUROC=0.8671 AUPRC=0.9002 + velocity_flow_t07 AUROC=0.8665 AUPRC=0.8702 + velocity_flow_t01 AUROC=0.8574 AUPRC=0.8775 + packet_consistency AUROC=0.8281 AUPRC=0.9144 + jacobian_packet AUROC=0.7594 AUPRC=0.8791 + pna_packet_max AUROC=0.6104 AUPRC=0.7817 + kappa2_speed2norm_packet_mean AUROC=0.5700 AUPRC=0.7703 + pna_packet_mean AUROC=0.5700 AUPRC=0.7703 + kappa2_speed2norm_packet_trimmed10_mean AUROC=0.5611 AUPRC=0.7646 + pna_packet_trimmed10_mean AUROC=0.5611 AUPRC=0.7646 + kappa2_speed2norm_packet_median AUROC=0.5571 AUPRC=0.7680 + pna_packet_median AUROC=0.5571 AUPRC=0.7680 + causal_surprisal_flow AUROC=0.5237 AUPRC=0.6484 + causal_surprisal_total AUROC=0.5187 AUPRC=0.6782 + causal_surprisal_packet_max AUROC=0.4765 AUPRC=0.6169 + jacobian_total AUROC=0.4716 AUPRC=0.6805 + causal_surprisal_packet_mean AUROC=0.4672 AUPRC=0.6018 + curvature_flow AUROC=0.4611 AUPRC=0.6692 + causal_surprisal_packet_median AUROC=0.4456 AUPRC=0.6565 + causal_surprisal_packet_trimmed10_mean AUROC=0.4274 AUPRC=0.5918 + direction_drift_packet_max AUROC=0.3719 AUPRC=0.6054 + direction_drift_packet_mean AUROC=0.2397 AUPRC=0.5387 + direction_drift_packet_median AUROC=0.2274 AUPRC=0.5351 + direction_drift_packet_trimmed10_mean AUROC=0.2261 AUPRC=0.5416 + direction_drift_total AUROC=0.1877 AUPRC=0.4980 + jacobian_flow AUROC=0.1838 AUPRC=0.4966 + direction_drift_flow AUROC=0.1309 AUPRC=0.4773 + pna_flow AUROC=0.0945 AUPRC=0.4691 diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed44/phase1_scores.npz b/artifacts/route_comparison/baseline_ciciot2023_seed44/phase1_scores.npz new file mode 100644 index 0000000..27f9c62 Binary files /dev/null and b/artifacts/route_comparison/baseline_ciciot2023_seed44/phase1_scores.npz differ diff --git a/artifacts/route_comparison/baseline_ciciot2023_seed44/phase1_summary.json b/artifacts/route_comparison/baseline_ciciot2023_seed44/phase1_summary.json new file mode 100644 index 0000000..8c1615f --- /dev/null +++ b/artifacts/route_comparison/baseline_ciciot2023_seed44/phase1_summary.json @@ -0,0 +1,2293 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed44", + "config": { + "T": 64, + "attack_cap": 20000, + "batch_size": 256, + "benign_label": "normal", + "d_model": 128, + "data_seed": 44, + "device": "auto", + "epochs": 50, + "eval_batch_size": 512, + "eval_every": 10, + "eval_n": 20000, + "eval_n_steps": 8, + "flow_features_align": "auto", + "flow_features_path": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet", + "flows_parquet": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet", + "grad_clip": 1.0, + "lambda_flow": 0.3, + "lambda_packet": 0.3, + "lr": 0.0003, + "min_len": 2, + "mlp_ratio": 4.0, + "n_heads": 4, + "n_layers": 4, + "n_train": 10000, + "num_workers": 0, + "packet_mask_ratio": 0.5, + "packet_preprocess": "mixed_dequant", + "reference_mode": null, + "save_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed44", + "seed": 44, + "sigma": 0.1, + "source_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "time_dim": 64, + "token_dim": null, + "train_ratio": 0.8, + "use_ot": true, + "val_cap": 10000, + "weight_decay": 0.01 + }, + "n_val": 5000, + "n_atk": 10000, + "n_score_keys": 57, + "overall": { + "arc_length": { + "auroc": 0.94476513, + "auprc": 0.9691011012258375 + }, + "causal_surprisal_flow": { + "auroc": 0.52371593, + "auprc": 0.6484296988315178 + }, + "causal_surprisal_packet_max": { + "auroc": 0.47653374000000004, + "auprc": 0.6168825640278288 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.4672204, + "auprc": 0.6017797644156688 + }, + "causal_surprisal_packet_median": { + "auroc": 0.44564168, + "auprc": 0.6565064889571541 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.42737206, + "auprc": 0.5917823754427507 + }, + "causal_surprisal_total": { + "auroc": 0.51871549, + "auprc": 0.6781888752122788 + }, + "consistency_total": { + "auroc": 0.9182941499999999, + "auprc": 0.9537075470058956 + }, + "curvature_flow": { + "auroc": 0.46107924000000006, + "auprc": 0.6692220275099245 + }, + "curvature_packet": { + "auroc": 0.90717631, + "auprc": 0.9556933962445117 + }, + "curvature_total": { + "auroc": 0.8700381899999998, + "auprc": 0.9325581564309032 + }, + "direction_drift_flow": { + "auroc": 0.13088499, + "auprc": 0.4773197059640263 + }, + "direction_drift_packet_max": { + "auroc": 0.37191467, + "auprc": 0.6054127767143298 + }, + "direction_drift_packet_mean": { + "auroc": 0.2396976, + "auprc": 0.5386928934308683 + }, + "direction_drift_packet_median": { + "auroc": 0.22743829, + "auprc": 0.5351224980805043 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.22607860000000002, + "auprc": 0.5415562760913036 + }, + "direction_drift_total": { + "auroc": 0.18771647000000002, + "auprc": 0.4979966252741743 + }, + "flow_consistency": { + "auroc": 0.9163548499999999, + "auprc": 0.9505220675336215 + }, + "jacobian_flow": { + "auroc": 0.18379989, + "auprc": 0.4966275906314543 + }, + "jacobian_packet": { + "auroc": 0.75942705, + "auprc": 0.8790895670445267 + }, + "jacobian_total": { + "auroc": 0.4715914, + "auprc": 0.6805216090598493 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.57000208, + "auprc": 0.770346474262839 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.55713511, + "auprc": 0.7680369364579054 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.56109885, + "auprc": 0.7646345819028444 + }, + "kinetic_energy": { + "auroc": 0.94478259, + "auprc": 0.9693069675762638 + }, + "kinetic_flow": { + "auroc": 0.89064222, + "auprc": 0.8967857256026388 + }, + "kinetic_packet": { + "auroc": 0.9430260800000001, + "auprc": 0.9760078886134982 + }, + "packet_consistency": { + "auroc": 0.82806481, + "auprc": 0.9143951082864343 + }, + "pna_flow": { + "auroc": 0.09449553, + "auprc": 0.4690651815659957 + }, + "pna_packet_max": { + "auroc": 0.61039735, + "auprc": 0.7817043469022762 + }, + "pna_packet_mean": { + "auroc": 0.57000208, + "auprc": 0.770346474262839 + }, + "pna_packet_median": { + "auroc": 0.55713511, + "auprc": 0.7680369364579054 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.56109885, + "auprc": 0.7646345819028444 + }, + "terminal_flow": { + "auroc": 0.94533518, + "auprc": 0.9699410173250904 + }, + "terminal_norm": { + "auroc": 0.96000444, + "auprc": 0.9819163238300211 + }, + "terminal_packet": { + "auroc": 0.9530863599999999, + "auprc": 0.9787769624041597 + }, + "velocity_flow": { + "auroc": 0.8687141, + "auprc": 0.8694498441749405 + }, + "velocity_flow_t01": { + "auroc": 0.8574231000000001, + "auprc": 0.8774659226067799 + }, + "velocity_flow_t03": { + "auroc": 0.8699556999999999, + "auprc": 0.8808636114662907 + }, + "velocity_flow_t05": { + "auroc": 0.8675928500000001, + "auprc": 0.8752882489370453 + }, + "velocity_flow_t07": { + "auroc": 0.86649712, + "auprc": 0.8701858737650939 + }, + "velocity_flow_t09": { + "auroc": 0.8732505000000002, + "auprc": 0.8688958121243842 + }, + "velocity_flow_t10": { + "auroc": 0.8708199400000001, + "auprc": 0.8664390886432836 + }, + "velocity_packet": { + "auroc": 0.91280346, + "auprc": 0.9504524403848695 + }, + "velocity_packet_t01": { + "auroc": 0.86712652, + "auprc": 0.9001942267570086 + }, + "velocity_packet_t03": { + "auroc": 0.8819791900000001, + "auprc": 0.911818191337715 + }, + "velocity_packet_t05": { + "auroc": 0.8935349, + "auprc": 0.9291994301590518 + }, + "velocity_packet_t07": { + "auroc": 0.9058221399999999, + "auprc": 0.9513475281232309 + }, + "velocity_packet_t09": { + "auroc": 0.92229128, + "auprc": 0.9611283108504745 + }, + "velocity_packet_t10": { + "auroc": 0.89388538, + "auprc": 0.9446142330214349 + }, + "velocity_total": { + "auroc": 0.9165879100000001, + "auprc": 0.9300877168117946 + }, + "velocity_total_t01": { + "auroc": 0.8761535199999999, + "auprc": 0.9023575877850893 + }, + "velocity_total_t03": { + "auroc": 0.88278959, + "auprc": 0.9077469810380825 + }, + "velocity_total_t05": { + "auroc": 0.8971708999999999, + "auprc": 0.9184035900943714 + }, + "velocity_total_t07": { + "auroc": 0.9131437600000001, + "auprc": 0.931662829730804 + }, + "velocity_total_t09": { + "auroc": 0.9283473000000001, + "auprc": 0.9401120270542773 + }, + "velocity_total_t10": { + "auroc": 0.92076963, + "auprc": 0.9317553979523108 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 7.0, + "arc_length": 0.9122285714285715, + "causal_surprisal_flow": 0.44608571428571425, + "causal_surprisal_packet_max": 0.3053714285714285, + "causal_surprisal_packet_mean": 0.2868857142857143, + "causal_surprisal_packet_median": 0.29642857142857143, + "causal_surprisal_packet_trimmed10_mean": 0.23317142857142856, + "causal_surprisal_total": 0.4156571428571429, + "consistency_total": 0.8277428571428571, + "curvature_flow": 0.3919714285714285, + "curvature_packet": 0.6705428571428571, + "curvature_total": 0.6029428571428571, + "direction_drift_flow": 0.19017142857142855, + "direction_drift_packet_max": 0.1901142857142857, + "direction_drift_packet_mean": 0.2392285714285714, + "direction_drift_packet_median": 0.24442857142857144, + "direction_drift_packet_trimmed10_mean": 0.2489142857142857, + "direction_drift_total": 0.18417142857142854, + "flow_consistency": 0.8726285714285714, + "jacobian_flow": 0.27094285714285715, + "jacobian_packet": 0.35288571428571425, + "jacobian_total": 0.3722, + "kappa2_speed2norm_packet_mean": 0.3248, + "kappa2_speed2norm_packet_median": 0.3216857142857143, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3274285714285714, + "kinetic_energy": 0.9110857142857143, + "kinetic_flow": 0.8133714285714285, + "kinetic_packet": 0.9202857142857143, + "packet_consistency": 0.6145714285714285, + "pna_flow": 0.18862857142857145, + "pna_packet_max": 0.3428571428571428, + "pna_packet_mean": 0.3248, + "pna_packet_median": 0.3216857142857143, + "pna_packet_trimmed10_mean": 0.3274285714285714, + "terminal_flow": 0.9024571428571428, + "terminal_norm": 0.9328285714285716, + "terminal_packet": 0.9335142857142857, + "velocity_flow": 0.7816285714285716, + "velocity_flow_t01": 0.7149142857142856, + "velocity_flow_t03": 0.7456285714285715, + "velocity_flow_t05": 0.7517714285714285, + "velocity_flow_t07": 0.7611428571428571, + "velocity_flow_t09": 0.8129714285714286, + "velocity_flow_t10": 0.7933142857142856, + "velocity_packet": 0.7432571428571428, + "velocity_packet_t01": 0.492, + "velocity_packet_t03": 0.5329714285714285, + "velocity_packet_t05": 0.5531714285714286, + "velocity_packet_t07": 0.6033714285714286, + "velocity_packet_t09": 0.8132285714285715, + "velocity_packet_t10": 0.9025142857142857, + "velocity_total": 0.8306, + "velocity_total_t01": 0.6953428571428572, + "velocity_total_t03": 0.7267714285714285, + "velocity_total_t05": 0.7409714285714286, + "velocity_total_t07": 0.7774285714285714, + "velocity_total_t09": 0.8787428571428572, + "velocity_total_t10": 0.8746285714285714 + }, + "browserhijacking": { + "_n": 9.0, + "arc_length": 0.6673111111111111, + "causal_surprisal_flow": 0.7322888888888888, + "causal_surprisal_packet_max": 0.5393111111111111, + "causal_surprisal_packet_mean": 0.4445111111111111, + "causal_surprisal_packet_median": 0.32097777777777775, + "causal_surprisal_packet_trimmed10_mean": 0.3697333333333333, + "causal_surprisal_total": 0.6404666666666666, + "consistency_total": 0.525511111111111, + "curvature_flow": 0.6418222222222223, + "curvature_packet": 0.6160222222222222, + "curvature_total": 0.6319333333333333, + "direction_drift_flow": 0.15875555555555557, + "direction_drift_packet_max": 0.3727555555555555, + "direction_drift_packet_mean": 0.22015555555555558, + "direction_drift_packet_median": 0.20433333333333334, + "direction_drift_packet_trimmed10_mean": 0.22048888888888885, + "direction_drift_total": 0.21208888888888885, + "flow_consistency": 0.5419555555555555, + "jacobian_flow": 0.24059999999999998, + "jacobian_packet": 0.3277333333333333, + "jacobian_total": 0.3381333333333333, + "kappa2_speed2norm_packet_mean": 0.4910444444444445, + "kappa2_speed2norm_packet_median": 0.4971333333333333, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5010444444444444, + "kinetic_energy": 0.6654444444444445, + "kinetic_flow": 0.7574222222222223, + "kinetic_packet": 0.6158888888888888, + "packet_consistency": 0.45633333333333337, + "pna_flow": 0.3274888888888889, + "pna_packet_max": 0.5470666666666666, + "pna_packet_mean": 0.4910444444444445, + "pna_packet_median": 0.4971333333333333, + "pna_packet_trimmed10_mean": 0.5010444444444444, + "terminal_flow": 0.7136222222222223, + "terminal_norm": 0.6988, + "terminal_packet": 0.7065777777777777, + "velocity_flow": 0.7237333333333333, + "velocity_flow_t01": 0.7206666666666666, + "velocity_flow_t03": 0.7269333333333333, + "velocity_flow_t05": 0.7246444444444444, + "velocity_flow_t07": 0.734, + "velocity_flow_t09": 0.7474, + "velocity_flow_t10": 0.7400222222222222, + "velocity_packet": 0.6451777777777777, + "velocity_packet_t01": 0.6744222222222223, + "velocity_packet_t03": 0.6693333333333333, + "velocity_packet_t05": 0.6540888888888888, + "velocity_packet_t07": 0.6458, + "velocity_packet_t09": 0.6818888888888889, + "velocity_packet_t10": 0.6353333333333334, + "velocity_total": 0.6775333333333334, + "velocity_total_t01": 0.6748222222222222, + "velocity_total_t03": 0.6695333333333334, + "velocity_total_t05": 0.6772666666666666, + "velocity_total_t07": 0.6838444444444444, + "velocity_total_t09": 0.7338444444444444, + "velocity_total_t10": 0.6896888888888889 + }, + "commandinjection": { + "_n": 11.0, + "arc_length": 0.8806363636363638, + "causal_surprisal_flow": 0.6366363636363636, + "causal_surprisal_packet_max": 0.5198181818181818, + "causal_surprisal_packet_mean": 0.4697272727272727, + "causal_surprisal_packet_median": 0.4552545454545454, + "causal_surprisal_packet_trimmed10_mean": 0.4243454545454545, + "causal_surprisal_total": 0.5775454545454546, + "consistency_total": 0.7410181818181818, + "curvature_flow": 0.6188545454545454, + "curvature_packet": 0.7998363636363637, + "curvature_total": 0.8110181818181819, + "direction_drift_flow": 0.15109090909090908, + "direction_drift_packet_max": 0.42876363636363635, + "direction_drift_packet_mean": 0.35267272727272725, + "direction_drift_packet_median": 0.3794181818181818, + "direction_drift_packet_trimmed10_mean": 0.3476727272727272, + "direction_drift_total": 0.33916363636363633, + "flow_consistency": 0.7366545454545455, + "jacobian_flow": 0.1806, + "jacobian_packet": 0.39790909090909093, + "jacobian_total": 0.3228181818181818, + "kappa2_speed2norm_packet_mean": 0.6900000000000001, + "kappa2_speed2norm_packet_median": 0.6761999999999999, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7076, + "kinetic_energy": 0.8820363636363636, + "kinetic_flow": 0.8739818181818182, + "kinetic_packet": 0.7622545454545454, + "packet_consistency": 0.6175272727272727, + "pna_flow": 0.16607272727272726, + "pna_packet_max": 0.6516545454545455, + "pna_packet_mean": 0.6900000000000001, + "pna_packet_median": 0.6761999999999999, + "pna_packet_trimmed10_mean": 0.7076, + "terminal_flow": 0.9158545454545454, + "terminal_norm": 0.9329636363636364, + "terminal_packet": 0.9047454545454545, + "velocity_flow": 0.8448545454545455, + "velocity_flow_t01": 0.8015636363636364, + "velocity_flow_t03": 0.8264727272727272, + "velocity_flow_t05": 0.8361090909090909, + "velocity_flow_t07": 0.8396545454545455, + "velocity_flow_t09": 0.8532181818181818, + "velocity_flow_t10": 0.8470181818181818, + "velocity_packet": 0.7508636363636364, + "velocity_packet_t01": 0.7000181818181819, + "velocity_packet_t03": 0.7284909090909091, + "velocity_packet_t05": 0.7421636363636364, + "velocity_packet_t07": 0.7304545454545455, + "velocity_packet_t09": 0.7736909090909092, + "velocity_packet_t10": 0.6845272727272727, + "velocity_total": 0.8450909090909091, + "velocity_total_t01": 0.7694727272727273, + "velocity_total_t03": 0.8026, + "velocity_total_t05": 0.8171999999999999, + "velocity_total_t07": 0.8383818181818182, + "velocity_total_t09": 0.8611272727272727, + "velocity_total_t10": 0.824709090909091 + }, + "ddos-ack_fragmentation": { + "_n": 340.0, + "arc_length": 0.9790305882352941, + "causal_surprisal_flow": 0.0847664705882353, + "causal_surprisal_packet_max": 0.2773029411764706, + "causal_surprisal_packet_mean": 0.27360823529411765, + "causal_surprisal_packet_median": 0.35982941176470595, + "causal_surprisal_packet_trimmed10_mean": 0.29653, + "causal_surprisal_total": 0.08350941176470589, + "consistency_total": 0.9756547058823529, + "curvature_flow": 0.21022588235294118, + "curvature_packet": 0.9772688235294117, + "curvature_total": 0.93965, + "direction_drift_flow": 0.09417264705882354, + "direction_drift_packet_max": 0.2611076470588235, + "direction_drift_packet_mean": 0.2618364705882353, + "direction_drift_packet_median": 0.2809205882352941, + "direction_drift_packet_trimmed10_mean": 0.2839876470588235, + "direction_drift_total": 0.10300823529411765, + "flow_consistency": 0.9690882352941177, + "jacobian_flow": 0.04641941176470589, + "jacobian_packet": 0.9650958823529412, + "jacobian_total": 0.6579676470588235, + "kappa2_speed2norm_packet_mean": 0.5031047058823529, + "kappa2_speed2norm_packet_median": 0.562274705882353, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5521347058823529, + "kinetic_energy": 0.9789635294117648, + "kinetic_flow": 0.9328735294117646, + "kinetic_packet": 0.9789052941176469, + "packet_consistency": 0.9799358823529413, + "pna_flow": 0.027228235294117643, + "pna_packet_max": 0.3926382352941176, + "pna_packet_mean": 0.5031047058823529, + "pna_packet_median": 0.562274705882353, + "pna_packet_trimmed10_mean": 0.5521347058823529, + "terminal_flow": 0.9809405882352941, + "terminal_norm": 0.9845017647058824, + "terminal_packet": 0.9842576470588235, + "velocity_flow": 0.9334517647058823, + "velocity_flow_t01": 0.9574288235294118, + "velocity_flow_t03": 0.9542805882352942, + "velocity_flow_t05": 0.9472017647058825, + "velocity_flow_t07": 0.9368205882352941, + "velocity_flow_t09": 0.918399411764706, + "velocity_flow_t10": 0.9120005882352942, + "velocity_packet": 0.9726788235294118, + "velocity_packet_t01": 0.9642664705882353, + "velocity_packet_t03": 0.9659076470588235, + "velocity_packet_t05": 0.9696588235294117, + "velocity_packet_t07": 0.9726576470588236, + "velocity_packet_t09": 0.9694182352941176, + "velocity_packet_t10": 0.9422494117647061, + "velocity_total": 0.9736147058823531, + "velocity_total_t01": 0.9770235294117647, + "velocity_total_t03": 0.9765364705882352, + "velocity_total_t05": 0.9751994117647058, + "velocity_total_t07": 0.9748058823529411, + "velocity_total_t09": 0.9731270588235295, + "velocity_total_t10": 0.970574705882353 + }, + "ddos-http_flood": { + "_n": 893.0, + "arc_length": 0.9369966405375142, + "causal_surprisal_flow": 0.5683368421052631, + "causal_surprisal_packet_max": 0.3016808510638298, + "causal_surprisal_packet_mean": 0.31111556550951847, + "causal_surprisal_packet_median": 0.3308726763717805, + "causal_surprisal_packet_trimmed10_mean": 0.28522194848824184, + "causal_surprisal_total": 0.540606718924972, + "consistency_total": 0.9286154535274357, + "curvature_flow": 0.4842301231802911, + "curvature_packet": 0.9561151175811868, + "curvature_total": 0.9237189249720045, + "direction_drift_flow": 0.1420195968645017, + "direction_drift_packet_max": 0.664119372900336, + "direction_drift_packet_mean": 0.4942874580067189, + "direction_drift_packet_median": 0.4889968645016797, + "direction_drift_packet_trimmed10_mean": 0.49124120940649496, + "direction_drift_total": 0.34295610302351626, + "flow_consistency": 0.9230356103023516, + "jacobian_flow": 0.22118924972004478, + "jacobian_packet": 0.6956172452407615, + "jacobian_total": 0.48924008958566634, + "kappa2_speed2norm_packet_mean": 0.8287386338185891, + "kappa2_speed2norm_packet_median": 0.8247820828667414, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8271010078387457, + "kinetic_energy": 0.9369863381858903, + "kinetic_flow": 0.8679892497200449, + "kinetic_packet": 0.943674804031355, + "packet_consistency": 0.8058262038073908, + "pna_flow": 0.10825464725643898, + "pna_packet_max": 0.8112792833146697, + "pna_packet_mean": 0.8287386338185891, + "pna_packet_median": 0.8247820828667414, + "pna_packet_trimmed10_mean": 0.8271010078387457, + "terminal_flow": 0.9710199328107504, + "terminal_norm": 0.9882145576707727, + "terminal_packet": 0.982799104143337, + "velocity_flow": 0.8580658454647255, + "velocity_flow_t01": 0.8355274356103024, + "velocity_flow_t03": 0.8516708846584545, + "velocity_flow_t05": 0.856010974244121, + "velocity_flow_t07": 0.8580008958566631, + "velocity_flow_t09": 0.8631368421052632, + "velocity_flow_t10": 0.8634790593505038, + "velocity_packet": 0.8619484882418813, + "velocity_packet_t01": 0.8808071668533034, + "velocity_packet_t03": 0.8808315789473684, + "velocity_packet_t05": 0.8690506159014558, + "velocity_packet_t07": 0.8659630459126539, + "velocity_packet_t09": 0.8717243001119822, + "velocity_packet_t10": 0.7800472564389698, + "velocity_total": 0.9145567749160134, + "velocity_total_t01": 0.861543784994401, + "velocity_total_t03": 0.8676154535274356, + "velocity_total_t05": 0.8953791713325868, + "velocity_total_t07": 0.9159363941769317, + "velocity_total_t09": 0.9236846584546473, + "velocity_total_t10": 0.912479731243001 + }, + "ddos-icmp_flood": { + "_n": 20.0, + "arc_length": 0.6937799999999998, + "causal_surprisal_flow": 0.5583199999999999, + "causal_surprisal_packet_max": 0.48882000000000003, + "causal_surprisal_packet_mean": 0.49071, + "causal_surprisal_packet_median": 0.52756, + "causal_surprisal_packet_trimmed10_mean": 0.47739999999999994, + "causal_surprisal_total": 0.53765, + "consistency_total": 0.69153, + "curvature_flow": 0.52212, + "curvature_packet": 0.60298, + "curvature_total": 0.62775, + "direction_drift_flow": 0.33290000000000003, + "direction_drift_packet_max": 0.5733199999999999, + "direction_drift_packet_mean": 0.56372, + "direction_drift_packet_median": 0.5551, + "direction_drift_packet_trimmed10_mean": 0.55837, + "direction_drift_total": 0.518175, + "flow_consistency": 0.70291, + "jacobian_flow": 0.40996000000000005, + "jacobian_packet": 0.58497, + "jacobian_total": 0.5165, + "kappa2_speed2norm_packet_mean": 0.5822299999999999, + "kappa2_speed2norm_packet_median": 0.58707, + "kappa2_speed2norm_packet_trimmed10_mean": 0.57934, + "kinetic_energy": 0.69377, + "kinetic_flow": 0.6544000000000001, + "kinetic_packet": 0.66177, + "packet_consistency": 0.5762, + "pna_flow": 0.41517999999999994, + "pna_packet_max": 0.59826, + "pna_packet_mean": 0.5822299999999999, + "pna_packet_median": 0.58707, + "pna_packet_trimmed10_mean": 0.57934, + "terminal_flow": 0.70346, + "terminal_norm": 0.7221, + "terminal_packet": 0.6983300000000001, + "velocity_flow": 0.6512899999999999, + "velocity_flow_t01": 0.66055, + "velocity_flow_t03": 0.6647799999999999, + "velocity_flow_t05": 0.65507, + "velocity_flow_t07": 0.64123, + "velocity_flow_t09": 0.6574500000000001, + "velocity_flow_t10": 0.63134, + "velocity_packet": 0.58313, + "velocity_packet_t01": 0.54972, + "velocity_packet_t03": 0.5445500000000001, + "velocity_packet_t05": 0.55008, + "velocity_packet_t07": 0.56409, + "velocity_packet_t09": 0.5948599999999999, + "velocity_packet_t10": 0.5890500000000001, + "velocity_total": 0.6422, + "velocity_total_t01": 0.618785, + "velocity_total_t03": 0.61675, + "velocity_total_t05": 0.61301, + "velocity_total_t07": 0.6232300000000001, + "velocity_total_t09": 0.6451499999999999, + "velocity_total_t10": 0.66415 + }, + "ddos-icmp_fragmentation": { + "_n": 35.0, + "arc_length": 0.8631828571428571, + "causal_surprisal_flow": 0.5622685714285715, + "causal_surprisal_packet_max": 0.46566857142857143, + "causal_surprisal_packet_mean": 0.47738857142857144, + "causal_surprisal_packet_median": 0.56652, + "causal_surprisal_packet_trimmed10_mean": 0.4771885714285714, + "causal_surprisal_total": 0.5603428571428571, + "consistency_total": 0.7102057142857143, + "curvature_flow": 0.39028, + "curvature_packet": 0.6738, + "curvature_total": 0.64056, + "direction_drift_flow": 0.19574285714285716, + "direction_drift_packet_max": 0.41107428571428567, + "direction_drift_packet_mean": 0.4160285714285714, + "direction_drift_packet_median": 0.4191542857142857, + "direction_drift_packet_trimmed10_mean": 0.4243028571428571, + "direction_drift_total": 0.3307485714285715, + "flow_consistency": 0.7821199999999999, + "jacobian_flow": 0.33770285714285714, + "jacobian_packet": 0.4108285714285714, + "jacobian_total": 0.3869142857142857, + "kappa2_speed2norm_packet_mean": 0.5687714285714286, + "kappa2_speed2norm_packet_median": 0.5814971428571428, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5835257142857143, + "kinetic_energy": 0.8635142857142857, + "kinetic_flow": 0.8133371428571429, + "kinetic_packet": 0.7894571428571429, + "packet_consistency": 0.4713885714285714, + "pna_flow": 0.16312, + "pna_packet_max": 0.5470228571428571, + "pna_packet_mean": 0.5687714285714286, + "pna_packet_median": 0.5814971428571428, + "pna_packet_trimmed10_mean": 0.5835257142857143, + "terminal_flow": 0.9133257142857143, + "terminal_norm": 0.9315085714285715, + "terminal_packet": 0.8525828571428572, + "velocity_flow": 0.7747485714285715, + "velocity_flow_t01": 0.6933257142857143, + "velocity_flow_t03": 0.7255371428571429, + "velocity_flow_t05": 0.7380342857142856, + "velocity_flow_t07": 0.7419314285714286, + "velocity_flow_t09": 0.7812171428571428, + "velocity_flow_t10": 0.8063142857142858, + "velocity_packet": 0.6307428571428572, + "velocity_packet_t01": 0.5002171428571428, + "velocity_packet_t03": 0.5272, + "velocity_packet_t05": 0.5508685714285714, + "velocity_packet_t07": 0.5776457142857143, + "velocity_packet_t09": 0.6593142857142857, + "velocity_packet_t10": 0.66992, + "velocity_total": 0.7724, + "velocity_total_t01": 0.6624628571428571, + "velocity_total_t03": 0.6768799999999999, + "velocity_total_t05": 0.6956571428571428, + "velocity_total_t07": 0.7361314285714285, + "velocity_total_t09": 0.7860514285714285, + "velocity_total_t10": 0.8006628571428571 + }, + "ddos-pshack_flood": { + "_n": 1065.0, + "arc_length": 0.9913600000000001, + "causal_surprisal_flow": 0.5508475117370892, + "causal_surprisal_packet_max": 0.5938217840375587, + "causal_surprisal_packet_mean": 0.5319748356807511, + "causal_surprisal_packet_median": 0.24012469483568075, + "causal_surprisal_packet_trimmed10_mean": 0.3339446009389671, + "causal_surprisal_total": 0.535364882629108, + "consistency_total": 0.9743136150234741, + "curvature_flow": 0.8382281690140846, + "curvature_packet": 0.9945098591549296, + "curvature_total": 0.9882997183098592, + "direction_drift_flow": 0.05158291079812207, + "direction_drift_packet_max": 0.08162460093896715, + "direction_drift_packet_mean": 0.04052845070422535, + "direction_drift_packet_median": 0.0499275117370892, + "direction_drift_packet_trimmed10_mean": 0.040276056338028166, + "direction_drift_total": 0.02169145539906104, + "flow_consistency": 0.9636640375586856, + "jacobian_flow": 0.07715999999999999, + "jacobian_packet": 0.8245364319248826, + "jacobian_total": 0.33891652582159626, + "kappa2_speed2norm_packet_mean": 0.5331919248826291, + "kappa2_speed2norm_packet_median": 0.5516427230046947, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5173680751173709, + "kinetic_energy": 0.9914266666666667, + "kinetic_flow": 0.9602314553990611, + "kinetic_packet": 0.9983973708920187, + "packet_consistency": 0.9700754929577464, + "pna_flow": 0.07901323943661973, + "pna_packet_max": 0.5080790610328638, + "pna_packet_mean": 0.5331919248826291, + "pna_packet_median": 0.5516427230046947, + "pna_packet_trimmed10_mean": 0.5173680751173709, + "terminal_flow": 0.948326572769953, + "terminal_norm": 0.9916001877934272, + "terminal_packet": 0.9934040375586853, + "velocity_flow": 0.9279654460093897, + "velocity_flow_t01": 0.9439194366197183, + "velocity_flow_t03": 0.9415896713615024, + "velocity_flow_t05": 0.9388018779342722, + "velocity_flow_t07": 0.932590985915493, + "velocity_flow_t09": 0.926538591549296, + "velocity_flow_t10": 0.9224759624413146, + "velocity_packet": 0.9912369953051644, + "velocity_packet_t01": 0.9635153051643193, + "velocity_packet_t03": 0.9737006572769953, + "velocity_packet_t05": 0.9845575586854458, + "velocity_packet_t07": 0.9936828169014086, + "velocity_packet_t09": 0.9915470422535212, + "velocity_packet_t10": 0.975498309859155, + "velocity_total": 0.9736542723004695, + "velocity_total_t01": 0.9563147417840375, + "velocity_total_t03": 0.9619600938967136, + "velocity_total_t05": 0.9695256338028169, + "velocity_total_t07": 0.9762662910798123, + "velocity_total_t09": 0.978482441314554, + "velocity_total_t10": 0.9697239436619719 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "arc_length": 0.7225, + "causal_surprisal_flow": 0.41459999999999997, + "causal_surprisal_packet_max": 0.3974, + "causal_surprisal_packet_mean": 0.42100000000000004, + "causal_surprisal_packet_median": 0.4983, + "causal_surprisal_packet_trimmed10_mean": 0.4537, + "causal_surprisal_total": 0.43679999999999997, + "consistency_total": 0.8194999999999999, + "curvature_flow": 0.08030000000000004, + "curvature_packet": 0.9028, + "curvature_total": 0.7254999999999999, + "direction_drift_flow": 0.581, + "direction_drift_packet_max": 0.3476, + "direction_drift_packet_mean": 0.4373, + "direction_drift_packet_median": 0.5388999999999999, + "direction_drift_packet_trimmed10_mean": 0.47040000000000004, + "direction_drift_total": 0.4386, + "flow_consistency": 0.8295, + "jacobian_flow": 0.48819999999999997, + "jacobian_packet": 0.5971, + "jacobian_total": 0.6707000000000001, + "kappa2_speed2norm_packet_mean": 0.8692, + "kappa2_speed2norm_packet_median": 0.9432, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9068, + "kinetic_energy": 0.7281, + "kinetic_flow": 0.4895, + "kinetic_packet": 0.8792, + "packet_consistency": 0.3983, + "pna_flow": 0.3204, + "pna_packet_max": 0.6888, + "pna_packet_mean": 0.8692, + "pna_packet_median": 0.9432, + "pna_packet_trimmed10_mean": 0.9068, + "terminal_flow": 0.6554, + "terminal_norm": 0.9012, + "terminal_packet": 0.9617, + "velocity_flow": 0.4603, + "velocity_flow_t01": 0.5986, + "velocity_flow_t03": 0.5898, + "velocity_flow_t05": 0.5605, + "velocity_flow_t07": 0.5267999999999999, + "velocity_flow_t09": 0.44759999999999994, + "velocity_flow_t10": 0.4399, + "velocity_packet": 0.5915, + "velocity_packet_t01": 0.4359, + "velocity_packet_t03": 0.4843, + "velocity_packet_t05": 0.5085999999999999, + "velocity_packet_t07": 0.5455, + "velocity_packet_t09": 0.6485, + "velocity_packet_t10": 0.5913, + "velocity_total": 0.5336, + "velocity_total_t01": 0.5101, + "velocity_total_t03": 0.5112, + "velocity_total_t05": 0.5416000000000001, + "velocity_total_t07": 0.5712999999999999, + "velocity_total_t09": 0.5695, + "velocity_total_t10": 0.5193 + }, + "ddos-slowloris": { + "_n": 336.0, + "arc_length": 0.8751630952380953, + "causal_surprisal_flow": 0.7440113095238093, + "causal_surprisal_packet_max": 0.5957488095238095, + "causal_surprisal_packet_mean": 0.5610119047619047, + "causal_surprisal_packet_median": 0.5510583333333334, + "causal_surprisal_packet_trimmed10_mean": 0.5292732142857143, + "causal_surprisal_total": 0.6629160714285713, + "consistency_total": 0.8393446428571429, + "curvature_flow": 0.4304380952380952, + "curvature_packet": 0.8948273809523808, + "curvature_total": 0.8740178571428572, + "direction_drift_flow": 0.20188095238095238, + "direction_drift_packet_max": 0.6180440476190476, + "direction_drift_packet_mean": 0.4288547619047619, + "direction_drift_packet_median": 0.4092458333333333, + "direction_drift_packet_trimmed10_mean": 0.3812797619047619, + "direction_drift_total": 0.4501744047619048, + "flow_consistency": 0.8533648809523809, + "jacobian_flow": 0.21976785714285715, + "jacobian_packet": 0.26167261904761907, + "jacobian_total": 0.19910476190476192, + "kappa2_speed2norm_packet_mean": 0.7022907738095239, + "kappa2_speed2norm_packet_median": 0.6973297619047619, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6854916666666666, + "kinetic_energy": 0.8734482142857143, + "kinetic_flow": 0.8729383928571428, + "kinetic_packet": 0.8249696428571428, + "packet_consistency": 0.6925342261904763, + "pna_flow": 0.10589940476190476, + "pna_packet_max": 0.7198863095238095, + "pna_packet_mean": 0.7022907738095239, + "pna_packet_median": 0.6973297619047619, + "pna_packet_trimmed10_mean": 0.6854916666666666, + "terminal_flow": 0.9388178571428571, + "terminal_norm": 0.9349955357142857, + "terminal_packet": 0.9145839285714285, + "velocity_flow": 0.8508529761904761, + "velocity_flow_t01": 0.8066363095238095, + "velocity_flow_t03": 0.8222119047619048, + "velocity_flow_t05": 0.8294416666666666, + "velocity_flow_t07": 0.8416708333333334, + "velocity_flow_t09": 0.8638071428571429, + "velocity_flow_t10": 0.8700488095238095, + "velocity_packet": 0.871894642857143, + "velocity_packet_t01": 0.8647113095238096, + "velocity_packet_t03": 0.8680053571428572, + "velocity_packet_t05": 0.8612184523809523, + "velocity_packet_t07": 0.815889880952381, + "velocity_packet_t09": 0.8709910714285716, + "velocity_packet_t10": 0.8804285714285714, + "velocity_total": 0.8676261904761905, + "velocity_total_t01": 0.8167119047619048, + "velocity_total_t03": 0.8312642857142857, + "velocity_total_t05": 0.8496982142857141, + "velocity_total_t07": 0.852585119047619, + "velocity_total_t09": 0.8720238095238095, + "velocity_total_t10": 0.8837059523809524 + }, + "ddos-syn_flood": { + "_n": 1089.0, + "arc_length": 0.9903022956841138, + "causal_surprisal_flow": 0.568309458218549, + "causal_surprisal_packet_max": 0.5786536271809, + "causal_surprisal_packet_mean": 0.5590754820936639, + "causal_surprisal_packet_median": 0.46255298438934805, + "causal_surprisal_packet_trimmed10_mean": 0.4694165289256198, + "causal_surprisal_total": 0.573468870523416, + "consistency_total": 0.982515702479339, + "curvature_flow": 0.2500988062442608, + "curvature_packet": 0.9898734618916437, + "curvature_total": 0.9792530762167125, + "direction_drift_flow": 0.12452754820936639, + "direction_drift_packet_max": 0.5051224977043158, + "direction_drift_packet_mean": 0.3543662993572084, + "direction_drift_packet_median": 0.27495463728191, + "direction_drift_packet_trimmed10_mean": 0.2855837465564738, + "direction_drift_total": 0.27685215794306706, + "flow_consistency": 0.9681228650137741, + "jacobian_flow": 0.06862736455463728, + "jacobian_packet": 0.9559247933884298, + "jacobian_total": 0.5134323232323232, + "kappa2_speed2norm_packet_mean": 0.8177237832874197, + "kappa2_speed2norm_packet_median": 0.8309281910009182, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7973944903581268, + "kinetic_energy": 0.9905219467401286, + "kinetic_flow": 0.9340870523415978, + "kinetic_packet": 0.9970200183654729, + "packet_consistency": 0.9931217630853996, + "pna_flow": 0.02759173553719008, + "pna_packet_max": 0.7815818181818183, + "pna_packet_mean": 0.8177237832874197, + "pna_packet_median": 0.8309281910009182, + "pna_packet_trimmed10_mean": 0.7973944903581268, + "terminal_flow": 0.991823691460055, + "terminal_norm": 0.9974488521579431, + "terminal_packet": 0.9971116620752983, + "velocity_flow": 0.9148257116620753, + "velocity_flow_t01": 0.9424194674012856, + "velocity_flow_t03": 0.9391594123048668, + "velocity_flow_t05": 0.9236809917355371, + "velocity_flow_t07": 0.9160462809917356, + "velocity_flow_t09": 0.9087101928374657, + "velocity_flow_t10": 0.9067836547291093, + "velocity_packet": 0.9768642791551883, + "velocity_packet_t01": 0.9567351698806245, + "velocity_packet_t03": 0.9587742883379246, + "velocity_packet_t05": 0.9633603305785123, + "velocity_packet_t07": 0.9732253443526171, + "velocity_packet_t09": 0.9842361799816346, + "velocity_packet_t10": 0.9674163452708906, + "velocity_total": 0.9564591368227732, + "velocity_total_t01": 0.9512356290174472, + "velocity_total_t03": 0.9512176308539946, + "velocity_total_t05": 0.9524549127640037, + "velocity_total_t07": 0.9547561065197429, + "velocity_total_t09": 0.9687162534435261, + "velocity_total_t10": 0.9589775022956841 + }, + "ddos-synonymousip_flood": { + "_n": 191.0, + "arc_length": 0.9720198952879581, + "causal_surprisal_flow": 0.4721214659685864, + "causal_surprisal_packet_max": 0.9484858638743455, + "causal_surprisal_packet_mean": 0.8452282722513088, + "causal_surprisal_packet_median": 0.8803099476439791, + "causal_surprisal_packet_trimmed10_mean": 0.8832649214659686, + "causal_surprisal_total": 0.5140816753926701, + "consistency_total": 0.9944910994764399, + "curvature_flow": 0.005801047120418849, + "curvature_packet": 0.9964324607329843, + "curvature_total": 0.9917560209424084, + "direction_drift_flow": 0.04213979057591623, + "direction_drift_packet_max": 0.6357329842931937, + "direction_drift_packet_mean": 0.2482240837696335, + "direction_drift_packet_median": 0.21994921465968587, + "direction_drift_packet_trimmed10_mean": 0.21842513089005233, + "direction_drift_total": 0.37097434554973824, + "flow_consistency": 0.9959193717277487, + "jacobian_flow": 0.0023486910994764366, + "jacobian_packet": 0.4360073298429319, + "jacobian_total": 0.13835811518324606, + "kappa2_speed2norm_packet_mean": 0.9169780104712041, + "kappa2_speed2norm_packet_median": 0.9116910994764399, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9258827225130889, + "kinetic_energy": 0.9730837696335078, + "kinetic_flow": 0.9016314136125654, + "kinetic_packet": 0.9921727748691098, + "packet_consistency": 0.9788628272251308, + "pna_flow": 0.0010785340314136123, + "pna_packet_max": 0.9248659685863874, + "pna_packet_mean": 0.9169780104712041, + "pna_packet_median": 0.9116910994764399, + "pna_packet_trimmed10_mean": 0.9258827225130889, + "terminal_flow": 0.9994774869109947, + "terminal_norm": 0.9989235602094241, + "terminal_packet": 0.9965319371727749, + "velocity_flow": 0.8866649214659686, + "velocity_flow_t01": 0.8993937172774868, + "velocity_flow_t03": 0.8900869109947644, + "velocity_flow_t05": 0.8864418848167539, + "velocity_flow_t07": 0.8832816753926701, + "velocity_flow_t09": 0.8967382198952879, + "velocity_flow_t10": 0.9027675392670157, + "velocity_packet": 0.9823005235602094, + "velocity_packet_t01": 0.9525581151832461, + "velocity_packet_t03": 0.962144502617801, + "velocity_packet_t05": 0.9715465968586388, + "velocity_packet_t07": 0.984771727748691, + "velocity_packet_t09": 0.9758523560209423, + "velocity_packet_t10": 0.9664743455497384, + "velocity_total": 0.918986387434555, + "velocity_total_t01": 0.8722837696335077, + "velocity_total_t03": 0.9108890052356021, + "velocity_total_t05": 0.9197078534031413, + "velocity_total_t07": 0.9253801047120419, + "velocity_total_t09": 0.9137287958115182, + "velocity_total_t10": 0.8957089005235602 + }, + "ddos-tcp_flood": { + "_n": 1198.0, + "arc_length": 0.9946318030050083, + "causal_surprisal_flow": 0.5281395659432387, + "causal_surprisal_packet_max": 0.5400495826377295, + "causal_surprisal_packet_mean": 0.5246113522537562, + "causal_surprisal_packet_median": 0.4563884808013356, + "causal_surprisal_packet_trimmed10_mean": 0.5193026711185309, + "causal_surprisal_total": 0.5026674457429048, + "consistency_total": 0.9536968280467445, + "curvature_flow": 0.6666825542570952, + "curvature_packet": 0.9439016694490818, + "curvature_total": 0.9319491652754591, + "direction_drift_flow": 0.05712103505843072, + "direction_drift_packet_max": 0.024285141903171957, + "direction_drift_packet_mean": 0.012412520868113515, + "direction_drift_packet_median": 0.02004090150250417, + "direction_drift_packet_trimmed10_mean": 0.014348914858096825, + "direction_drift_total": 0.004024040066777963, + "flow_consistency": 0.9440974958263773, + "jacobian_flow": 0.07353171953255427, + "jacobian_packet": 0.89660183639399, + "jacobian_total": 0.5072032554257095, + "kappa2_speed2norm_packet_mean": 0.119069449081803, + "kappa2_speed2norm_packet_median": 0.10173405676126877, + "kappa2_speed2norm_packet_trimmed10_mean": 0.11208464106844741, + "kinetic_energy": 0.9946597662771286, + "kinetic_flow": 0.9528848080133556, + "kinetic_packet": 0.9981846410684474, + "packet_consistency": 0.8347248747913188, + "pna_flow": 0.05073155258764607, + "pna_packet_max": 0.22057212020033387, + "pna_packet_mean": 0.119069449081803, + "pna_packet_median": 0.10173405676126877, + "pna_packet_trimmed10_mean": 0.11208464106844741, + "terminal_flow": 0.9468412353923206, + "terminal_norm": 0.9887540901502505, + "terminal_packet": 0.9873779632721202, + "velocity_flow": 0.9236499165275459, + "velocity_flow_t01": 0.9431400667779632, + "velocity_flow_t03": 0.938860100166945, + "velocity_flow_t05": 0.9283346410684473, + "velocity_flow_t07": 0.9253330550918196, + "velocity_flow_t09": 0.9223514190317196, + "velocity_flow_t10": 0.9192732888146913, + "velocity_packet": 0.9926125208681135, + "velocity_packet_t01": 0.9312023372287146, + "velocity_packet_t03": 0.9542667779632721, + "velocity_packet_t05": 0.9772402337228715, + "velocity_packet_t07": 0.9935813856427379, + "velocity_packet_t09": 0.9965409015025041, + "velocity_packet_t10": 0.9942060100166945, + "velocity_total": 0.9791464106844741, + "velocity_total_t01": 0.9549796327212021, + "velocity_total_t03": 0.9616896494156928, + "velocity_total_t05": 0.9711716193656094, + "velocity_total_t07": 0.9797257095158597, + "velocity_total_t09": 0.9852270450751253, + "velocity_total_t10": 0.9822661101836393 + }, + "ddos-udp_flood": { + "_n": 9.0, + "arc_length": 0.9603111111111111, + "causal_surprisal_flow": 0.46015555555555554, + "causal_surprisal_packet_max": 0.4056444444444444, + "causal_surprisal_packet_mean": 0.12911111111111112, + "causal_surprisal_packet_median": 0.08755555555555557, + "causal_surprisal_packet_trimmed10_mean": 0.07499999999999998, + "causal_surprisal_total": 0.21282222222222222, + "consistency_total": 0.8333777777777778, + "curvature_flow": 0.6353555555555555, + "curvature_packet": 0.8590666666666666, + "curvature_total": 0.7634666666666667, + "direction_drift_flow": 0.0891111111111111, + "direction_drift_packet_max": 0.3968444444444444, + "direction_drift_packet_mean": 0.29475555555555555, + "direction_drift_packet_median": 0.3204, + "direction_drift_packet_trimmed10_mean": 0.3124444444444444, + "direction_drift_total": 0.3804, + "flow_consistency": 0.8840444444444444, + "jacobian_flow": 0.13313333333333335, + "jacobian_packet": 0.6831333333333334, + "jacobian_total": 0.44184444444444443, + "kappa2_speed2norm_packet_mean": 0.6800444444444445, + "kappa2_speed2norm_packet_median": 0.6800222222222223, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6831777777777777, + "kinetic_energy": 0.9609777777777778, + "kinetic_flow": 0.9235111111111112, + "kinetic_packet": 0.9774444444444444, + "packet_consistency": 0.5311777777777777, + "pna_flow": 0.055066666666666673, + "pna_packet_max": 0.6469111111111111, + "pna_packet_mean": 0.6800444444444445, + "pna_packet_median": 0.6800222222222223, + "pna_packet_trimmed10_mean": 0.6831777777777777, + "terminal_flow": 0.9705555555555555, + "terminal_norm": 0.9767111111111111, + "terminal_packet": 0.9518, + "velocity_flow": 0.9098222222222222, + "velocity_flow_t01": 0.8239555555555556, + "velocity_flow_t03": 0.8624888888888889, + "velocity_flow_t05": 0.8749333333333333, + "velocity_flow_t07": 0.8682222222222222, + "velocity_flow_t09": 0.9168000000000001, + "velocity_flow_t10": 0.9277555555555556, + "velocity_packet": 0.6701777777777778, + "velocity_packet_t01": 0.7165777777777778, + "velocity_packet_t03": 0.7115111111111111, + "velocity_packet_t05": 0.6685555555555556, + "velocity_packet_t07": 0.6232888888888889, + "velocity_packet_t09": 0.7078222222222222, + "velocity_packet_t10": 0.5704, + "velocity_total": 0.8725555555555555, + "velocity_total_t01": 0.774, + "velocity_total_t03": 0.7778444444444444, + "velocity_total_t05": 0.7782888888888889, + "velocity_total_t07": 0.8047333333333333, + "velocity_total_t09": 0.8692222222222222, + "velocity_total_t10": 0.8015777777777777 + }, + "ddos-udp_fragmentation": { + "_n": 22.0, + "arc_length": 0.7680090909090909, + "causal_surprisal_flow": 0.6134727272727273, + "causal_surprisal_packet_max": 0.5472181818181818, + "causal_surprisal_packet_mean": 0.5004090909090909, + "causal_surprisal_packet_median": 0.5564363636363636, + "causal_surprisal_packet_trimmed10_mean": 0.4647636363636364, + "causal_surprisal_total": 0.5527818181818183, + "consistency_total": 0.7091, + "curvature_flow": 0.4481363636363636, + "curvature_packet": 0.7488272727272728, + "curvature_total": 0.7541636363636364, + "direction_drift_flow": 0.19994545454545454, + "direction_drift_packet_max": 0.5261545454545455, + "direction_drift_packet_mean": 0.5017181818181818, + "direction_drift_packet_median": 0.4956727272727273, + "direction_drift_packet_trimmed10_mean": 0.4989909090909091, + "direction_drift_total": 0.4268272727272727, + "flow_consistency": 0.7063909090909092, + "jacobian_flow": 0.3171090909090909, + "jacobian_packet": 0.5119909090909092, + "jacobian_total": 0.47693636363636366, + "kappa2_speed2norm_packet_mean": 0.6463363636363637, + "kappa2_speed2norm_packet_median": 0.6457090909090909, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6413909090909091, + "kinetic_energy": 0.7677818181818182, + "kinetic_flow": 0.7737818181818182, + "kinetic_packet": 0.7243909090909091, + "packet_consistency": 0.5577090909090909, + "pna_flow": 0.2561, + "pna_packet_max": 0.6116909090909091, + "pna_packet_mean": 0.6463363636363637, + "pna_packet_median": 0.6457090909090909, + "pna_packet_trimmed10_mean": 0.6413909090909091, + "terminal_flow": 0.8243818181818182, + "terminal_norm": 0.7992818181818183, + "terminal_packet": 0.7599181818181819, + "velocity_flow": 0.7545545454545455, + "velocity_flow_t01": 0.7599181818181817, + "velocity_flow_t03": 0.7553272727272727, + "velocity_flow_t05": 0.7450909090909091, + "velocity_flow_t07": 0.7444909090909091, + "velocity_flow_t09": 0.760990909090909, + "velocity_flow_t10": 0.7801272727272728, + "velocity_packet": 0.6478636363636364, + "velocity_packet_t01": 0.6694272727272728, + "velocity_packet_t03": 0.6667181818181818, + "velocity_packet_t05": 0.6568636363636363, + "velocity_packet_t07": 0.6321181818181818, + "velocity_packet_t09": 0.6772363636363636, + "velocity_packet_t10": 0.6613909090909091, + "velocity_total": 0.7371772727272727, + "velocity_total_t01": 0.7242727272727272, + "velocity_total_t03": 0.7255727272727274, + "velocity_total_t05": 0.7259545454545455, + "velocity_total_t07": 0.7234636363636364, + "velocity_total_t09": 0.7431727272727273, + "velocity_total_t10": 0.7469818181818182 + }, + "dictionarybruteforce": { + "_n": 20.0, + "arc_length": 0.63832, + "causal_surprisal_flow": 0.61778, + "causal_surprisal_packet_max": 0.47801000000000005, + "causal_surprisal_packet_mean": 0.45614999999999994, + "causal_surprisal_packet_median": 0.4758, + "causal_surprisal_packet_trimmed10_mean": 0.38904999999999995, + "causal_surprisal_total": 0.53587, + "consistency_total": 0.5378000000000001, + "curvature_flow": 0.61848, + "curvature_packet": 0.6230699999999999, + "curvature_total": 0.6487700000000001, + "direction_drift_flow": 0.21067000000000002, + "direction_drift_packet_max": 0.47131, + "direction_drift_packet_mean": 0.41008, + "direction_drift_packet_median": 0.39146, + "direction_drift_packet_trimmed10_mean": 0.41417, + "direction_drift_total": 0.37583, + "flow_consistency": 0.6124200000000001, + "jacobian_flow": 0.36450000000000005, + "jacobian_packet": 0.33584, + "jacobian_total": 0.43178, + "kappa2_speed2norm_packet_mean": 0.5556099999999999, + "kappa2_speed2norm_packet_median": 0.56117, + "kappa2_speed2norm_packet_trimmed10_mean": 0.57521, + "kinetic_energy": 0.6368199999999999, + "kinetic_flow": 0.77641, + "kinetic_packet": 0.5715600000000001, + "packet_consistency": 0.34675999999999996, + "pna_flow": 0.31471, + "pna_packet_max": 0.55357, + "pna_packet_mean": 0.5556099999999999, + "pna_packet_median": 0.56117, + "pna_packet_trimmed10_mean": 0.57521, + "terminal_flow": 0.83096, + "terminal_norm": 0.73009, + "terminal_packet": 0.6377299999999999, + "velocity_flow": 0.74709, + "velocity_flow_t01": 0.71203, + "velocity_flow_t03": 0.71691, + "velocity_flow_t05": 0.70055, + "velocity_flow_t07": 0.7083299999999999, + "velocity_flow_t09": 0.75694, + "velocity_flow_t10": 0.7941, + "velocity_packet": 0.58905, + "velocity_packet_t01": 0.5781499999999999, + "velocity_packet_t03": 0.57097, + "velocity_packet_t05": 0.54647, + "velocity_packet_t07": 0.5267599999999999, + "velocity_packet_t09": 0.6398499999999999, + "velocity_packet_t10": 0.65354, + "velocity_total": 0.70723, + "velocity_total_t01": 0.6507299999999999, + "velocity_total_t03": 0.6451800000000001, + "velocity_total_t05": 0.6481, + "velocity_total_t07": 0.67055, + "velocity_total_t09": 0.72452, + "velocity_total_t10": 0.7516999999999999 + }, + "dns_spoofing": { + "_n": 163.0, + "arc_length": 0.7438907975460124, + "causal_surprisal_flow": 0.553120245398773, + "causal_surprisal_packet_max": 0.4619484662576687, + "causal_surprisal_packet_mean": 0.40976441717791406, + "causal_surprisal_packet_median": 0.3936085889570552, + "causal_surprisal_packet_trimmed10_mean": 0.38187239263803685, + "causal_surprisal_total": 0.5089263803680981, + "consistency_total": 0.6645680981595092, + "curvature_flow": 0.6216073619631901, + "curvature_packet": 0.7009717791411043, + "curvature_total": 0.7053791411042943, + "direction_drift_flow": 0.21944723926380366, + "direction_drift_packet_max": 0.46998404907975455, + "direction_drift_packet_mean": 0.34946380368098157, + "direction_drift_packet_median": 0.3539079754601227, + "direction_drift_packet_trimmed10_mean": 0.35445889570552147, + "direction_drift_total": 0.30383312883435587, + "flow_consistency": 0.6574785276073619, + "jacobian_flow": 0.26158650306748465, + "jacobian_packet": 0.5714453987730062, + "jacobian_total": 0.40925030674846624, + "kappa2_speed2norm_packet_mean": 0.5903717791411043, + "kappa2_speed2norm_packet_median": 0.5918392638036809, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6015079754601227, + "kinetic_energy": 0.7433791411042945, + "kinetic_flow": 0.7455656441717792, + "kinetic_packet": 0.6874932515337424, + "packet_consistency": 0.5706220858895705, + "pna_flow": 0.28419754601226993, + "pna_packet_max": 0.5937705521472392, + "pna_packet_mean": 0.5903717791411043, + "pna_packet_median": 0.5918392638036809, + "pna_packet_trimmed10_mean": 0.6015079754601227, + "terminal_flow": 0.7762, + "terminal_norm": 0.7690368098159509, + "terminal_packet": 0.7277828220858895, + "velocity_flow": 0.7494981595092024, + "velocity_flow_t01": 0.7312576687116563, + "velocity_flow_t03": 0.7425803680981595, + "velocity_flow_t05": 0.7430233128834356, + "velocity_flow_t07": 0.7429926380368099, + "velocity_flow_t09": 0.7548503067484663, + "velocity_flow_t10": 0.7598895705521472, + "velocity_packet": 0.6885779141104293, + "velocity_packet_t01": 0.6813496932515338, + "velocity_packet_t03": 0.6856490797546011, + "velocity_packet_t05": 0.6843533742331288, + "velocity_packet_t07": 0.678880981595092, + "velocity_packet_t09": 0.6941116564417179, + "velocity_packet_t10": 0.648926380368098, + "velocity_total": 0.7453042944785278, + "velocity_total_t01": 0.7183533742331288, + "velocity_total_t03": 0.7252981595092024, + "velocity_total_t05": 0.7355840490797547, + "velocity_total_t07": 0.7405644171779141, + "velocity_total_t09": 0.7594797546012271, + "velocity_total_t10": 0.752359509202454 + }, + "dos-http_flood": { + "_n": 714.0, + "arc_length": 0.961396918767507, + "causal_surprisal_flow": 0.26814383753501403, + "causal_surprisal_packet_max": 0.2558389355742297, + "causal_surprisal_packet_mean": 0.2784420168067227, + "causal_surprisal_packet_median": 0.27516162464985994, + "causal_surprisal_packet_trimmed10_mean": 0.25711148459383754, + "causal_surprisal_total": 0.2330128851540616, + "consistency_total": 0.9159686274509805, + "curvature_flow": 0.32388627450980395, + "curvature_packet": 0.8874645658263304, + "curvature_total": 0.7788929971988796, + "direction_drift_flow": 0.14036442577030814, + "direction_drift_packet_max": 0.37655560224089635, + "direction_drift_packet_mean": 0.1581747899159664, + "direction_drift_packet_median": 0.1532036414565826, + "direction_drift_packet_trimmed10_mean": 0.15443389355742299, + "direction_drift_total": 0.11234047619047619, + "flow_consistency": 0.9061970588235295, + "jacobian_flow": 0.2654725490196078, + "jacobian_packet": 0.7283098039215686, + "jacobian_total": 0.5593775910364146, + "kappa2_speed2norm_packet_mean": 0.6394837535014005, + "kappa2_speed2norm_packet_median": 0.6507817927170869, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6530980392156862, + "kinetic_energy": 0.9612899159663865, + "kinetic_flow": 0.8743649859943977, + "kinetic_packet": 0.9613689075630253, + "packet_consistency": 0.8082504201680673, + "pna_flow": 0.06846834733893557, + "pna_packet_max": 0.7081040616246499, + "pna_packet_mean": 0.6394837535014005, + "pna_packet_median": 0.6507817927170869, + "pna_packet_trimmed10_mean": 0.6530980392156862, + "terminal_flow": 0.9757616246498599, + "terminal_norm": 0.985986274509804, + "terminal_packet": 0.9810212885154062, + "velocity_flow": 0.8510305322128852, + "velocity_flow_t01": 0.7945703081232494, + "velocity_flow_t03": 0.827301680672269, + "velocity_flow_t05": 0.838958543417367, + "velocity_flow_t07": 0.8455, + "velocity_flow_t09": 0.8778386554621849, + "velocity_flow_t10": 0.8820507002801121, + "velocity_packet": 0.9250907563025211, + "velocity_packet_t01": 0.8910344537815126, + "velocity_packet_t03": 0.899375350140056, + "velocity_packet_t05": 0.9066352941176471, + "velocity_packet_t07": 0.9215098039215686, + "velocity_packet_t09": 0.9425549019607844, + "velocity_packet_t10": 0.8745498599439777, + "velocity_total": 0.926849299719888, + "velocity_total_t01": 0.8394033613445376, + "velocity_total_t03": 0.844727731092437, + "velocity_total_t05": 0.8828988795518208, + "velocity_total_t07": 0.9203613445378153, + "velocity_total_t09": 0.9511557422969187, + "velocity_total_t10": 0.9493224089635854 + }, + "dos-syn_flood": { + "_n": 836.0, + "arc_length": 0.9855971291866028, + "causal_surprisal_flow": 0.6838401913875598, + "causal_surprisal_packet_max": 0.5755650717703349, + "causal_surprisal_packet_mean": 0.5844897129186603, + "causal_surprisal_packet_median": 0.5753616028708134, + "causal_surprisal_packet_trimmed10_mean": 0.5647818181818182, + "causal_surprisal_total": 0.7216037081339711, + "consistency_total": 0.9878363636363636, + "curvature_flow": 0.10893588516746411, + "curvature_packet": 0.9718387559808612, + "curvature_total": 0.9272811004784689, + "direction_drift_flow": 0.14162631578947368, + "direction_drift_packet_max": 0.5721438995215311, + "direction_drift_packet_mean": 0.3169693779904306, + "direction_drift_packet_median": 0.24136734449760766, + "direction_drift_packet_trimmed10_mean": 0.24519366028708134, + "direction_drift_total": 0.2817425837320574, + "flow_consistency": 0.9841165071770335, + "jacobian_flow": 0.14042846889952154, + "jacobian_packet": 0.8135166267942584, + "jacobian_total": 0.3875377990430622, + "kappa2_speed2norm_packet_mean": 0.7801535885167464, + "kappa2_speed2norm_packet_median": 0.7195468899521531, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7614342105263158, + "kinetic_energy": 0.9859540669856458, + "kinetic_flow": 0.9130844497607656, + "kinetic_packet": 0.9975662679425837, + "packet_consistency": 0.9746366028708136, + "pna_flow": 0.021442344497607655, + "pna_packet_max": 0.8110648325358852, + "pna_packet_mean": 0.7801535885167464, + "pna_packet_median": 0.7195468899521531, + "pna_packet_trimmed10_mean": 0.7614342105263158, + "terminal_flow": 0.992472009569378, + "terminal_norm": 0.9982019138755982, + "terminal_packet": 0.9977550239234451, + "velocity_flow": 0.8891047846889952, + "velocity_flow_t01": 0.9157815789473684, + "velocity_flow_t03": 0.9087021531100479, + "velocity_flow_t05": 0.8951368421052631, + "velocity_flow_t07": 0.8881145933014354, + "velocity_flow_t09": 0.8897703349282295, + "velocity_flow_t10": 0.8890318181818181, + "velocity_packet": 0.9758662679425837, + "velocity_packet_t01": 0.9383007177033492, + "velocity_packet_t03": 0.9460320574162678, + "velocity_packet_t05": 0.9600507177033493, + "velocity_packet_t07": 0.9810605263157894, + "velocity_packet_t09": 0.9824435406698565, + "velocity_packet_t10": 0.9358124401913875, + "velocity_total": 0.9421954545454546, + "velocity_total_t01": 0.9222645933014355, + "velocity_total_t03": 0.9317842105263158, + "velocity_total_t05": 0.9359303827751196, + "velocity_total_t07": 0.9456732057416268, + "velocity_total_t09": 0.9550531100478469, + "velocity_total_t10": 0.937978947368421 + }, + "dos-tcp_flood": { + "_n": 1084.0, + "arc_length": 0.9876562730627307, + "causal_surprisal_flow": 0.6554666051660516, + "causal_surprisal_packet_max": 0.5374160516605166, + "causal_surprisal_packet_mean": 0.5522367158671587, + "causal_surprisal_packet_median": 0.7501507380073801, + "causal_surprisal_packet_trimmed10_mean": 0.5431501845018449, + "causal_surprisal_total": 0.7677094095940958, + "consistency_total": 0.9718540590405903, + "curvature_flow": 0.6328918819188192, + "curvature_packet": 0.9773381918819187, + "curvature_total": 0.9513547970479704, + "direction_drift_flow": 0.08763726937269373, + "direction_drift_packet_max": 0.41039981549815496, + "direction_drift_packet_mean": 0.19150885608856086, + "direction_drift_packet_median": 0.2010241697416974, + "direction_drift_packet_trimmed10_mean": 0.19852352398523984, + "direction_drift_total": 0.12220461254612547, + "flow_consistency": 0.9737075645756458, + "jacobian_flow": 0.1303509225092251, + "jacobian_packet": 0.7657619926199262, + "jacobian_total": 0.4168428044280442, + "kappa2_speed2norm_packet_mean": 0.46850959409594095, + "kappa2_speed2norm_packet_median": 0.3577620848708487, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4093986162361623, + "kinetic_energy": 0.9877885608856088, + "kinetic_flow": 0.923010701107011, + "kinetic_packet": 0.9958055350553506, + "packet_consistency": 0.7241328413284133, + "pna_flow": 0.0874621771217712, + "pna_packet_max": 0.6974027675276753, + "pna_packet_mean": 0.46850959409594095, + "pna_packet_median": 0.3577620848708487, + "pna_packet_trimmed10_mean": 0.4093986162361623, + "terminal_flow": 0.9873238007380073, + "terminal_norm": 0.9952529520295202, + "terminal_packet": 0.9947573800738008, + "velocity_flow": 0.9053736162361623, + "velocity_flow_t01": 0.9312833948339483, + "velocity_flow_t03": 0.9313749077490776, + "velocity_flow_t05": 0.9160653136531365, + "velocity_flow_t07": 0.9065516605166052, + "velocity_flow_t09": 0.892659409594096, + "velocity_flow_t10": 0.8855830258302584, + "velocity_packet": 0.9591185424354245, + "velocity_packet_t01": 0.8142223247232473, + "velocity_packet_t03": 0.8776393911439114, + "velocity_packet_t05": 0.9233402214022142, + "velocity_packet_t07": 0.9620235239852398, + "velocity_packet_t09": 0.9736811808118081, + "velocity_packet_t10": 0.9580234317343171, + "velocity_total": 0.9620612546125461, + "velocity_total_t01": 0.941388745387454, + "velocity_total_t03": 0.9450470479704798, + "velocity_total_t05": 0.9512616236162361, + "velocity_total_t07": 0.9625040590405903, + "velocity_total_t09": 0.9693929889298892, + "velocity_total_t10": 0.9628854243542435 + }, + "dos-udp_flood": { + "_n": 201.0, + "arc_length": 0.9699572139303482, + "causal_surprisal_flow": 0.8663781094527364, + "causal_surprisal_packet_max": 0.7176417910447762, + "causal_surprisal_packet_mean": 0.6425213930348258, + "causal_surprisal_packet_median": 0.4088616915422886, + "causal_surprisal_packet_trimmed10_mean": 0.5833154228855721, + "causal_surprisal_total": 0.5249711442786069, + "consistency_total": 0.9948726368159204, + "curvature_flow": 0.9595154228855721, + "curvature_packet": 0.9791532338308457, + "curvature_total": 0.9752796019900498, + "direction_drift_flow": 0.03261094527363187, + "direction_drift_packet_max": 0.5524353233830845, + "direction_drift_packet_mean": 0.02965373134328358, + "direction_drift_packet_median": 0.02178308457711442, + "direction_drift_packet_trimmed10_mean": 0.019433830845771147, + "direction_drift_total": 0.06340398009950249, + "flow_consistency": 0.9954786069651742, + "jacobian_flow": 0.0188905472636816, + "jacobian_packet": 0.728489552238806, + "jacobian_total": 0.21710547263681593, + "kappa2_speed2norm_packet_mean": 0.5466154228855721, + "kappa2_speed2norm_packet_median": 0.4874835820895523, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5226557213930348, + "kinetic_energy": 0.9701940298507463, + "kinetic_flow": 0.9863422885572138, + "kinetic_packet": 0.9958796019900497, + "packet_consistency": 0.7127920398009949, + "pna_flow": 0.07639800995024876, + "pna_packet_max": 0.8758248756218906, + "pna_packet_mean": 0.5466154228855721, + "pna_packet_median": 0.4874835820895523, + "pna_packet_trimmed10_mean": 0.5226557213930348, + "terminal_flow": 0.9959223880597015, + "terminal_norm": 0.939302487562189, + "terminal_packet": 0.9270029850746269, + "velocity_flow": 0.9791174129353234, + "velocity_flow_t01": 0.9803562189054726, + "velocity_flow_t03": 0.9812825870646766, + "velocity_flow_t05": 0.9814666666666667, + "velocity_flow_t07": 0.9792597014925373, + "velocity_flow_t09": 0.977995024875622, + "velocity_flow_t10": 0.9776945273631841, + "velocity_packet": 0.9885681592039801, + "velocity_packet_t01": 0.981428855721393, + "velocity_packet_t03": 0.9816358208955225, + "velocity_packet_t05": 0.9854467661691543, + "velocity_packet_t07": 0.9886039800995025, + "velocity_packet_t09": 0.976718407960199, + "velocity_packet_t10": 0.9653711442786069, + "velocity_total": 0.9339820895522387, + "velocity_total_t01": 0.929526368159204, + "velocity_total_t03": 0.9295054726368159, + "velocity_total_t05": 0.9334129353233831, + "velocity_total_t07": 0.9346865671641791, + "velocity_total_t09": 0.9256756218905473, + "velocity_total_t10": 0.9129124378109453 + }, + "mirai-greeth_flood": { + "_n": 12.0, + "arc_length": 0.5748833333333333, + "causal_surprisal_flow": 0.542, + "causal_surprisal_packet_max": 0.45005000000000006, + "causal_surprisal_packet_mean": 0.4666, + "causal_surprisal_packet_median": 0.5759, + "causal_surprisal_packet_trimmed10_mean": 0.46445000000000003, + "causal_surprisal_total": 0.5542666666666667, + "consistency_total": 0.6343833333333333, + "curvature_flow": 0.4627, + "curvature_packet": 0.5888166666666665, + "curvature_total": 0.5836166666666667, + "direction_drift_flow": 0.3548, + "direction_drift_packet_max": 0.5018166666666667, + "direction_drift_packet_mean": 0.55315, + "direction_drift_packet_median": 0.5693499999999999, + "direction_drift_packet_trimmed10_mean": 0.5655666666666667, + "direction_drift_total": 0.49125, + "flow_consistency": 0.6436499999999999, + "jacobian_flow": 0.4307166666666667, + "jacobian_packet": 0.68515, + "jacobian_total": 0.5714333333333333, + "kappa2_speed2norm_packet_mean": 0.6706833333333334, + "kappa2_speed2norm_packet_median": 0.6789833333333334, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7037666666666667, + "kinetic_energy": 0.5765, + "kinetic_flow": 0.5626166666666667, + "kinetic_packet": 0.49815, + "packet_consistency": 0.5696833333333333, + "pna_flow": 0.4403166666666667, + "pna_packet_max": 0.6017333333333333, + "pna_packet_mean": 0.6706833333333334, + "pna_packet_median": 0.6789833333333334, + "pna_packet_trimmed10_mean": 0.7037666666666667, + "terminal_flow": 0.6392166666666667, + "terminal_norm": 0.6882333333333334, + "terminal_packet": 0.67395, + "velocity_flow": 0.5698333333333334, + "velocity_flow_t01": 0.627, + "velocity_flow_t03": 0.6066499999999999, + "velocity_flow_t05": 0.56995, + "velocity_flow_t07": 0.5494833333333333, + "velocity_flow_t09": 0.55665, + "velocity_flow_t10": 0.6069, + "velocity_packet": 0.4110333333333333, + "velocity_packet_t01": 0.4576833333333333, + "velocity_packet_t03": 0.4707, + "velocity_packet_t05": 0.4772166666666666, + "velocity_packet_t07": 0.47178333333333333, + "velocity_packet_t09": 0.43446666666666667, + "velocity_packet_t10": 0.37365, + "velocity_total": 0.5606, + "velocity_total_t01": 0.5814166666666667, + "velocity_total_t03": 0.5784, + "velocity_total_t05": 0.5761166666666667, + "velocity_total_t07": 0.5723166666666666, + "velocity_total_t09": 0.5703166666666666, + "velocity_total_t10": 0.5723 + }, + "mirai-greip_flood": { + "_n": 18.0, + "arc_length": 0.7754222222222221, + "causal_surprisal_flow": 0.6145666666666667, + "causal_surprisal_packet_max": 0.4468, + "causal_surprisal_packet_mean": 0.4564777777777778, + "causal_surprisal_packet_median": 0.5452444444444444, + "causal_surprisal_packet_trimmed10_mean": 0.4348222222222222, + "causal_surprisal_total": 0.5476444444444444, + "consistency_total": 0.7327333333333333, + "curvature_flow": 0.4312444444444445, + "curvature_packet": 0.6273222222222222, + "curvature_total": 0.6845111111111112, + "direction_drift_flow": 0.1617777777777778, + "direction_drift_packet_max": 0.49978888888888884, + "direction_drift_packet_mean": 0.39049999999999996, + "direction_drift_packet_median": 0.3793777777777778, + "direction_drift_packet_trimmed10_mean": 0.37379999999999997, + "direction_drift_total": 0.3566666666666667, + "flow_consistency": 0.8462, + "jacobian_flow": 0.30924444444444443, + "jacobian_packet": 0.3211, + "jacobian_total": 0.36533333333333334, + "kappa2_speed2norm_packet_mean": 0.5832555555555555, + "kappa2_speed2norm_packet_median": 0.5774, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5920333333333333, + "kinetic_energy": 0.7744444444444444, + "kinetic_flow": 0.8086111111111112, + "kinetic_packet": 0.5970444444444445, + "packet_consistency": 0.4133555555555556, + "pna_flow": 0.24473333333333336, + "pna_packet_max": 0.5681888888888889, + "pna_packet_mean": 0.5832555555555555, + "pna_packet_median": 0.5774, + "pna_packet_trimmed10_mean": 0.5920333333333333, + "terminal_flow": 0.8703000000000001, + "terminal_norm": 0.8133888888888889, + "terminal_packet": 0.6442888888888889, + "velocity_flow": 0.7995444444444444, + "velocity_flow_t01": 0.7454777777777778, + "velocity_flow_t03": 0.7745222222222222, + "velocity_flow_t05": 0.7787444444444445, + "velocity_flow_t07": 0.7779333333333334, + "velocity_flow_t09": 0.8116111111111111, + "velocity_flow_t10": 0.7965555555555556, + "velocity_packet": 0.6542111111111111, + "velocity_packet_t01": 0.5936, + "velocity_packet_t03": 0.5923444444444445, + "velocity_packet_t05": 0.5871555555555555, + "velocity_packet_t07": 0.5928888888888889, + "velocity_packet_t09": 0.6897444444444445, + "velocity_packet_t10": 0.6918333333333333, + "velocity_total": 0.7787111111111111, + "velocity_total_t01": 0.7083944444444443, + "velocity_total_t03": 0.7276777777777778, + "velocity_total_t05": 0.735, + "velocity_total_t07": 0.7584222222222222, + "velocity_total_t09": 0.8173222222222223, + "velocity_total_t10": 0.7805555555555556 + }, + "mirai-udpplain": { + "_n": 9.0, + "arc_length": 0.5709555555555555, + "causal_surprisal_flow": 0.4415111111111111, + "causal_surprisal_packet_max": 0.46195555555555556, + "causal_surprisal_packet_mean": 0.4808, + "causal_surprisal_packet_median": 0.6268444444444444, + "causal_surprisal_packet_trimmed10_mean": 0.5007333333333333, + "causal_surprisal_total": 0.4653777777777778, + "consistency_total": 0.7402888888888888, + "curvature_flow": 0.5402888888888888, + "curvature_packet": 0.5172222222222222, + "curvature_total": 0.5084, + "direction_drift_flow": 0.4573999999999999, + "direction_drift_packet_max": 0.3293111111111111, + "direction_drift_packet_mean": 0.44053333333333333, + "direction_drift_packet_median": 0.4730666666666666, + "direction_drift_packet_trimmed10_mean": 0.4711777777777778, + "direction_drift_total": 0.39486666666666664, + "flow_consistency": 0.7823111111111111, + "jacobian_flow": 0.4199555555555555, + "jacobian_packet": 0.8028222222222222, + "jacobian_total": 0.7290666666666668, + "kappa2_speed2norm_packet_mean": 0.37995555555555555, + "kappa2_speed2norm_packet_median": 0.3896, + "kappa2_speed2norm_packet_trimmed10_mean": 0.39326666666666665, + "kinetic_energy": 0.5695999999999999, + "kinetic_flow": 0.5212666666666667, + "kinetic_packet": 0.5648666666666666, + "packet_consistency": 0.5001333333333333, + "pna_flow": 0.47608888888888884, + "pna_packet_max": 0.3194666666666667, + "pna_packet_mean": 0.37995555555555555, + "pna_packet_median": 0.3896, + "pna_packet_trimmed10_mean": 0.39326666666666665, + "terminal_flow": 0.6279333333333333, + "terminal_norm": 0.5894666666666667, + "terminal_packet": 0.5775111111111111, + "velocity_flow": 0.561088888888889, + "velocity_flow_t01": 0.6210222222222223, + "velocity_flow_t03": 0.6084888888888889, + "velocity_flow_t05": 0.5769333333333333, + "velocity_flow_t07": 0.5757555555555556, + "velocity_flow_t09": 0.5924444444444443, + "velocity_flow_t10": 0.5652888888888888, + "velocity_packet": 0.4949777777777778, + "velocity_packet_t01": 0.44206666666666666, + "velocity_packet_t03": 0.44004444444444446, + "velocity_packet_t05": 0.43868888888888896, + "velocity_packet_t07": 0.43726666666666664, + "velocity_packet_t09": 0.45084444444444444, + "velocity_packet_t10": 0.5302666666666667, + "velocity_total": 0.5978666666666667, + "velocity_total_t01": 0.5664222222222222, + "velocity_total_t03": 0.5586666666666666, + "velocity_total_t05": 0.5560444444444443, + "velocity_total_t07": 0.5569333333333334, + "velocity_total_t09": 0.5846444444444444, + "velocity_total_t10": 0.6751777777777778 + }, + "mitm-arpspoofing": { + "_n": 134.0, + "arc_length": 0.7578149253731343, + "causal_surprisal_flow": 0.5444686567164179, + "causal_surprisal_packet_max": 0.3572223880597015, + "causal_surprisal_packet_mean": 0.3451089552238806, + "causal_surprisal_packet_median": 0.3491, + "causal_surprisal_packet_trimmed10_mean": 0.3288925373134329, + "causal_surprisal_total": 0.48382089552238805, + "consistency_total": 0.6460947761194029, + "curvature_flow": 0.664479104477612, + "curvature_packet": 0.669389552238806, + "curvature_total": 0.7017716417910448, + "direction_drift_flow": 0.20863432835820894, + "direction_drift_packet_max": 0.32781044776119406, + "direction_drift_packet_mean": 0.27551940298507466, + "direction_drift_packet_median": 0.29413731343283583, + "direction_drift_packet_trimmed10_mean": 0.28581641791044776, + "direction_drift_total": 0.21933283582089552, + "flow_consistency": 0.6865611940298508, + "jacobian_flow": 0.4171134328358209, + "jacobian_packet": 0.43917611940298507, + "jacobian_total": 0.5015007462686567, + "kappa2_speed2norm_packet_mean": 0.5235955223880597, + "kappa2_speed2norm_packet_median": 0.5406343283582089, + "kappa2_speed2norm_packet_trimmed10_mean": 0.546455223880597, + "kinetic_energy": 0.7567716417910447, + "kinetic_flow": 0.7538880597014925, + "kinetic_packet": 0.6677597014925373, + "packet_consistency": 0.3606313432835821, + "pna_flow": 0.31224626865671645, + "pna_packet_max": 0.4830925373134328, + "pna_packet_mean": 0.5235955223880597, + "pna_packet_median": 0.5406343283582089, + "pna_packet_trimmed10_mean": 0.546455223880597, + "terminal_flow": 0.804765671641791, + "terminal_norm": 0.7932701492537312, + "terminal_packet": 0.7178029850746269, + "velocity_flow": 0.7433388059701492, + "velocity_flow_t01": 0.7123253731343283, + "velocity_flow_t03": 0.7293761194029852, + "velocity_flow_t05": 0.7221910447761194, + "velocity_flow_t07": 0.7260268656716419, + "velocity_flow_t09": 0.7609835820895521, + "velocity_flow_t10": 0.7563477611940298, + "velocity_packet": 0.596539552238806, + "velocity_packet_t01": 0.5405597014925374, + "velocity_packet_t03": 0.5461507462686568, + "velocity_packet_t05": 0.5516388059701494, + "velocity_packet_t07": 0.544934328358209, + "velocity_packet_t09": 0.6653462686567164, + "velocity_packet_t10": 0.6462753731343284, + "velocity_total": 0.7454999999999999, + "velocity_total_t01": 0.6857537313432835, + "velocity_total_t03": 0.7021014925373134, + "velocity_total_t05": 0.7098776119402985, + "velocity_total_t07": 0.7289462686567164, + "velocity_total_t09": 0.7800850746268657, + "velocity_total_t10": 0.7529313432835821 + }, + "recon-hostdiscovery": { + "_n": 179.0, + "arc_length": 0.7984245810055866, + "causal_surprisal_flow": 0.37643240223463686, + "causal_surprisal_packet_max": 0.27377877094972064, + "causal_surprisal_packet_mean": 0.30812067039106145, + "causal_surprisal_packet_median": 0.37806703910614525, + "causal_surprisal_packet_trimmed10_mean": 0.31870055865921787, + "causal_surprisal_total": 0.36858100558659224, + "consistency_total": 0.7466737430167599, + "curvature_flow": 0.3765396648044692, + "curvature_packet": 0.6107128491620112, + "curvature_total": 0.5497575418994413, + "direction_drift_flow": 0.259931843575419, + "direction_drift_packet_max": 0.2806022346368715, + "direction_drift_packet_mean": 0.2222905027932961, + "direction_drift_packet_median": 0.23683575418994413, + "direction_drift_packet_trimmed10_mean": 0.23475530726256982, + "direction_drift_total": 0.1805251396648045, + "flow_consistency": 0.7513508379888267, + "jacobian_flow": 0.45530279329608936, + "jacobian_packet": 0.6888122905027934, + "jacobian_total": 0.6721016759776536, + "kappa2_speed2norm_packet_mean": 0.3899832402234637, + "kappa2_speed2norm_packet_median": 0.3954368715083799, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4036715083798883, + "kinetic_energy": 0.7983675977653631, + "kinetic_flow": 0.7229620111731844, + "kinetic_packet": 0.7768614525139664, + "packet_consistency": 0.6948614525139665, + "pna_flow": 0.276136312849162, + "pna_packet_max": 0.4111955307262569, + "pna_packet_mean": 0.3899832402234637, + "pna_packet_median": 0.3954368715083799, + "pna_packet_trimmed10_mean": 0.4036715083798883, + "terminal_flow": 0.8011642458100559, + "terminal_norm": 0.8108078212290503, + "terminal_packet": 0.7839061452513967, + "velocity_flow": 0.6981094972067039, + "velocity_flow_t01": 0.6069553072625699, + "velocity_flow_t03": 0.6665899441340783, + "velocity_flow_t05": 0.6788234636871509, + "velocity_flow_t07": 0.6930960893854747, + "velocity_flow_t09": 0.7337932960893855, + "velocity_flow_t10": 0.7159083798882682, + "velocity_packet": 0.7380100558659217, + "velocity_packet_t01": 0.670795530726257, + "velocity_packet_t03": 0.6818994413407822, + "velocity_packet_t05": 0.6895139664804469, + "velocity_packet_t07": 0.7047195530726258, + "velocity_packet_t09": 0.7422301675977654, + "velocity_packet_t10": 0.733408938547486, + "velocity_total": 0.7476055865921787, + "velocity_total_t01": 0.6643586592178771, + "velocity_total_t03": 0.6750581005586592, + "velocity_total_t05": 0.7055005586592178, + "velocity_total_t07": 0.7382346368715085, + "velocity_total_t09": 0.7908156424581005, + "velocity_total_t10": 0.7711206703910614 + }, + "recon-osscan": { + "_n": 371.0, + "arc_length": 0.910555795148248, + "causal_surprisal_flow": 0.3982528301886792, + "causal_surprisal_packet_max": 0.2755482479784367, + "causal_surprisal_packet_mean": 0.2802517520215634, + "causal_surprisal_packet_median": 0.3161789757412399, + "causal_surprisal_packet_trimmed10_mean": 0.27713692722371963, + "causal_surprisal_total": 0.39765336927223716, + "consistency_total": 0.8731746630727762, + "curvature_flow": 0.29316118598382745, + "curvature_packet": 0.7912469002695418, + "curvature_total": 0.6856312668463612, + "direction_drift_flow": 0.20932291105121292, + "direction_drift_packet_max": 0.3978797843665768, + "direction_drift_packet_mean": 0.33646765498652287, + "direction_drift_packet_median": 0.3400797843665768, + "direction_drift_packet_trimmed10_mean": 0.3448881401617251, + "direction_drift_total": 0.23797843665768192, + "flow_consistency": 0.8819714285714286, + "jacobian_flow": 0.39560754716981134, + "jacobian_packet": 0.7259121293800539, + "jacobian_total": 0.651521832884097, + "kappa2_speed2norm_packet_mean": 0.5822738544474393, + "kappa2_speed2norm_packet_median": 0.5935609164420484, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5930803234501347, + "kinetic_energy": 0.9103752021563343, + "kinetic_flow": 0.8300630727762803, + "kinetic_packet": 0.8989261455525608, + "packet_consistency": 0.8020835579514826, + "pna_flow": 0.12676172506738545, + "pna_packet_max": 0.5881477088948788, + "pna_packet_mean": 0.5822738544474393, + "pna_packet_median": 0.5935609164420484, + "pna_packet_trimmed10_mean": 0.5930803234501347, + "terminal_flow": 0.9264776280323451, + "terminal_norm": 0.9368415094339622, + "terminal_packet": 0.9250964959568732, + "velocity_flow": 0.7948830188679246, + "velocity_flow_t01": 0.6992134770889489, + "velocity_flow_t03": 0.759954716981132, + "velocity_flow_t05": 0.7753660377358491, + "velocity_flow_t07": 0.7864355795148248, + "velocity_flow_t09": 0.8188237196765499, + "velocity_flow_t10": 0.812222641509434, + "velocity_packet": 0.8251417789757411, + "velocity_packet_t01": 0.7650323450134772, + "velocity_packet_t03": 0.7770145552560647, + "velocity_packet_t05": 0.780789218328841, + "velocity_packet_t07": 0.8029142857142858, + "velocity_packet_t09": 0.8599498652291107, + "velocity_packet_t10": 0.8011552560646901, + "velocity_total": 0.8710350404312669, + "velocity_total_t01": 0.7627433962264151, + "velocity_total_t03": 0.7731778975741239, + "velocity_total_t05": 0.810677628032345, + "velocity_total_t07": 0.857011320754717, + "velocity_total_t09": 0.8951013477088949, + "velocity_total_t10": 0.8907272237196766 + }, + "recon-pingsweep": { + "_n": 6.0, + "arc_length": 0.9607999999999999, + "causal_surprisal_flow": 0.6642, + "causal_surprisal_packet_max": 0.7875000000000001, + "causal_surprisal_packet_mean": 0.6853, + "causal_surprisal_packet_median": 0.6482333333333333, + "causal_surprisal_packet_trimmed10_mean": 0.6455, + "causal_surprisal_total": 0.6306333333333333, + "consistency_total": 0.9236, + "curvature_flow": 0.7084999999999999, + "curvature_packet": 0.9809333333333333, + "curvature_total": 0.9793333333333333, + "direction_drift_flow": 0.19973333333333332, + "direction_drift_packet_max": 0.5949333333333333, + "direction_drift_packet_mean": 0.46906666666666663, + "direction_drift_packet_median": 0.4294, + "direction_drift_packet_trimmed10_mean": 0.4315, + "direction_drift_total": 0.428, + "flow_consistency": 0.8328666666666666, + "jacobian_flow": 0.18860000000000002, + "jacobian_packet": 0.4640666666666667, + "jacobian_total": 0.23246666666666663, + "kappa2_speed2norm_packet_mean": 0.7474000000000001, + "kappa2_speed2norm_packet_median": 0.6754, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7189333333333334, + "kinetic_energy": 0.9615333333333334, + "kinetic_flow": 0.9058999999999999, + "kinetic_packet": 0.9847666666666667, + "packet_consistency": 0.9177, + "pna_flow": 0.2111333333333333, + "pna_packet_max": 0.8229, + "pna_packet_mean": 0.7474000000000001, + "pna_packet_median": 0.6754, + "pna_packet_trimmed10_mean": 0.7189333333333334, + "terminal_flow": 0.8844666666666666, + "terminal_norm": 0.9177, + "terminal_packet": 0.9056, + "velocity_flow": 0.8779, + "velocity_flow_t01": 0.8460333333333334, + "velocity_flow_t03": 0.8500333333333334, + "velocity_flow_t05": 0.8609333333333333, + "velocity_flow_t07": 0.8624, + "velocity_flow_t09": 0.8816999999999999, + "velocity_flow_t10": 0.8806, + "velocity_packet": 0.9695999999999999, + "velocity_packet_t01": 0.9484333333333334, + "velocity_packet_t03": 0.9581666666666666, + "velocity_packet_t05": 0.9689666666666666, + "velocity_packet_t07": 0.9747999999999999, + "velocity_packet_t09": 0.8919333333333334, + "velocity_packet_t10": 0.9226, + "velocity_total": 0.9157333333333333, + "velocity_total_t01": 0.8957999999999999, + "velocity_total_t03": 0.8994333333333333, + "velocity_total_t05": 0.9188, + "velocity_total_t07": 0.9207000000000001, + "velocity_total_t09": 0.8779333333333335, + "velocity_total_t10": 0.9163666666666667 + }, + "recon-portscan": { + "_n": 397.0, + "arc_length": 0.8979108312342569, + "causal_surprisal_flow": 0.34415768261964735, + "causal_surprisal_packet_max": 0.27225894206549117, + "causal_surprisal_packet_mean": 0.295376322418136, + "causal_surprisal_packet_median": 0.32993551637279595, + "causal_surprisal_packet_trimmed10_mean": 0.2917884130982368, + "causal_surprisal_total": 0.3444549118387909, + "consistency_total": 0.8595921914357681, + "curvature_flow": 0.26176070528967255, + "curvature_packet": 0.756393450881612, + "curvature_total": 0.6200765743073048, + "direction_drift_flow": 0.21874357682619647, + "direction_drift_packet_max": 0.33177128463476074, + "direction_drift_packet_mean": 0.27868261964735513, + "direction_drift_packet_median": 0.288527959697733, + "direction_drift_packet_trimmed10_mean": 0.2860221662468514, + "direction_drift_total": 0.2065546599496222, + "flow_consistency": 0.8623370277078085, + "jacobian_flow": 0.4317420654911839, + "jacobian_packet": 0.7740977329974811, + "jacobian_total": 0.6939309823677582, + "kappa2_speed2norm_packet_mean": 0.5218700251889168, + "kappa2_speed2norm_packet_median": 0.5335037783375315, + "kappa2_speed2norm_packet_trimmed10_mean": 0.534039798488665, + "kinetic_energy": 0.8979974811083123, + "kinetic_flow": 0.817639798488665, + "kinetic_packet": 0.8941340050377834, + "packet_consistency": 0.8215869017632242, + "pna_flow": 0.14558186397984885, + "pna_packet_max": 0.5409037783375314, + "pna_packet_mean": 0.5218700251889168, + "pna_packet_median": 0.5335037783375315, + "pna_packet_trimmed10_mean": 0.534039798488665, + "terminal_flow": 0.9146342569269522, + "terminal_norm": 0.9191856423173802, + "terminal_packet": 0.9093209068010076, + "velocity_flow": 0.7876015113350128, + "velocity_flow_t01": 0.6831546599496221, + "velocity_flow_t03": 0.756095717884131, + "velocity_flow_t05": 0.7757198992443324, + "velocity_flow_t07": 0.7875939546599495, + "velocity_flow_t09": 0.8132649874055415, + "velocity_flow_t10": 0.7950133501259447, + "velocity_packet": 0.8357874055415617, + "velocity_packet_t01": 0.7819954659949622, + "velocity_packet_t03": 0.798992443324937, + "velocity_packet_t05": 0.8076921914357682, + "velocity_packet_t07": 0.8280272040302268, + "velocity_packet_t09": 0.8594362720403023, + "velocity_packet_t10": 0.8100191435768261, + "velocity_total": 0.8611007556675062, + "velocity_total_t01": 0.7671073047858942, + "velocity_total_t03": 0.7776649874055415, + "velocity_total_t05": 0.8163939546599496, + "velocity_total_t07": 0.8590594458438287, + "velocity_total_t09": 0.8844453400503779, + "velocity_total_t10": 0.871295717884131 + }, + "sqlinjection": { + "_n": 15.0, + "arc_length": 0.7147866666666667, + "causal_surprisal_flow": 0.4650266666666666, + "causal_surprisal_packet_max": 0.3556533333333333, + "causal_surprisal_packet_mean": 0.3511866666666667, + "causal_surprisal_packet_median": 0.39176, + "causal_surprisal_packet_trimmed10_mean": 0.3398133333333333, + "causal_surprisal_total": 0.4686, + "consistency_total": 0.70208, + "curvature_flow": 0.51556, + "curvature_packet": 0.5226533333333333, + "curvature_total": 0.52548, + "direction_drift_flow": 0.25625333333333333, + "direction_drift_packet_max": 0.34443999999999997, + "direction_drift_packet_mean": 0.33629333333333333, + "direction_drift_packet_median": 0.33730666666666664, + "direction_drift_packet_trimmed10_mean": 0.3420533333333333, + "direction_drift_total": 0.25964, + "flow_consistency": 0.7892399999999999, + "jacobian_flow": 0.4971333333333333, + "jacobian_packet": 0.44367999999999996, + "jacobian_total": 0.54704, + "kappa2_speed2norm_packet_mean": 0.4221733333333333, + "kappa2_speed2norm_packet_median": 0.4190266666666666, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4302933333333333, + "kinetic_energy": 0.71596, + "kinetic_flow": 0.7196266666666666, + "kinetic_packet": 0.6052533333333333, + "packet_consistency": 0.43346666666666667, + "pna_flow": 0.41252000000000005, + "pna_packet_max": 0.36702666666666667, + "pna_packet_mean": 0.4221733333333333, + "pna_packet_median": 0.4190266666666666, + "pna_packet_trimmed10_mean": 0.4302933333333333, + "terminal_flow": 0.7933600000000001, + "terminal_norm": 0.7497466666666667, + "terminal_packet": 0.67244, + "velocity_flow": 0.7297333333333333, + "velocity_flow_t01": 0.6835466666666666, + "velocity_flow_t03": 0.7106399999999999, + "velocity_flow_t05": 0.7099333333333333, + "velocity_flow_t07": 0.7008266666666667, + "velocity_flow_t09": 0.7257866666666666, + "velocity_flow_t10": 0.6540933333333332, + "velocity_packet": 0.57004, + "velocity_packet_t01": 0.43732000000000004, + "velocity_packet_t03": 0.4330666666666667, + "velocity_packet_t05": 0.4458533333333333, + "velocity_packet_t07": 0.47403999999999996, + "velocity_packet_t09": 0.596, + "velocity_packet_t10": 0.59492, + "velocity_total": 0.7263466666666667, + "velocity_total_t01": 0.6131866666666667, + "velocity_total_t03": 0.6246666666666667, + "velocity_total_t05": 0.63668, + "velocity_total_t07": 0.67308, + "velocity_total_t09": 0.7353066666666667, + "velocity_total_t10": 0.6757066666666667 + }, + "uploading_attack": { + "_n": 5.0, + "arc_length": 0.82148, + "causal_surprisal_flow": 0.40892, + "causal_surprisal_packet_max": 0.2592, + "causal_surprisal_packet_mean": 0.31724, + "causal_surprisal_packet_median": 0.41268, + "causal_surprisal_packet_trimmed10_mean": 0.33708, + "causal_surprisal_total": 0.42596, + "consistency_total": 0.71904, + "curvature_flow": 0.6914, + "curvature_packet": 0.62364, + "curvature_total": 0.6861600000000001, + "direction_drift_flow": 0.19616000000000003, + "direction_drift_packet_max": 0.23228000000000001, + "direction_drift_packet_mean": 0.32648, + "direction_drift_packet_median": 0.37307999999999997, + "direction_drift_packet_trimmed10_mean": 0.35304, + "direction_drift_total": 0.19580000000000003, + "flow_consistency": 0.79556, + "jacobian_flow": 0.26924000000000003, + "jacobian_packet": 0.5318400000000001, + "jacobian_total": 0.5176000000000001, + "kappa2_speed2norm_packet_mean": 0.46136, + "kappa2_speed2norm_packet_median": 0.46599999999999997, + "kappa2_speed2norm_packet_trimmed10_mean": 0.48036, + "kinetic_energy": 0.82064, + "kinetic_flow": 0.67044, + "kinetic_packet": 0.8318, + "packet_consistency": 0.43084, + "pna_flow": 0.44560000000000005, + "pna_packet_max": 0.37176000000000003, + "pna_packet_mean": 0.46136, + "pna_packet_median": 0.46599999999999997, + "pna_packet_trimmed10_mean": 0.48036, + "terminal_flow": 0.6917599999999999, + "terminal_norm": 0.80552, + "terminal_packet": 0.82296, + "velocity_flow": 0.6886, + "velocity_flow_t01": 0.667, + "velocity_flow_t03": 0.69456, + "velocity_flow_t05": 0.68956, + "velocity_flow_t07": 0.70356, + "velocity_flow_t09": 0.73172, + "velocity_flow_t10": 0.62676, + "velocity_packet": 0.55856, + "velocity_packet_t01": 0.5101600000000001, + "velocity_packet_t03": 0.51668, + "velocity_packet_t05": 0.52356, + "velocity_packet_t07": 0.4964, + "velocity_packet_t09": 0.5988800000000001, + "velocity_packet_t10": 0.63016, + "velocity_total": 0.7201200000000001, + "velocity_total_t01": 0.6420399999999999, + "velocity_total_t03": 0.67464, + "velocity_total_t05": 0.6876, + "velocity_total_t07": 0.7074400000000001, + "velocity_total_t09": 0.78532, + "velocity_total_t10": 0.7168 + }, + "vulnerabilityscan": { + "_n": 598.0, + "arc_length": 0.7937147157190636, + "causal_surprisal_flow": 0.4030759197324415, + "causal_surprisal_packet_max": 0.40048762541806016, + "causal_surprisal_packet_mean": 0.418828762541806, + "causal_surprisal_packet_median": 0.4639715719063545, + "causal_surprisal_packet_trimmed10_mean": 0.421, + "causal_surprisal_total": 0.4052541806020067, + "consistency_total": 0.7105914715719064, + "curvature_flow": 0.3647076923076923, + "curvature_packet": 0.6291170568561872, + "curvature_total": 0.5518264214046823, + "direction_drift_flow": 0.2880257525083612, + "direction_drift_packet_max": 0.3311297658862876, + "direction_drift_packet_mean": 0.30914665551839465, + "direction_drift_packet_median": 0.3112610367892976, + "direction_drift_packet_trimmed10_mean": 0.30821204013377923, + "direction_drift_total": 0.2789889632107023, + "flow_consistency": 0.7287973244147157, + "jacobian_flow": 0.4739740802675585, + "jacobian_packet": 0.5878715719063545, + "jacobian_total": 0.5821607023411373, + "kappa2_speed2norm_packet_mean": 0.45376321070234116, + "kappa2_speed2norm_packet_median": 0.46321137123745815, + "kappa2_speed2norm_packet_trimmed10_mean": 0.45980836120401336, + "kinetic_energy": 0.7939045150501672, + "kinetic_flow": 0.729575585284281, + "kinetic_packet": 0.7790210702341138, + "packet_consistency": 0.6301892976588629, + "pna_flow": 0.2486421404682274, + "pna_packet_max": 0.4551842809364548, + "pna_packet_mean": 0.45376321070234116, + "pna_packet_median": 0.46321137123745815, + "pna_packet_trimmed10_mean": 0.45980836120401336, + "terminal_flow": 0.7821662207357858, + "terminal_norm": 0.809360535117057, + "terminal_packet": 0.7959660535117057, + "velocity_flow": 0.6973224080267558, + "velocity_flow_t01": 0.5924160535117056, + "velocity_flow_t03": 0.6467416387959866, + "velocity_flow_t05": 0.6651916387959865, + "velocity_flow_t07": 0.6752224080267559, + "velocity_flow_t09": 0.7190966555183947, + "velocity_flow_t10": 0.7240036789297659, + "velocity_packet": 0.717811872909699, + "velocity_packet_t01": 0.6372311036789298, + "velocity_packet_t03": 0.6486498327759197, + "velocity_packet_t05": 0.6601635451505017, + "velocity_packet_t07": 0.6751458193979933, + "velocity_packet_t09": 0.7269284280936456, + "velocity_packet_t10": 0.7368916387959866, + "velocity_total": 0.7426137123745818, + "velocity_total_t01": 0.6436030100334449, + "velocity_total_t03": 0.6505207357859532, + "velocity_total_t05": 0.673184949832776, + "velocity_total_t07": 0.7143290969899666, + "velocity_total_t09": 0.7632244147157191, + "velocity_total_t10": 0.7633066889632107 + }, + "xss": { + "_n": 11.0, + "arc_length": 0.8542, + "causal_surprisal_flow": 0.5213636363636364, + "causal_surprisal_packet_max": 0.3961272727272728, + "causal_surprisal_packet_mean": 0.3180545454545455, + "causal_surprisal_packet_median": 0.34994545454545456, + "causal_surprisal_packet_trimmed10_mean": 0.28394545454545456, + "causal_surprisal_total": 0.5248545454545455, + "consistency_total": 0.717, + "curvature_flow": 0.5880181818181819, + "curvature_packet": 0.7358909090909092, + "curvature_total": 0.7393090909090909, + "direction_drift_flow": 0.19689090909090912, + "direction_drift_packet_max": 0.2298, + "direction_drift_packet_mean": 0.21463636363636363, + "direction_drift_packet_median": 0.2415090909090909, + "direction_drift_packet_trimmed10_mean": 0.23163636363636367, + "direction_drift_total": 0.1498, + "flow_consistency": 0.7370545454545454, + "jacobian_flow": 0.4328909090909091, + "jacobian_packet": 0.5336727272727273, + "jacobian_total": 0.5598363636363636, + "kappa2_speed2norm_packet_mean": 0.4898545454545455, + "kappa2_speed2norm_packet_median": 0.5306181818181818, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5108727272727273, + "kinetic_energy": 0.8527272727272727, + "kinetic_flow": 0.8048363636363636, + "kinetic_packet": 0.7376909090909091, + "packet_consistency": 0.5631999999999999, + "pna_flow": 0.3048363636363637, + "pna_packet_max": 0.46343636363636365, + "pna_packet_mean": 0.4898545454545455, + "pna_packet_median": 0.5306181818181818, + "pna_packet_trimmed10_mean": 0.5108727272727273, + "terminal_flow": 0.8643818181818181, + "terminal_norm": 0.8889454545454545, + "terminal_packet": 0.777090909090909, + "velocity_flow": 0.7942, + "velocity_flow_t01": 0.7368363636363635, + "velocity_flow_t03": 0.7681636363636364, + "velocity_flow_t05": 0.7759454545454545, + "velocity_flow_t07": 0.7899090909090908, + "velocity_flow_t09": 0.8156727272727273, + "velocity_flow_t10": 0.7900909090909091, + "velocity_packet": 0.6940545454545455, + "velocity_packet_t01": 0.6423818181818182, + "velocity_packet_t03": 0.6660545454545455, + "velocity_packet_t05": 0.6714909090909091, + "velocity_packet_t07": 0.6634727272727272, + "velocity_packet_t09": 0.7535636363636363, + "velocity_packet_t10": 0.6842181818181818, + "velocity_total": 0.7934181818181818, + "velocity_total_t01": 0.7342, + "velocity_total_t03": 0.7431090909090909, + "velocity_total_t05": 0.7518, + "velocity_total_t07": 0.7812181818181818, + "velocity_total_t09": 0.8638545454545454, + "velocity_total_t10": 0.7967454545454545 + } + }, + "classes": [ + "backdoor_malware", + "browserhijacking", + "commandinjection", + "ddos-ack_fragmentation", + "ddos-http_flood", + "ddos-icmp_flood", + "ddos-icmp_fragmentation", + "ddos-pshack_flood", + "ddos-rstfinflood", + "ddos-slowloris", + "ddos-syn_flood", + "ddos-synonymousip_flood", + "ddos-tcp_flood", + "ddos-udp_flood", + "ddos-udp_fragmentation", + "dictionarybruteforce", + "dns_spoofing", + "dos-http_flood", + "dos-syn_flood", + "dos-tcp_flood", + "dos-udp_flood", + "mirai-greeth_flood", + "mirai-greip_flood", + "mirai-udpplain", + "mitm-arpspoofing", + "recon-hostdiscovery", + "recon-osscan", + "recon-pingsweep", + "recon-portscan", + "sqlinjection", + "uploading_attack", + "vulnerabilityscan", + "xss" + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/baseline_seed42_to_cicddos2019.json b/artifacts/route_comparison/cross/baseline_seed42_to_cicddos2019.json new file mode 100644 index 0000000..d72fd6e --- /dev/null +++ b/artifacts/route_comparison/cross/baseline_seed42_to_cicddos2019.json @@ -0,0 +1,818 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.8890601665651027, + "auprc": 0.9017847164124985 + }, + "causal_surprisal_flow": { + "auroc": 0.3219862939264676, + "auprc": 0.37763207216855643 + }, + "causal_surprisal_packet_max": { + "auroc": 0.17894871013609587, + "auprc": 0.3340006531934666 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.15079507414178345, + "auprc": 0.32924997124174993 + }, + "causal_surprisal_packet_median": { + "auroc": 0.1479359790777981, + "auprc": 0.32865036222566935 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.14805533211456431, + "auprc": 0.3297370548131222 + }, + "causal_surprisal_total": { + "auroc": 0.31574723745683525, + "auprc": 0.3764340321963523 + }, + "consistency_total": { + "auroc": 0.7507356337599024, + "auprc": 0.6532375350919759 + }, + "curvature_flow": { + "auroc": 0.40174964452569567, + "auprc": 0.4269097400962829 + }, + "curvature_packet": { + "auroc": 0.7347348110907983, + "auprc": 0.7194359456742736 + }, + "curvature_total": { + "auroc": 0.593133460288442, + "auprc": 0.5665689721858671 + }, + "direction_drift_flow": { + "auroc": 0.3731876853544587, + "auprc": 0.39665248198322745 + }, + "direction_drift_packet_max": { + "auroc": 0.3157683830997359, + "auprc": 0.3743300924155997 + }, + "direction_drift_packet_mean": { + "auroc": 0.37595207698557787, + "auprc": 0.40532536615556336 + }, + "direction_drift_packet_median": { + "auroc": 0.3915179565305708, + "auprc": 0.41457912615620535 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.38584157525898843, + "auprc": 0.4087646083371921 + }, + "direction_drift_total": { + "auroc": 0.269911679869998, + "auprc": 0.36022518176290813 + }, + "flow_consistency": { + "auroc": 0.7495988218565915, + "auprc": 0.6678251995026067 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.3491473542555353, + "auprc": 0.40099055151807905 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.3563453128173878, + "auprc": 0.4028044227912733 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.3536138990452976, + "auprc": 0.3998197491040796 + }, + "kinetic_energy": { + "auroc": 0.8890195003046923, + "auprc": 0.9017888272326648 + }, + "kinetic_flow": { + "auroc": 0.7843267926061344, + "auprc": 0.6707790060227417 + }, + "kinetic_packet": { + "auroc": 0.8103417225269145, + "auprc": 0.8001317454564407 + }, + "packet_consistency": { + "auroc": 0.5888639752183629, + "auprc": 0.5486694656700807 + }, + "pna_flow": { + "auroc": 0.21613931037984968, + "auprc": 0.3435203255067082 + }, + "pna_packet_max": { + "auroc": 0.3016611872841763, + "auprc": 0.4084051245765058 + }, + "pna_packet_mean": { + "auroc": 0.3491473542555353, + "auprc": 0.40099055151807905 + }, + "pna_packet_median": { + "auroc": 0.3563453128173878, + "auprc": 0.4028044227912733 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.3536138990452976, + "auprc": 0.3998197491040796 + }, + "terminal_flow": { + "auroc": 0.6995101970343287, + "auprc": 0.6324961166719927 + }, + "terminal_norm": { + "auroc": 0.7528441854560227, + "auprc": 0.6954518317268139 + }, + "terminal_packet": { + "auroc": 0.665489036156815, + "auprc": 0.6561837632831677 + }, + "velocity_flow": { + "auroc": 0.7306168799512494, + "auprc": 0.6134602809590071 + }, + "velocity_packet": { + "auroc": 0.7950585669307332, + "auprc": 0.7369936660437894 + }, + "velocity_total": { + "auroc": 0.9077879138736544, + "auprc": 0.9170927191553628 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "arc_length": 0.9963336734693877, + "causal_surprisal_flow": 0.30014421768707483, + "causal_surprisal_packet_max": 0.10373214285714286, + "causal_surprisal_packet_mean": 0.10564013605442177, + "causal_surprisal_packet_median": 0.1104484693877551, + "causal_surprisal_packet_trimmed10_mean": 0.10612908163265307, + "causal_surprisal_total": 0.3298108843537415, + "consistency_total": 0.77175306122449, + "curvature_flow": 0.12886921768707485, + "curvature_packet": 0.8919805272108844, + "curvature_total": 0.453463350340136, + "direction_drift_flow": 0.4248401360544218, + "direction_drift_packet_max": 0.1845137755102041, + "direction_drift_packet_mean": 0.1920424319727891, + "direction_drift_packet_median": 0.21855306122448984, + "direction_drift_packet_trimmed10_mean": 0.21825552721088431, + "direction_drift_total": 0.11615816326530612, + "flow_consistency": 0.7627923469387755, + "kappa2_speed2norm_packet_mean": 0.13678494897959184, + "kappa2_speed2norm_packet_median": 0.1613121598639456, + "kappa2_speed2norm_packet_trimmed10_mean": 0.15525833333333333, + "kinetic_energy": 0.9963897959183674, + "kinetic_flow": 0.8733517857142856, + "kinetic_packet": 0.9719326530612244, + "packet_consistency": 0.8506357142857143, + "pna_flow": 0.09477840136054422, + "pna_packet_max": 0.1094781462585034, + "pna_packet_mean": 0.13678494897959184, + "pna_packet_median": 0.1613121598639456, + "pna_packet_trimmed10_mean": 0.15525833333333333, + "terminal_flow": 0.8859746598639455, + "terminal_norm": 0.9379482993197279, + "terminal_packet": 0.912025850340136, + "velocity_flow": 0.6531449829931972, + "velocity_packet": 0.9551515306122449, + "velocity_total": 0.9977083333333334 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "arc_length": 0.9979200680272109, + "causal_surprisal_flow": 0.3017612244897959, + "causal_surprisal_packet_max": 0.11253724489795919, + "causal_surprisal_packet_mean": 0.11507244897959183, + "causal_surprisal_packet_median": 0.12033826530612245, + "causal_surprisal_packet_trimmed10_mean": 0.11544778911564627, + "causal_surprisal_total": 0.3317930272108844, + "consistency_total": 0.7671680272108844, + "curvature_flow": 0.11521768707482993, + "curvature_packet": 0.901950255102041, + "curvature_total": 0.45897219387755106, + "direction_drift_flow": 0.43403852040816326, + "direction_drift_packet_max": 0.1679816326530612, + "direction_drift_packet_mean": 0.1676610544217687, + "direction_drift_packet_median": 0.19452091836734697, + "direction_drift_packet_trimmed10_mean": 0.19463554421768708, + "direction_drift_total": 0.101725, + "flow_consistency": 0.7578335034013606, + "kappa2_speed2norm_packet_mean": 0.11257891156462585, + "kappa2_speed2norm_packet_median": 0.13769923469387757, + "kappa2_speed2norm_packet_trimmed10_mean": 0.13165765306122448, + "kinetic_energy": 0.9979833333333334, + "kinetic_flow": 0.8771879251700682, + "kinetic_packet": 0.9830460034013606, + "packet_consistency": 0.8788382653061225, + "pna_flow": 0.0906704081632653, + "pna_packet_max": 0.09400034013605443, + "pna_packet_mean": 0.11257891156462585, + "pna_packet_median": 0.13769923469387757, + "pna_packet_trimmed10_mean": 0.13165765306122448, + "terminal_flow": 0.8974350340136055, + "terminal_norm": 0.9458583333333334, + "terminal_packet": 0.9313938775510203, + "velocity_flow": 0.6288767006802722, + "velocity_packet": 0.9719384353741497, + "velocity_total": 0.9982874149659863 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "arc_length": 0.9850712585034013, + "causal_surprisal_flow": 0.29628809523809524, + "causal_surprisal_packet_max": 0.0727874149659864, + "causal_surprisal_packet_mean": 0.06680289115646258, + "causal_surprisal_packet_median": 0.06900578231292517, + "causal_surprisal_packet_trimmed10_mean": 0.06699982993197279, + "causal_surprisal_total": 0.32491479591836736, + "consistency_total": 0.8440784013605442, + "curvature_flow": 0.16663299319727892, + "curvature_packet": 0.8489680272108844, + "curvature_total": 0.45526717687074836, + "direction_drift_flow": 0.3857336734693878, + "direction_drift_packet_max": 0.32191862244897956, + "direction_drift_packet_mean": 0.4157772959183673, + "direction_drift_packet_median": 0.43566045918367347, + "direction_drift_packet_trimmed10_mean": 0.4349401360544218, + "direction_drift_total": 0.24582023809523812, + "flow_consistency": 0.8594891156462584, + "kappa2_speed2norm_packet_mean": 0.3972444727891157, + "kappa2_speed2norm_packet_median": 0.4252666666666667, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4181272959183674, + "kinetic_energy": 0.9850003401360544, + "kinetic_flow": 0.8796583333333332, + "kinetic_packet": 0.8803239795918366, + "packet_consistency": 0.5601412414965986, + "pna_flow": 0.10244846938775512, + "pna_packet_max": 0.25552763605442175, + "pna_packet_mean": 0.3972444727891157, + "pna_packet_median": 0.4252666666666667, + "pna_packet_trimmed10_mean": 0.4181272959183674, + "terminal_flow": 0.7882183673469388, + "terminal_norm": 0.876426530612245, + "terminal_packet": 0.6954278911564626, + "velocity_flow": 0.8445627551020408, + "velocity_packet": 0.7871329931972788, + "velocity_total": 0.9908180272108843 + }, + "DrDoS_NTP": { + "_n": 588.0, + "arc_length": 0.6853139455782313, + "causal_surprisal_flow": 0.7427698979591836, + "causal_surprisal_packet_max": 0.6032889455782312, + "causal_surprisal_packet_mean": 0.2995517006802721, + "causal_surprisal_packet_median": 0.25700765306122453, + "causal_surprisal_packet_trimmed10_mean": 0.2620765306122449, + "causal_surprisal_total": 0.3455787414965987, + "consistency_total": 0.8205998299319728, + "curvature_flow": 0.656852380952381, + "curvature_packet": 0.9618324829931972, + "curvature_total": 0.9454418367346937, + "direction_drift_flow": 0.3157363095238096, + "direction_drift_packet_max": 0.5267705782312925, + "direction_drift_packet_mean": 0.29442857142857143, + "direction_drift_packet_median": 0.276227380952381, + "direction_drift_packet_trimmed10_mean": 0.28518069727891154, + "direction_drift_total": 0.42961275510204083, + "flow_consistency": 0.8139645408163267, + "kappa2_speed2norm_packet_mean": 0.6743351190476191, + "kappa2_speed2norm_packet_median": 0.63164268707483, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6279262755102041, + "kinetic_energy": 0.6877174319727891, + "kinetic_flow": 0.8967880952380953, + "kinetic_packet": 0.8770610544217686, + "packet_consistency": 0.8432241496598639, + "pna_flow": 0.16770671768707482, + "pna_packet_max": 0.8545575680272108, + "pna_packet_mean": 0.6743351190476191, + "pna_packet_median": 0.63164268707483, + "pna_packet_trimmed10_mean": 0.6279262755102041, + "terminal_flow": 0.8308443877551022, + "terminal_norm": 0.6138165816326531, + "terminal_packet": 0.6256013605442177, + "velocity_flow": 0.8937921768707484, + "velocity_packet": 0.9267248299319727, + "velocity_total": 0.6380864795918367 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "arc_length": 0.9445195578231292, + "causal_surprisal_flow": 0.2669464285714286, + "causal_surprisal_packet_max": 0.05089149659863945, + "causal_surprisal_packet_mean": 0.04668027210884354, + "causal_surprisal_packet_median": 0.04745289115646259, + "causal_surprisal_packet_trimmed10_mean": 0.0467093537414966, + "causal_surprisal_total": 0.2822605442176871, + "consistency_total": 0.9171767006802722, + "curvature_flow": 0.6917134353741498, + "curvature_packet": 0.7035130952380952, + "curvature_total": 0.7869515306122448, + "direction_drift_flow": 0.3162880102040816, + "direction_drift_packet_max": 0.43006360544217687, + "direction_drift_packet_mean": 0.7010837585034014, + "direction_drift_packet_median": 0.7266940476190477, + "direction_drift_packet_trimmed10_mean": 0.7068798469387755, + "direction_drift_total": 0.4343676870748299, + "flow_consistency": 0.9371144557823129, + "kappa2_speed2norm_packet_mean": 0.48542959183673473, + "kappa2_speed2norm_packet_median": 0.5105429421768707, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5028472789115647, + "kinetic_energy": 0.9443914965986395, + "kinetic_flow": 0.8444292517006803, + "kinetic_packet": 0.6999849489795917, + "packet_consistency": 0.17919880952380954, + "pna_flow": 0.27231037414965986, + "pna_packet_max": 0.2501575680272109, + "pna_packet_mean": 0.48542959183673473, + "pna_packet_median": 0.5105429421768707, + "pna_packet_trimmed10_mean": 0.5028472789115647, + "terminal_flow": 0.6161267006802721, + "terminal_norm": 0.7068884353741496, + "terminal_packet": 0.4661265306122449, + "velocity_flow": 0.8576571428571429, + "velocity_packet": 0.6354083333333334, + "velocity_total": 0.9901437074829933 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "arc_length": 0.997280612244898, + "causal_surprisal_flow": 0.3005020408163266, + "causal_surprisal_packet_max": 0.1076265306122449, + "causal_surprisal_packet_mean": 0.10947704081632653, + "causal_surprisal_packet_median": 0.1145860544217687, + "causal_surprisal_packet_trimmed10_mean": 0.11001122448979592, + "causal_surprisal_total": 0.329733843537415, + "consistency_total": 0.7749031462585034, + "curvature_flow": 0.14367125850340134, + "curvature_packet": 0.8904620748299321, + "curvature_total": 0.4647443027210884, + "direction_drift_flow": 0.4308619047619048, + "direction_drift_packet_max": 0.169690306122449, + "direction_drift_packet_mean": 0.1825437925170068, + "direction_drift_packet_median": 0.20970722789115645, + "direction_drift_packet_trimmed10_mean": 0.20877857142857142, + "direction_drift_total": 0.11106028911564625, + "flow_consistency": 0.7692535714285713, + "kappa2_speed2norm_packet_mean": 0.12097474489795919, + "kappa2_speed2norm_packet_median": 0.1465654761904762, + "kappa2_speed2norm_packet_trimmed10_mean": 0.14026301020408163, + "kinetic_energy": 0.99730731292517, + "kinetic_flow": 0.8814960884353741, + "kinetic_packet": 0.9718598639455782, + "packet_consistency": 0.8458901360544219, + "pna_flow": 0.10028197278911564, + "pna_packet_max": 0.0993658163265306, + "pna_packet_mean": 0.12097474489795919, + "pna_packet_median": 0.1465654761904762, + "pna_packet_trimmed10_mean": 0.14026301020408163, + "terminal_flow": 0.8809646258503402, + "terminal_norm": 0.9307258503401359, + "terminal_packet": 0.904062925170068, + "velocity_flow": 0.6358573979591837, + "velocity_packet": 0.9588734693877551, + "velocity_total": 0.9992482993197279 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "arc_length": 0.7436115646258503, + "causal_surprisal_flow": 0.319753231292517, + "causal_surprisal_packet_max": 0.17073180272108845, + "causal_surprisal_packet_mean": 0.15474795918367346, + "causal_surprisal_packet_median": 0.15876105442176872, + "causal_surprisal_packet_trimmed10_mean": 0.15127261904761904, + "causal_surprisal_total": 0.3327984693877551, + "consistency_total": 0.546865306122449, + "curvature_flow": 0.41472227891156466, + "curvature_packet": 0.6473445578231294, + "curvature_total": 0.5106110544217687, + "direction_drift_flow": 0.3591196428571429, + "direction_drift_packet_max": 0.37151369047619043, + "direction_drift_packet_mean": 0.42458333333333326, + "direction_drift_packet_median": 0.4384836734693877, + "direction_drift_packet_trimmed10_mean": 0.41829515306122445, + "direction_drift_total": 0.3316816326530612, + "flow_consistency": 0.526381462585034, + "kappa2_speed2norm_packet_mean": 0.4309107142857143, + "kappa2_speed2norm_packet_median": 0.4326215986394558, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4068644557823129, + "kinetic_energy": 0.7427234693877551, + "kinetic_flow": 0.6870583333333333, + "kinetic_packet": 0.6424797619047619, + "packet_consistency": 0.4535643707482994, + "pna_flow": 0.3185873299319728, + "pna_packet_max": 0.40639311224489794, + "pna_packet_mean": 0.4309107142857143, + "pna_packet_median": 0.4326215986394558, + "pna_packet_trimmed10_mean": 0.4068644557823129, + "terminal_flow": 0.39990986394557826, + "terminal_norm": 0.46308001700680274, + "terminal_packet": 0.3960660714285714, + "velocity_flow": 0.7177452380952379, + "velocity_packet": 0.7702564625850341, + "velocity_total": 0.8310155612244898 + }, + "DrDoS_UDP": { + "_n": 588.0, + "arc_length": 0.7448772108843538, + "causal_surprisal_flow": 0.3199311224489796, + "causal_surprisal_packet_max": 0.1714062925170068, + "causal_surprisal_packet_mean": 0.15513826530612246, + "causal_surprisal_packet_median": 0.16559319727891156, + "causal_surprisal_packet_trimmed10_mean": 0.1544872448979592, + "causal_surprisal_total": 0.3348564625850341, + "consistency_total": 0.5537301020408163, + "curvature_flow": 0.43706870748299315, + "curvature_packet": 0.6250278911564626, + "curvature_total": 0.5029998299319728, + "direction_drift_flow": 0.3531664115646258, + "direction_drift_packet_max": 0.3621924319727891, + "direction_drift_packet_mean": 0.4326807823129252, + "direction_drift_packet_median": 0.45411062925170076, + "direction_drift_packet_trimmed10_mean": 0.4337772108843537, + "direction_drift_total": 0.33184600340136056, + "flow_consistency": 0.5299042517006802, + "kappa2_speed2norm_packet_mean": 0.42475416666666665, + "kappa2_speed2norm_packet_median": 0.4351431972789116, + "kappa2_speed2norm_packet_trimmed10_mean": 0.41489549319727886, + "kinetic_energy": 0.7440443027210883, + "kinetic_flow": 0.6842073129251701, + "kinetic_packet": 0.6325057823129252, + "packet_consistency": 0.45187823129251703, + "pna_flow": 0.3306721088435374, + "pna_packet_max": 0.39503750000000004, + "pna_packet_mean": 0.42475416666666665, + "pna_packet_median": 0.4351431972789116, + "pna_packet_trimmed10_mean": 0.41489549319727886, + "terminal_flow": 0.38882976190476193, + "terminal_norm": 0.45797049319727895, + "terminal_packet": 0.39245297619047614, + "velocity_flow": 0.7201287414965987, + "velocity_packet": 0.7625326530612246, + "velocity_total": 0.8310806122448978 + }, + "LDAP": { + "_n": 588.0, + "arc_length": 0.998525, + "causal_surprisal_flow": 0.3008831632653062, + "causal_surprisal_packet_max": 0.1093828231292517, + "causal_surprisal_packet_mean": 0.11022755102040815, + "causal_surprisal_packet_median": 0.11531513605442176, + "causal_surprisal_packet_trimmed10_mean": 0.11085306122448979, + "causal_surprisal_total": 0.33067278911564624, + "consistency_total": 0.7716651360544218, + "curvature_flow": 0.11648078231292518, + "curvature_packet": 0.9082093537414966, + "curvature_total": 0.4671304421768708, + "direction_drift_flow": 0.4442260204081633, + "direction_drift_packet_max": 0.16097993197278912, + "direction_drift_packet_mean": 0.1607981292517007, + "direction_drift_packet_median": 0.18767891156462585, + "direction_drift_packet_trimmed10_mean": 0.18776649659863948, + "direction_drift_total": 0.09826190476190476, + "flow_consistency": 0.7643526360544217, + "kappa2_speed2norm_packet_mean": 0.10334081632653061, + "kappa2_speed2norm_packet_median": 0.12702865646258504, + "kappa2_speed2norm_packet_trimmed10_mean": 0.12163095238095237, + "kinetic_energy": 0.9985806122448979, + "kinetic_flow": 0.8762062925170068, + "kinetic_packet": 0.9855585034013605, + "packet_consistency": 0.880883163265306, + "pna_flow": 0.09153486394557822, + "pna_packet_max": 0.09148154761904762, + "pna_packet_mean": 0.10334081632653061, + "pna_packet_median": 0.12702865646258504, + "pna_packet_trimmed10_mean": 0.12163095238095237, + "terminal_flow": 0.899618707482993, + "terminal_norm": 0.9488685374149659, + "terminal_packet": 0.9336215986394557, + "velocity_flow": 0.6089571428571429, + "velocity_packet": 0.9730493197278912, + "velocity_total": 0.9982581632653061 + }, + "MSSQL": { + "_n": 588.0, + "arc_length": 0.9825062925170068, + "causal_surprisal_flow": 0.2969887755102041, + "causal_surprisal_packet_max": 0.07103418367346939, + "causal_surprisal_packet_mean": 0.06526989795918368, + "causal_surprisal_packet_median": 0.06709744897959184, + "causal_surprisal_packet_trimmed10_mean": 0.06542125850340137, + "causal_surprisal_total": 0.32629336734693876, + "consistency_total": 0.8457214285714285, + "curvature_flow": 0.18420340136054422, + "curvature_packet": 0.8346710034013606, + "curvature_total": 0.45258146258503396, + "direction_drift_flow": 0.3705319727891157, + "direction_drift_packet_max": 0.33876768707482996, + "direction_drift_packet_mean": 0.43425374149659857, + "direction_drift_packet_median": 0.4544852040816326, + "direction_drift_packet_trimmed10_mean": 0.45267312925170067, + "direction_drift_total": 0.25876437074829933, + "flow_consistency": 0.8614144557823129, + "kappa2_speed2norm_packet_mean": 0.40880263605442174, + "kappa2_speed2norm_packet_median": 0.43637942176870753, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4292987244897959, + "kinetic_energy": 0.9824243197278911, + "kinetic_flow": 0.8782724489795918, + "kinetic_packet": 0.8703947278911566, + "packet_consistency": 0.5449455782312925, + "pna_flow": 0.10642704081632653, + "pna_packet_max": 0.2547578231292517, + "pna_packet_mean": 0.40880263605442174, + "pna_packet_median": 0.43637942176870753, + "pna_packet_trimmed10_mean": 0.4292987244897959, + "terminal_flow": 0.7777346088435374, + "terminal_norm": 0.8711215986394558, + "terminal_packet": 0.6864682823129251, + "velocity_flow": 0.8443641156462585, + "velocity_packet": 0.7756755102040817, + "velocity_total": 0.9892350340136054 + }, + "NetBIOS": { + "_n": 588.0, + "arc_length": 0.927215306122449, + "causal_surprisal_flow": 0.2712037414965986, + "causal_surprisal_packet_max": 0.05173792517006803, + "causal_surprisal_packet_mean": 0.04737755102040817, + "causal_surprisal_packet_median": 0.04819812925170069, + "causal_surprisal_packet_trimmed10_mean": 0.047412074829931976, + "causal_surprisal_total": 0.28958690476190474, + "consistency_total": 0.9171884353741497, + "curvature_flow": 0.6814571428571428, + "curvature_packet": 0.6590122448979592, + "curvature_total": 0.7551890306122448, + "direction_drift_flow": 0.3030147108843537, + "direction_drift_packet_max": 0.43876904761904767, + "direction_drift_packet_mean": 0.7066080782312925, + "direction_drift_packet_median": 0.7319131802721088, + "direction_drift_packet_trimmed10_mean": 0.7123283163265306, + "direction_drift_total": 0.4380534013605442, + "flow_consistency": 0.9358863945578231, + "kappa2_speed2norm_packet_mean": 0.48915416666666667, + "kappa2_speed2norm_packet_median": 0.5145280612244898, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5064056972789116, + "kinetic_energy": 0.9272559523809523, + "kinetic_flow": 0.8184608843537415, + "kinetic_packet": 0.6735683673469387, + "packet_consistency": 0.18752721088435376, + "pna_flow": 0.2846644557823129, + "pna_packet_max": 0.24648988095238097, + "pna_packet_mean": 0.48915416666666667, + "pna_packet_median": 0.5145280612244898, + "pna_packet_trimmed10_mean": 0.5064056972789116, + "terminal_flow": 0.6112491496598639, + "terminal_norm": 0.699130612244898, + "terminal_packet": 0.4560522959183674, + "velocity_flow": 0.8485309523809524, + "velocity_packet": 0.6089442176870749, + "velocity_total": 0.982802380952381 + }, + "Portmap": { + "_n": 588.0, + "arc_length": 0.9396957482993197, + "causal_surprisal_flow": 0.26856377551020405, + "causal_surprisal_packet_max": 0.05251122448979592, + "causal_surprisal_packet_mean": 0.048256122448979595, + "causal_surprisal_packet_median": 0.04815612244897959, + "causal_surprisal_packet_trimmed10_mean": 0.04851649659863946, + "causal_surprisal_total": 0.28577653061224495, + "consistency_total": 0.9162181972789115, + "curvature_flow": 0.6697530612244899, + "curvature_packet": 0.6960394557823129, + "curvature_total": 0.7575525510204083, + "direction_drift_flow": 0.32758171768707484, + "direction_drift_packet_max": 0.4268697278911565, + "direction_drift_packet_mean": 0.7005583333333333, + "direction_drift_packet_median": 0.7258733843537416, + "direction_drift_packet_trimmed10_mean": 0.7064095238095238, + "direction_drift_total": 0.43540221088435377, + "flow_consistency": 0.9356530612244898, + "kappa2_speed2norm_packet_mean": 0.49148707482993187, + "kappa2_speed2norm_packet_median": 0.515918537414966, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5084480442176871, + "kinetic_energy": 0.9395102040816325, + "kinetic_flow": 0.837524149659864, + "kinetic_packet": 0.6929203231292517, + "packet_consistency": 0.19104277210884354, + "pna_flow": 0.2601034013605442, + "pna_packet_max": 0.26080229591836734, + "pna_packet_mean": 0.49148707482993187, + "pna_packet_median": 0.515918537414966, + "pna_packet_trimmed10_mean": 0.5084480442176871, + "terminal_flow": 0.6301115646258504, + "terminal_norm": 0.7150375850340136, + "terminal_packet": 0.4695926020408163, + "velocity_flow": 0.8468358843537416, + "velocity_packet": 0.6187994897959184, + "velocity_total": 0.9815408163265306 + }, + "Syn": { + "_n": 588.0, + "arc_length": 0.9358270408163265, + "causal_surprisal_flow": 0.2606306122448979, + "causal_surprisal_packet_max": 0.3259681972789116, + "causal_surprisal_packet_mean": 0.2800158163265306, + "causal_surprisal_packet_median": 0.24710799319727889, + "causal_surprisal_packet_trimmed10_mean": 0.2813270408163266, + "causal_surprisal_total": 0.2705289115646259, + "consistency_total": 0.7937899659863945, + "curvature_flow": 0.6305418367346939, + "curvature_packet": 0.4409897108843538, + "curvature_total": 0.6736895408163266, + "direction_drift_flow": 0.4156739795918367, + "direction_drift_packet_max": 0.10597074829931973, + "direction_drift_packet_mean": 0.07920595238095239, + "direction_drift_packet_median": 0.0660484693877551, + "direction_drift_packet_trimmed10_mean": 0.09272772108843538, + "direction_drift_total": 0.07481785714285714, + "flow_consistency": 0.7904056122448978, + "kappa2_speed2norm_packet_mean": 0.10661309523809523, + "kappa2_speed2norm_packet_median": 0.029495408163265308, + "kappa2_speed2norm_packet_trimmed10_mean": 0.11317891156462585, + "kinetic_energy": 0.9368556122448979, + "kinetic_flow": 0.5854022108843537, + "kinetic_packet": 0.9729284013605441, + "packet_consistency": 0.8295010204081632, + "pna_flow": 0.34406139455782314, + "pna_packet_max": 0.2887418367346939, + "pna_packet_mean": 0.10661309523809523, + "pna_packet_median": 0.029495408163265308, + "pna_packet_trimmed10_mean": 0.11317891156462585, + "terminal_flow": 0.8797192176870748, + "terminal_norm": 0.9303887755102039, + "terminal_packet": 0.9643391156462584, + "velocity_flow": 0.5739841836734694, + "velocity_packet": 0.8365346088435374, + "velocity_total": 0.8616037414965986 + }, + "TFTP": { + "_n": 588.0, + "arc_length": 0.8313353741496599, + "causal_surprisal_flow": 0.2911358843537415, + "causal_surprisal_packet_max": 0.22707397959183673, + "causal_surprisal_packet_mean": 0.17344489795918366, + "causal_surprisal_packet_median": 0.18318792517006804, + "causal_surprisal_packet_trimmed10_mean": 0.17806564625850338, + "causal_surprisal_total": 0.29929064625850343, + "consistency_total": 0.6471134353741497, + "curvature_flow": 0.16585340136054422, + "curvature_packet": 0.8682761904761905, + "curvature_total": 0.6051887755102041, + "direction_drift_flow": 0.41199574829931973, + "direction_drift_packet_max": 0.40492287414965983, + "direction_drift_packet_mean": 0.4978687074829933, + "direction_drift_packet_median": 0.5096576530612245, + "direction_drift_packet_trimmed10_mean": 0.5039537414965987, + "direction_drift_total": 0.40214948979591836, + "flow_consistency": 0.6474093537414966, + "kappa2_speed2norm_packet_mean": 0.4603664115646259, + "kappa2_speed2norm_packet_median": 0.4815430272108844, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4635876700680272, + "kinetic_energy": 0.8300083333333333, + "kinetic_flow": 0.7316724489795918, + "kinetic_packet": 0.8317255952380953, + "packet_consistency": 0.5809788265306122, + "pna_flow": 0.11277610544217688, + "pna_packet_max": 0.4137335034013605, + "pna_packet_mean": 0.4603664115646259, + "pna_packet_median": 0.4815430272108844, + "pna_packet_trimmed10_mean": 0.4635876700680272, + "terminal_flow": 0.7676875850340136, + "terminal_norm": 0.8260487244897959, + "terminal_packet": 0.6509920918367347, + "velocity_flow": 0.6977440476190474, + "velocity_packet": 0.8148435374149661, + "velocity_total": 0.8433348639455782 + }, + "UDP": { + "_n": 588.0, + "arc_length": 0.7248636054421769, + "causal_surprisal_flow": 0.32063835034013605, + "causal_surprisal_packet_max": 0.17509829931972792, + "causal_surprisal_packet_mean": 0.15936326530612244, + "causal_surprisal_packet_median": 0.1687033163265306, + "causal_surprisal_packet_trimmed10_mean": 0.15873452380952383, + "causal_surprisal_total": 0.33679727891156463, + "consistency_total": 0.5257925170068027, + "curvature_flow": 0.45594761904761905, + "curvature_packet": 0.6030704081632654, + "curvature_total": 0.5016335884353742, + "direction_drift_flow": 0.3499520408163266, + "direction_drift_packet_max": 0.3745183673469388, + "direction_drift_packet_mean": 0.4376511904761905, + "direction_drift_packet_median": 0.4551623299319728, + "direction_drift_packet_trimmed10_mean": 0.43550255102040814, + "direction_drift_total": 0.34098562925170073, + "flow_consistency": 0.5008061224489795, + "kappa2_speed2norm_packet_mean": 0.4445410714285714, + "kappa2_speed2norm_packet_median": 0.4482734693877551, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4277125850340136, + "kinetic_energy": 0.7239107142857143, + "kinetic_flow": 0.6665450680272108, + "kinetic_packet": 0.6151187925170067, + "packet_consistency": 0.4562069727891157, + "pna_flow": 0.34498622448979593, + "pna_packet_max": 0.4037355442176871, + "pna_packet_mean": 0.4445410714285714, + "pna_packet_median": 0.4482734693877551, + "pna_packet_trimmed10_mean": 0.4277125850340136, + "terminal_flow": 0.36644472789115645, + "terminal_norm": 0.43244744897959186, + "terminal_packet": 0.38226522108843536, + "velocity_flow": 0.706290731292517, + "velocity_packet": 0.7548442176870747, + "velocity_total": 0.8179841836734696 + }, + "UDPLag": { + "_n": 588.0, + "arc_length": 0.9108332482993197, + "causal_surprisal_flow": 0.26542653061224486, + "causal_surprisal_packet_max": 0.3019875850340136, + "causal_surprisal_packet_mean": 0.29038554421768703, + "causal_surprisal_packet_median": 0.2668090136054422, + "causal_surprisal_packet_trimmed10_mean": 0.28472329931972784, + "causal_surprisal_total": 0.28254931972789116, + "consistency_total": 0.7695321428571429, + "curvature_flow": 0.5654299319727891, + "curvature_packet": 0.38653911564625854, + "curvature_total": 0.5761210034013605, + "direction_drift_flow": 0.41371062925170066, + "direction_drift_packet_max": 0.09921122448979591, + "direction_drift_packet_mean": 0.09855714285714287, + "direction_drift_packet_median": 0.10302551020408164, + "direction_drift_packet_trimmed10_mean": 0.10888129251700682, + "direction_drift_total": 0.08665901360544218, + "flow_consistency": 0.7648959183673469, + "kappa2_speed2norm_packet_mean": 0.10345867346938775, + "kappa2_speed2norm_packet_median": 0.07261045918367348, + "kappa2_speed2norm_packet_trimmed10_mean": 0.10552117346938775, + "kinetic_energy": 0.9113505102040815, + "kinetic_flow": 0.5861016156462584, + "kinetic_packet": 0.9372340136054421, + "packet_consistency": 0.7910509353741496, + "pna_flow": 0.32325068027210885, + "pna_packet_max": 0.19332108843537416, + "pna_packet_mean": 0.10345867346938775, + "pna_packet_median": 0.07261045918367348, + "pna_packet_trimmed10_mean": 0.10552117346938775, + "terminal_flow": 0.8342948979591837, + "terminal_norm": 0.8828649659863946, + "terminal_packet": 0.9059818027210886, + "velocity_flow": 0.5780552721088436, + "velocity_packet": 0.8418581632653062, + "velocity_total": 0.8651822278911564 + }, + "WebDDoS": { + "_n": 438.0, + "arc_length": 0.7269348173515982, + "causal_surprisal_flow": 0.35986210045662104, + "causal_surprisal_packet_max": 0.3875454337899543, + "causal_surprisal_packet_mean": 0.39951347031963474, + "causal_surprisal_packet_median": 0.3885155251141552, + "causal_surprisal_packet_trimmed10_mean": 0.3906365296803653, + "causal_surprisal_total": 0.3408691780821918, + "consistency_total": 0.5204682648401826, + "curvature_flow": 0.6750477168949772, + "curvature_packet": 0.5842049086757992, + "curvature_total": 0.7577166666666667, + "direction_drift_flow": 0.25844920091324197, + "direction_drift_packet_max": 0.5408191780821917, + "direction_drift_packet_mean": 0.4953388127853881, + "direction_drift_packet_median": 0.4941968036529681, + "direction_drift_packet_trimmed10_mean": 0.4831431506849315, + "direction_drift_total": 0.37894840182648404, + "flow_consistency": 0.5294671232876713, + "kappa2_speed2norm_packet_mean": 0.6117082191780822, + "kappa2_speed2norm_packet_median": 0.618064383561644, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6008945205479452, + "kinetic_energy": 0.7263908675799087, + "kinetic_flow": 0.7103118721461188, + "kinetic_packet": 0.4436133561643836, + "packet_consistency": 0.4496720319634703, + "pna_flow": 0.36779634703196346, + "pna_packet_max": 0.5822335616438357, + "pna_packet_mean": 0.6117082191780822, + "pna_packet_median": 0.618064383561644, + "pna_packet_trimmed10_mean": 0.6008945205479452, + "terminal_flow": 0.34644075342465747, + "terminal_norm": 0.49359280821917806, + "terminal_packet": 0.49815616438356164, + "velocity_flow": 0.775378196347032, + "velocity_packet": 0.4304036529680365, + "velocity_total": 0.7846526255707762 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/baseline_seed42_to_cicddos2019.log b/artifacts/route_comparison/cross/baseline_seed42_to_cicddos2019.log new file mode 100644 index 0000000..88ded1f --- /dev/null +++ b/artifacts/route_comparison/cross/baseline_seed42_to_cicddos2019.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 8,993,376 target rows; label distribution top: + Syn 1,495,248 + NetBIOS 702,760 + UDP 611,999 + MSSQL 523,845 + LDAP 509,665 +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 19.8s +[eval] scoring attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done in 18.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/baseline_seed42_to_cicddos2019.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/baseline_seed42_to_cicddos2019.npz + +=== overall AUROC top-10 === + velocity_total AUROC=0.9078 AUPRC=0.9171 + arc_length AUROC=0.8891 AUPRC=0.9018 + kinetic_energy AUROC=0.8890 AUPRC=0.9018 + kinetic_packet AUROC=0.8103 AUPRC=0.8001 + velocity_packet AUROC=0.7951 AUPRC=0.7370 + kinetic_flow AUROC=0.7843 AUPRC=0.6708 + terminal_norm AUROC=0.7528 AUPRC=0.6955 + consistency_total AUROC=0.7507 AUPRC=0.6532 + flow_consistency AUROC=0.7496 AUPRC=0.6678 + curvature_packet AUROC=0.7347 AUPRC=0.7194 diff --git a/artifacts/route_comparison/cross/baseline_seed42_to_cicddos2019.npz b/artifacts/route_comparison/cross/baseline_seed42_to_cicddos2019.npz new file mode 100644 index 0000000..367715d Binary files /dev/null and b/artifacts/route_comparison/cross/baseline_seed42_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/baseline_seed42_to_cicids2017.json b/artifacts/route_comparison/cross/baseline_seed42_to_cicids2017.json new file mode 100644 index 0000000..b095fd6 --- /dev/null +++ b/artifacts/route_comparison/cross/baseline_seed42_to_cicids2017.json @@ -0,0 +1,740 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.6648447209096279, + "auprc": 0.6056702557190425 + }, + "causal_surprisal_flow": { + "auroc": 0.6077987743650326, + "auprc": 0.5123274590630392 + }, + "causal_surprisal_packet_max": { + "auroc": 0.6602307811577082, + "auprc": 0.5200214496633778 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.6871511075014767, + "auprc": 0.6060695844455424 + }, + "causal_surprisal_packet_median": { + "auroc": 0.5417952377436503, + "auprc": 0.5127199638008333 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.5813014619019493, + "auprc": 0.521208700227414 + }, + "causal_surprisal_total": { + "auroc": 0.5668836163614884, + "auprc": 0.43552978050507446 + }, + "consistency_total": { + "auroc": 0.6890789574719433, + "auprc": 0.5019402323491193 + }, + "curvature_flow": { + "auroc": 0.5927680891907856, + "auprc": 0.47202777572880017 + }, + "curvature_packet": { + "auroc": 0.6031672917897224, + "auprc": 0.45924426821477515 + }, + "curvature_total": { + "auroc": 0.6422616435321914, + "auprc": 0.49351705149809066 + }, + "direction_drift_flow": { + "auroc": 0.24053762551683405, + "auprc": 0.2751716416765159 + }, + "direction_drift_packet_max": { + "auroc": 0.4807359716479622, + "auprc": 0.40483799648169067 + }, + "direction_drift_packet_mean": { + "auroc": 0.1979804562906084, + "auprc": 0.2665770762275176 + }, + "direction_drift_packet_median": { + "auroc": 0.19494882604843472, + "auprc": 0.26647208127704997 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.19048148257531008, + "auprc": 0.26596163197833106 + }, + "direction_drift_total": { + "auroc": 0.2466910587714117, + "auprc": 0.27622289370069214 + }, + "flow_consistency": { + "auroc": 0.6654891907855877, + "auprc": 0.4765431799884604 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.3630396042528057, + "auprc": 0.31080444529342494 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.3570415239220319, + "auprc": 0.3087981822041716 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.35258677643236863, + "auprc": 0.3073578527445636 + }, + "kinetic_energy": { + "auroc": 0.664247135262847, + "auprc": 0.6049704486432048 + }, + "kinetic_flow": { + "auroc": 0.777704858239811, + "auprc": 0.6010468574169747 + }, + "kinetic_packet": { + "auroc": 0.6963392720023627, + "auprc": 0.6285077647242254 + }, + "packet_consistency": { + "auroc": 0.7879833210277615, + "auprc": 0.5814348989453796 + }, + "pna_flow": { + "auroc": 0.251665696987596, + "auprc": 0.28016667663282907 + }, + "pna_packet_max": { + "auroc": 0.4376368576491435, + "auprc": 0.3386757502747807 + }, + "pna_packet_mean": { + "auroc": 0.3630396042528057, + "auprc": 0.31080444529342494 + }, + "pna_packet_median": { + "auroc": 0.3570415239220319, + "auprc": 0.3087981822041716 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.35258677643236863, + "auprc": 0.3073578527445636 + }, + "terminal_flow": { + "auroc": 0.9102290756054342, + "auprc": 0.8157685942518073 + }, + "terminal_norm": { + "auroc": 0.7558361266981688, + "auprc": 0.685079464507983 + }, + "terminal_packet": { + "auroc": 0.7517144418192557, + "auprc": 0.6685616267326426 + }, + "velocity_flow": { + "auroc": 0.7726178898405198, + "auprc": 0.5831011505007035 + }, + "velocity_packet": { + "auroc": 0.7811558254577673, + "auprc": 0.6029816390612415 + }, + "velocity_total": { + "auroc": 0.7243832250443002, + "auprc": 0.6669642960542863 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "arc_length": 0.5899080330330331, + "causal_surprisal_flow": 0.7107103603603604, + "causal_surprisal_packet_max": 0.8444776276276276, + "causal_surprisal_packet_mean": 0.8516381381381382, + "causal_surprisal_packet_median": 0.4314570570570571, + "causal_surprisal_packet_trimmed10_mean": 0.4755816816816817, + "causal_surprisal_total": 0.8292474474474474, + "consistency_total": 0.8601892642642643, + "curvature_flow": 0.09858348348348348, + "curvature_packet": 0.3708310810810811, + "curvature_total": 0.33927027027027024, + "direction_drift_flow": 0.5813989489489488, + "direction_drift_packet_max": 0.3905019519519519, + "direction_drift_packet_mean": 0.26569129129129126, + "direction_drift_packet_median": 0.2854316066066066, + "direction_drift_packet_trimmed10_mean": 0.24435285285285283, + "direction_drift_total": 0.32050082582582584, + "flow_consistency": 0.8136228228228228, + "kappa2_speed2norm_packet_mean": 0.283266066066066, + "kappa2_speed2norm_packet_median": 0.3038022522522522, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2418907657657658, + "kinetic_energy": 0.5974582582582583, + "kinetic_flow": 0.429897972972973, + "kinetic_packet": 0.7823424174174174, + "packet_consistency": 0.8139254504504505, + "pna_flow": 0.05712762762762763, + "pna_packet_max": 0.3204948198198198, + "pna_packet_mean": 0.283266066066066, + "pna_packet_median": 0.3038022522522522, + "pna_packet_trimmed10_mean": 0.2418907657657658, + "terminal_flow": 0.8790902402402402, + "terminal_norm": 0.8629602102102102, + "terminal_packet": 0.8775471471471471, + "velocity_flow": 0.41074684684684687, + "velocity_packet": 0.7267304054054055, + "velocity_total": 0.4333579579579579 + }, + "DDoS": { + "_n": 666.0, + "arc_length": 0.7794867867867866, + "causal_surprisal_flow": 0.7241312312312312, + "causal_surprisal_packet_max": 0.7252448948948949, + "causal_surprisal_packet_mean": 0.8761346846846847, + "causal_surprisal_packet_median": 0.8812503003003003, + "causal_surprisal_packet_trimmed10_mean": 0.830139039039039, + "causal_surprisal_total": 0.7866531531531532, + "consistency_total": 0.7369277777777778, + "curvature_flow": 0.48912049549549547, + "curvature_packet": 0.6327051051051051, + "curvature_total": 0.6338927177177177, + "direction_drift_flow": 0.2682713213213213, + "direction_drift_packet_max": 0.5130003003003003, + "direction_drift_packet_mean": 0.20493198198198198, + "direction_drift_packet_median": 0.20513963963963966, + "direction_drift_packet_trimmed10_mean": 0.18916711711711712, + "direction_drift_total": 0.24687424924924925, + "flow_consistency": 0.6945716966966967, + "kappa2_speed2norm_packet_mean": 0.36106561561561556, + "kappa2_speed2norm_packet_median": 0.37347184684684687, + "kappa2_speed2norm_packet_trimmed10_mean": 0.33914624624624623, + "kinetic_energy": 0.7793317567567566, + "kinetic_flow": 0.8196954954954955, + "kinetic_packet": 0.8438881381381381, + "packet_consistency": 0.8735017267267268, + "pna_flow": 0.04562912912912913, + "pna_packet_max": 0.3756268768768769, + "pna_packet_mean": 0.36106561561561556, + "pna_packet_median": 0.37347184684684687, + "pna_packet_trimmed10_mean": 0.33914624624624623, + "terminal_flow": 0.9859631381381383, + "terminal_norm": 0.9449177177177176, + "terminal_packet": 0.9059312312312312, + "velocity_flow": 0.8078055555555556, + "velocity_packet": 0.8604512762762763, + "velocity_total": 0.8381963963963965 + }, + "DoS GoldenEye": { + "_n": 666.0, + "arc_length": 0.6705545795795794, + "causal_surprisal_flow": 0.7355208708708709, + "causal_surprisal_packet_max": 0.7830201951951951, + "causal_surprisal_packet_mean": 0.9212674174174174, + "causal_surprisal_packet_median": 0.8168987237237236, + "causal_surprisal_packet_trimmed10_mean": 0.8675123123123123, + "causal_surprisal_total": 0.7678903903903904, + "consistency_total": 0.717198048048048, + "curvature_flow": 0.5004863363363363, + "curvature_packet": 0.7379563063063063, + "curvature_total": 0.7494623123123123, + "direction_drift_flow": 0.21684159159159158, + "direction_drift_packet_max": 0.7187542042042042, + "direction_drift_packet_mean": 0.31614166666666665, + "direction_drift_packet_median": 0.2892375375375375, + "direction_drift_packet_trimmed10_mean": 0.28263753753753756, + "direction_drift_total": 0.4343641141141141, + "flow_consistency": 0.6910601351351352, + "kappa2_speed2norm_packet_mean": 0.42342312312312314, + "kappa2_speed2norm_packet_median": 0.41803746246246243, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3966165165165165, + "kinetic_energy": 0.6687011261261261, + "kinetic_flow": 0.88896493993994, + "kinetic_packet": 0.7151996996996997, + "packet_consistency": 0.781703003003003, + "pna_flow": 0.04006366366366366, + "pna_packet_max": 0.546291066066066, + "pna_packet_mean": 0.42342312312312314, + "pna_packet_median": 0.41803746246246243, + "pna_packet_trimmed10_mean": 0.3966165165165165, + "terminal_flow": 0.982142942942943, + "terminal_norm": 0.86916996996997, + "terminal_packet": 0.7917612612612612, + "velocity_flow": 0.8641737237237237, + "velocity_packet": 0.8353198948948949, + "velocity_total": 0.8098453453453454 + }, + "DoS Hulk": { + "_n": 666.0, + "arc_length": 0.6923043543543543, + "causal_surprisal_flow": 0.7303795795795796, + "causal_surprisal_packet_max": 0.8133163663663664, + "causal_surprisal_packet_mean": 0.9632142642642643, + "causal_surprisal_packet_median": 0.8463596096096095, + "causal_surprisal_packet_trimmed10_mean": 0.909038138138138, + "causal_surprisal_total": 0.7991243243243243, + "consistency_total": 0.5142654654654655, + "curvature_flow": 0.6484648648648649, + "curvature_packet": 0.6735409159159159, + "curvature_total": 0.6958152402402402, + "direction_drift_flow": 0.2113945945945946, + "direction_drift_packet_max": 0.5270895645645646, + "direction_drift_packet_mean": 0.12032747747747748, + "direction_drift_packet_median": 0.1303551801801802, + "direction_drift_packet_trimmed10_mean": 0.10301111111111111, + "direction_drift_total": 0.1398499249249249, + "flow_consistency": 0.45904324324324325, + "kappa2_speed2norm_packet_mean": 0.3307496996996997, + "kappa2_speed2norm_packet_median": 0.3295524024024024, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2851364864864865, + "kinetic_energy": 0.6895770270270272, + "kinetic_flow": 0.8205321321321322, + "kinetic_packet": 0.7817817567567569, + "packet_consistency": 0.902425975975976, + "pna_flow": 0.12418648648648649, + "pna_packet_max": 0.48171974474474477, + "pna_packet_mean": 0.3307496996996997, + "pna_packet_median": 0.3295524024024024, + "pna_packet_trimmed10_mean": 0.2851364864864865, + "terminal_flow": 0.9222626876876877, + "terminal_norm": 0.7593193693693694, + "terminal_packet": 0.7706262762762762, + "velocity_flow": 0.8309956456456454, + "velocity_packet": 0.9246819819819821, + "velocity_total": 0.8639913663663664 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "arc_length": 0.7139668918918919, + "causal_surprisal_flow": 0.7085207207207207, + "causal_surprisal_packet_max": 0.7265737987987987, + "causal_surprisal_packet_mean": 0.8419331831831832, + "causal_surprisal_packet_median": 0.7773974474474474, + "causal_surprisal_packet_trimmed10_mean": 0.7484297297297297, + "causal_surprisal_total": 0.7367048048048048, + "consistency_total": 0.6165897897897897, + "curvature_flow": 0.6461487237237238, + "curvature_packet": 0.8608635135135135, + "curvature_total": 0.8871588588588588, + "direction_drift_flow": 0.24354046546546546, + "direction_drift_packet_max": 0.6045549549549549, + "direction_drift_packet_mean": 0.272943993993994, + "direction_drift_packet_median": 0.23576066066066068, + "direction_drift_packet_trimmed10_mean": 0.23095705705705707, + "direction_drift_total": 0.33836171171171175, + "flow_consistency": 0.6020608108108108, + "kappa2_speed2norm_packet_mean": 0.4355103603603604, + "kappa2_speed2norm_packet_median": 0.42746381381381376, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4131159159159159, + "kinetic_energy": 0.7114143393393393, + "kinetic_flow": 0.7368016516516517, + "kinetic_packet": 0.8279556306306306, + "packet_consistency": 0.826408858858859, + "pna_flow": 0.33330998498498493, + "pna_packet_max": 0.4580535285285285, + "pna_packet_mean": 0.4355103603603604, + "pna_packet_median": 0.42746381381381376, + "pna_packet_trimmed10_mean": 0.4131159159159159, + "terminal_flow": 0.917118918918919, + "terminal_norm": 0.8334408408408408, + "terminal_packet": 0.8520295795795796, + "velocity_flow": 0.7132446696696697, + "velocity_packet": 0.8592172672672673, + "velocity_total": 0.7401195195195195 + }, + "DoS Slowloris": { + "_n": 666.0, + "arc_length": 0.697518093093093, + "causal_surprisal_flow": 0.5945411411411411, + "causal_surprisal_packet_max": 0.6118563063063063, + "causal_surprisal_packet_mean": 0.7240576576576577, + "causal_surprisal_packet_median": 0.6856951951951952, + "causal_surprisal_packet_trimmed10_mean": 0.7143063063063062, + "causal_surprisal_total": 0.49577702702702703, + "consistency_total": 0.6086702702702703, + "curvature_flow": 0.5855441441441441, + "curvature_packet": 0.7705983483483484, + "curvature_total": 0.8029506756756756, + "direction_drift_flow": 0.15515345345345344, + "direction_drift_packet_max": 0.4506918168168168, + "direction_drift_packet_mean": 0.14061306306306307, + "direction_drift_packet_median": 0.15523746246246245, + "direction_drift_packet_trimmed10_mean": 0.12822072072072072, + "direction_drift_total": 0.11672567567567568, + "flow_consistency": 0.6143794294294296, + "kappa2_speed2norm_packet_mean": 0.40118821321321324, + "kappa2_speed2norm_packet_median": 0.3984231231231231, + "kappa2_speed2norm_packet_trimmed10_mean": 0.38315210210210215, + "kinetic_energy": 0.6956150900900899, + "kinetic_flow": 0.7529633633633633, + "kinetic_packet": 0.8072879129129128, + "packet_consistency": 0.6695268768768768, + "pna_flow": 0.22461253753753752, + "pna_packet_max": 0.4248262762762762, + "pna_packet_mean": 0.40118821321321324, + "pna_packet_median": 0.3984231231231231, + "pna_packet_trimmed10_mean": 0.38315210210210215, + "terminal_flow": 0.8395563063063064, + "terminal_norm": 0.7993878378378378, + "terminal_packet": 0.8133039039039037, + "velocity_flow": 0.7587668168168169, + "velocity_packet": 0.8182603603603604, + "velocity_total": 0.7670701951951953 + }, + "FTP-Patator": { + "_n": 666.0, + "arc_length": 0.16535007507507507, + "causal_surprisal_flow": 0.8607521021021022, + "causal_surprisal_packet_max": 0.834799024024024, + "causal_surprisal_packet_mean": 0.8151099099099101, + "causal_surprisal_packet_median": 0.531754954954955, + "causal_surprisal_packet_trimmed10_mean": 0.7126194444444445, + "causal_surprisal_total": 0.644531081081081, + "consistency_total": 0.5847641141141141, + "curvature_flow": 0.3847624624624625, + "curvature_packet": 0.19913363363363362, + "curvature_total": 0.2239692942942943, + "direction_drift_flow": 0.4560507507507508, + "direction_drift_packet_max": 0.7248663663663663, + "direction_drift_packet_mean": 0.34832897897897896, + "direction_drift_packet_median": 0.3145857357357357, + "direction_drift_packet_trimmed10_mean": 0.33542867867867865, + "direction_drift_total": 0.5745986486486486, + "flow_consistency": 0.5915387387387386, + "kappa2_speed2norm_packet_mean": 0.4142258258258258, + "kappa2_speed2norm_packet_median": 0.4298539039039039, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4251800300300301, + "kinetic_energy": 0.16218213213213212, + "kinetic_flow": 0.8313471471471472, + "kinetic_packet": 0.06911366366366367, + "packet_consistency": 0.6771726726726727, + "pna_flow": 0.04265705705705705, + "pna_packet_max": 0.41979429429429427, + "pna_packet_mean": 0.4142258258258258, + "pna_packet_median": 0.4298539039039039, + "pna_packet_trimmed10_mean": 0.4251800300300301, + "terminal_flow": 0.96736996996997, + "terminal_norm": 0.40324174174174177, + "terminal_packet": 0.3678536786786787, + "velocity_flow": 0.7839959459459459, + "velocity_packet": 0.6272445945945946, + "velocity_total": 0.3634846846846847 + }, + "Heartbleed": { + "_n": 1.0, + "arc_length": 0.9383, + "causal_surprisal_flow": 0.4345, + "causal_surprisal_packet_max": 0.9938, + "causal_surprisal_packet_mean": 0.5650999999999999, + "causal_surprisal_packet_median": 0.2379, + "causal_surprisal_packet_trimmed10_mean": 0.3297, + "causal_surprisal_total": 0.03869999999999996, + "consistency_total": 0.7264, + "curvature_flow": 0.7696999999999999, + "curvature_packet": 0.562, + "curvature_total": 0.5956, + "direction_drift_flow": 0.007900000000000018, + "direction_drift_packet_max": 0.4164, + "direction_drift_packet_mean": 0.028100000000000014, + "direction_drift_packet_median": 0.06620000000000004, + "direction_drift_packet_trimmed10_mean": 0.034599999999999964, + "direction_drift_total": 0.037699999999999956, + "flow_consistency": 0.6089, + "kappa2_speed2norm_packet_mean": 0.10819999999999996, + "kappa2_speed2norm_packet_median": 0.11960000000000004, + "kappa2_speed2norm_packet_trimmed10_mean": 0.10609999999999997, + "kinetic_energy": 0.9328, + "kinetic_flow": 0.9997, + "kinetic_packet": 0.8364999999999999, + "packet_consistency": 0.976, + "pna_flow": 0.00660000000000005, + "pna_packet_max": 0.39380000000000004, + "pna_packet_mean": 0.10819999999999996, + "pna_packet_median": 0.11960000000000004, + "pna_packet_trimmed10_mean": 0.10609999999999997, + "terminal_flow": 0.9852000000000001, + "terminal_norm": 0.26739999999999997, + "terminal_packet": 0.2538, + "velocity_flow": 0.9944, + "velocity_packet": 0.9796, + "velocity_total": 0.9775 + }, + "Infiltration": { + "_n": 7.0, + "arc_length": 0.7415428571428571, + "causal_surprisal_flow": 0.5203571428571429, + "causal_surprisal_packet_max": 0.8549714285714286, + "causal_surprisal_packet_mean": 0.6089857142857142, + "causal_surprisal_packet_median": 0.4742571428571429, + "causal_surprisal_packet_trimmed10_mean": 0.47561428571428566, + "causal_surprisal_total": 0.22145714285714285, + "consistency_total": 0.6862714285714285, + "curvature_flow": 0.6714428571428571, + "curvature_packet": 0.5840857142857143, + "curvature_total": 0.6193, + "direction_drift_flow": 0.0947, + "direction_drift_packet_max": 0.6747428571428571, + "direction_drift_packet_mean": 0.22182857142857143, + "direction_drift_packet_median": 0.22605714285714285, + "direction_drift_packet_trimmed10_mean": 0.22614285714285712, + "direction_drift_total": 0.3337857142857143, + "flow_consistency": 0.6462857142857142, + "kappa2_speed2norm_packet_mean": 0.3667, + "kappa2_speed2norm_packet_median": 0.37175714285714284, + "kappa2_speed2norm_packet_trimmed10_mean": 0.35750000000000004, + "kinetic_energy": 0.7424285714285714, + "kinetic_flow": 0.9227571428571428, + "kinetic_packet": 0.6843428571428571, + "packet_consistency": 0.8414142857142857, + "pna_flow": 0.029657142857142875, + "pna_packet_max": 0.5700428571428571, + "pna_packet_mean": 0.3667, + "pna_packet_median": 0.37175714285714284, + "pna_packet_trimmed10_mean": 0.35750000000000004, + "terminal_flow": 0.9600857142857142, + "terminal_norm": 0.6185, + "terminal_packet": 0.7378142857142858, + "velocity_flow": 0.8902142857142856, + "velocity_packet": 0.7621142857142857, + "velocity_total": 0.7430142857142856 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "arc_length": 0.988715015015015, + "causal_surprisal_flow": 0.02426141141141141, + "causal_surprisal_packet_max": 0.19694294294294296, + "causal_surprisal_packet_mean": 0.12014346846846846, + "causal_surprisal_packet_median": 0.05285225225225225, + "causal_surprisal_packet_trimmed10_mean": 0.13498070570570572, + "causal_surprisal_total": 0.03376201201201201, + "consistency_total": 0.6773387387387388, + "curvature_flow": 0.751975975975976, + "curvature_packet": 0.5877183933933935, + "curvature_total": 0.6455876876876878, + "direction_drift_flow": 0.11477860360360362, + "direction_drift_packet_max": 0.08295675675675676, + "direction_drift_packet_mean": 0.11472785285285285, + "direction_drift_packet_median": 0.1235448948948949, + "direction_drift_packet_trimmed10_mean": 0.14986336336336337, + "direction_drift_total": 0.03801546546546546, + "flow_consistency": 0.6580485735735735, + "kappa2_speed2norm_packet_mean": 0.33566178678678676, + "kappa2_speed2norm_packet_median": 0.22125067567567566, + "kappa2_speed2norm_packet_trimmed10_mean": 0.35829181681681677, + "kinetic_energy": 0.9887681681681681, + "kinetic_flow": 0.7610172672672673, + "kinetic_packet": 0.9508737237237237, + "packet_consistency": 0.7898436186186186, + "pna_flow": 0.4038121621621622, + "pna_packet_max": 0.3989128378378378, + "pna_packet_mean": 0.33566178678678676, + "pna_packet_median": 0.22125067567567566, + "pna_packet_trimmed10_mean": 0.35829181681681677, + "terminal_flow": 0.9317294294294295, + "terminal_norm": 0.9855945945945946, + "terminal_packet": 0.9675334834834834, + "velocity_flow": 0.7890447447447447, + "velocity_packet": 0.6858639639639639, + "velocity_total": 0.983766066066066 + }, + "Portscan": { + "_n": 666.0, + "arc_length": 0.996568018018018, + "causal_surprisal_flow": 0.015501501501501494, + "causal_surprisal_packet_max": 0.06837642642642643, + "causal_surprisal_packet_mean": 0.06906906906906907, + "causal_surprisal_packet_median": 0.10629684684684684, + "causal_surprisal_packet_trimmed10_mean": 0.07219204204204205, + "causal_surprisal_total": 0.015833933933933928, + "consistency_total": 0.7784507507507507, + "curvature_flow": 0.8239288288288288, + "curvature_packet": 0.8433125375375375, + "curvature_total": 0.8941412912912913, + "direction_drift_flow": 0.10704954954954955, + "direction_drift_packet_max": 0.056309159159159156, + "direction_drift_packet_mean": 0.039429804804804805, + "direction_drift_packet_median": 0.0652421921921922, + "direction_drift_packet_trimmed10_mean": 0.06053843843843844, + "direction_drift_total": 0.009105555555555554, + "flow_consistency": 0.734301876876877, + "kappa2_speed2norm_packet_mean": 0.26848806306306305, + "kappa2_speed2norm_packet_median": 0.2954253003003003, + "kappa2_speed2norm_packet_trimmed10_mean": 0.294781006006006, + "kinetic_energy": 0.9965283783783784, + "kinetic_flow": 0.7500879879879879, + "kinetic_packet": 0.9889465465465465, + "packet_consistency": 0.8395405405405406, + "pna_flow": 0.56538003003003, + "pna_packet_max": 0.3677319069069068, + "pna_packet_mean": 0.26848806306306305, + "pna_packet_median": 0.2954253003003003, + "pna_packet_trimmed10_mean": 0.294781006006006, + "terminal_flow": 0.8570978228228229, + "terminal_norm": 0.9901243993993993, + "terminal_packet": 0.9909965465465466, + "velocity_flow": 0.7940310810810812, + "velocity_packet": 0.7831327327327328, + "velocity_total": 0.9971870870870871 + }, + "SSH-Patator": { + "_n": 666.0, + "arc_length": 0.322192942942943, + "causal_surprisal_flow": 0.9942081081081081, + "causal_surprisal_packet_max": 0.9529121621621621, + "causal_surprisal_packet_mean": 0.729043168168168, + "causal_surprisal_packet_median": 0.35346441441441445, + "causal_surprisal_packet_trimmed10_mean": 0.4146566066066066, + "causal_surprisal_total": 0.6323346096096095, + "consistency_total": 0.8146954204204203, + "curvature_flow": 0.9775974474474475, + "curvature_packet": 0.3458319069069069, + "curvature_total": 0.5416713963963964, + "direction_drift_flow": 0.0781337087087087, + "direction_drift_packet_max": 0.7350286786786787, + "direction_drift_packet_mean": 0.1789930930930931, + "direction_drift_packet_median": 0.16598903903903903, + "direction_drift_packet_trimmed10_mean": 0.20200990990990994, + "direction_drift_total": 0.2758034534534534, + "flow_consistency": 0.8161301801801802, + "kappa2_speed2norm_packet_mean": 0.40474692192192185, + "kappa2_speed2norm_packet_median": 0.40192342342342346, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4171987987987988, + "kinetic_energy": 0.32186636636636634, + "kinetic_flow": 0.9541854354354354, + "kinetic_packet": 0.18949061561561564, + "packet_consistency": 0.6839051051051052, + "pna_flow": 0.7184084084084086, + "pna_packet_max": 0.5732735735735736, + "pna_packet_mean": 0.40474692192192185, + "pna_packet_median": 0.40192342342342346, + "pna_packet_trimmed10_mean": 0.4171987987987988, + "terminal_flow": 0.8120267267267266, + "terminal_norm": 0.1802851351351351, + "terminal_packet": 0.2425795045045045, + "velocity_flow": 0.9441956456456456, + "velocity_packet": 0.6627540540540541, + "velocity_total": 0.4130806306306306 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "arc_length": 0.8532767123287671, + "causal_surprisal_flow": 0.4510164383561644, + "causal_surprisal_packet_max": 0.9607986301369862, + "causal_surprisal_packet_mean": 0.38882328767123286, + "causal_surprisal_packet_median": 0.06879726027397261, + "causal_surprisal_packet_trimmed10_mean": 0.11200821917808218, + "causal_surprisal_total": 0.019968493150684934, + "consistency_total": 0.5660931506849315, + "curvature_flow": 0.7792493150684932, + "curvature_packet": 0.5977698630136987, + "curvature_total": 0.6371068493150684, + "direction_drift_flow": 0.009448630136986316, + "direction_drift_packet_max": 0.4903397260273972, + "direction_drift_packet_mean": 0.02537945205479452, + "direction_drift_packet_median": 0.033594520547945206, + "direction_drift_packet_trimmed10_mean": 0.03029178082191781, + "direction_drift_total": 0.03373972602739726, + "flow_consistency": 0.5403301369863014, + "kappa2_speed2norm_packet_mean": 0.15113150684931506, + "kappa2_speed2norm_packet_median": 0.15549041095890412, + "kappa2_speed2norm_packet_trimmed10_mean": 0.14717260273972602, + "kinetic_energy": 0.8452301369863013, + "kinetic_flow": 0.9987301369863014, + "kinetic_packet": 0.680241095890411, + "packet_consistency": 0.9348794520547945, + "pna_flow": 0.016283561643835664, + "pna_packet_max": 0.4575835616438356, + "pna_packet_mean": 0.15113150684931506, + "pna_packet_median": 0.15549041095890412, + "pna_packet_trimmed10_mean": 0.14717260273972602, + "terminal_flow": 0.9535993150684932, + "terminal_norm": 0.21514520547945207, + "terminal_packet": 0.24604109589041098, + "velocity_flow": 0.9963863013698631, + "velocity_packet": 0.9664602739726028, + "velocity_total": 0.9654849315068493 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "arc_length": 0.7644230769230769, + "causal_surprisal_flow": 0.737376923076923, + "causal_surprisal_packet_max": 0.7324538461538461, + "causal_surprisal_packet_mean": 0.7919384615384615, + "causal_surprisal_packet_median": 0.5808384615384615, + "causal_surprisal_packet_trimmed10_mean": 0.5731692307692308, + "causal_surprisal_total": 0.8952076923076924, + "consistency_total": 0.6301615384615384, + "curvature_flow": 0.3425615384615385, + "curvature_packet": 0.8690769230769231, + "curvature_total": 0.8657153846153848, + "direction_drift_flow": 0.562, + "direction_drift_packet_max": 0.7049307692307692, + "direction_drift_packet_mean": 0.27048461538461543, + "direction_drift_packet_median": 0.23915384615384616, + "direction_drift_packet_trimmed10_mean": 0.21546923076923077, + "direction_drift_total": 0.3196846153846154, + "flow_consistency": 0.6119076923076923, + "kappa2_speed2norm_packet_mean": 0.49372307692307693, + "kappa2_speed2norm_packet_median": 0.38126153846153843, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4044, + "kinetic_energy": 0.7658538461538462, + "kinetic_flow": 0.7505384615384616, + "kinetic_packet": 0.8536076923076923, + "packet_consistency": 0.7886846153846154, + "pna_flow": 0.07737692307692311, + "pna_packet_max": 0.7433153846153846, + "pna_packet_mean": 0.49372307692307693, + "pna_packet_median": 0.38126153846153843, + "pna_packet_trimmed10_mean": 0.4044, + "terminal_flow": 0.9615615384615386, + "terminal_norm": 0.9082153846153846, + "terminal_packet": 0.8787, + "velocity_flow": 0.6204846153846154, + "velocity_packet": 0.8812230769230769, + "velocity_total": 0.7083615384615385 + }, + "Web Attack - XSS": { + "_n": 18.0, + "arc_length": 0.9633611111111111, + "causal_surprisal_flow": 0.4337333333333333, + "causal_surprisal_packet_max": 0.9519944444444444, + "causal_surprisal_packet_mean": 0.3748388888888889, + "causal_surprisal_packet_median": 0.052461111111111125, + "causal_surprisal_packet_trimmed10_mean": 0.08716666666666666, + "causal_surprisal_total": 0.009644444444444454, + "consistency_total": 0.5523222222222223, + "curvature_flow": 0.7562833333333333, + "curvature_packet": 0.7824222222222222, + "curvature_total": 0.8350833333333333, + "direction_drift_flow": 0.007444444444444476, + "direction_drift_packet_max": 0.34141666666666665, + "direction_drift_packet_mean": 0.01976111111111111, + "direction_drift_packet_median": 0.03413888888888888, + "direction_drift_packet_trimmed10_mean": 0.026122222222222213, + "direction_drift_total": 0.025655555555555567, + "flow_consistency": 0.48736111111111113, + "kappa2_speed2norm_packet_mean": 0.10740000000000001, + "kappa2_speed2norm_packet_median": 0.09922777777777778, + "kappa2_speed2norm_packet_trimmed10_mean": 0.10026666666666666, + "kinetic_energy": 0.9596166666666666, + "kinetic_flow": 0.9997444444444443, + "kinetic_packet": 0.8858888888888888, + "packet_consistency": 0.9700444444444444, + "pna_flow": 0.006483333333333285, + "pna_packet_max": 0.4437333333333333, + "pna_packet_mean": 0.10740000000000001, + "pna_packet_median": 0.09922777777777778, + "pna_packet_trimmed10_mean": 0.10026666666666666, + "terminal_flow": 0.9672166666666666, + "terminal_norm": 0.32615, + "terminal_packet": 0.41218333333333335, + "velocity_flow": 0.9965277777777778, + "velocity_packet": 0.9861166666666666, + "velocity_total": 0.9849666666666667 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/baseline_seed42_to_cicids2017.log b/artifacts/route_comparison/cross/baseline_seed42_to_cicids2017.log new file mode 100644 index 0000000..f4adea7 --- /dev/null +++ b/artifacts/route_comparison/cross/baseline_seed42_to_cicids2017.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 2,025,564 target rows; label distribution top: + normal 1,521,748 + Portscan 159,040 + DoS Hulk 158,454 + DDoS 95,144 + Infiltration - Portscan 71,714 +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 19.9s +[eval] scoring attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done in 13.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/baseline_seed42_to_cicids2017.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/baseline_seed42_to_cicids2017.npz + +=== overall AUROC top-10 === + terminal_flow AUROC=0.9102 AUPRC=0.8158 + packet_consistency AUROC=0.7880 AUPRC=0.5814 + velocity_packet AUROC=0.7812 AUPRC=0.6030 + kinetic_flow AUROC=0.7777 AUPRC=0.6010 + velocity_flow AUROC=0.7726 AUPRC=0.5831 + terminal_norm AUROC=0.7558 AUPRC=0.6851 + terminal_packet AUROC=0.7517 AUPRC=0.6686 + velocity_total AUROC=0.7244 AUPRC=0.6670 + kinetic_packet AUROC=0.6963 AUPRC=0.6285 + consistency_total AUROC=0.6891 AUPRC=0.5019 diff --git a/artifacts/route_comparison/cross/baseline_seed42_to_cicids2017.npz b/artifacts/route_comparison/cross/baseline_seed42_to_cicids2017.npz new file mode 100644 index 0000000..e691071 Binary files /dev/null and b/artifacts/route_comparison/cross/baseline_seed42_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/baseline_seed43_to_cicddos2019.json b/artifacts/route_comparison/cross/baseline_seed43_to_cicddos2019.json new file mode 100644 index 0000000..5fdb83c --- /dev/null +++ b/artifacts/route_comparison/cross/baseline_seed43_to_cicddos2019.json @@ -0,0 +1,818 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.8713904072719885, + "auprc": 0.8386260453504502 + }, + "causal_surprisal_flow": { + "auroc": 0.3729884420069064, + "auprc": 0.39588749206633184 + }, + "causal_surprisal_packet_max": { + "auroc": 0.12404417529961405, + "auprc": 0.3227413141342186 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.10634878123095676, + "auprc": 0.31966058406611286 + }, + "causal_surprisal_packet_median": { + "auroc": 0.11732548750761733, + "auprc": 0.3210399426975387 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.10469792809262644, + "auprc": 0.31908914130273486 + }, + "causal_surprisal_total": { + "auroc": 0.41857968210440794, + "auprc": 0.40990078175010797 + }, + "consistency_total": { + "auroc": 0.7566465315864311, + "auprc": 0.6853952291037532 + }, + "curvature_flow": { + "auroc": 0.37831439163111924, + "auprc": 0.4210238631564238 + }, + "curvature_packet": { + "auroc": 0.5234403869591713, + "auprc": 0.4819557060165768 + }, + "curvature_total": { + "auroc": 0.3821871267519805, + "auprc": 0.412566083929373 + }, + "direction_drift_flow": { + "auroc": 0.4569246800731262, + "auprc": 0.4299470380387104 + }, + "direction_drift_packet_max": { + "auroc": 0.28611192362380666, + "auprc": 0.3871164789204977 + }, + "direction_drift_packet_mean": { + "auroc": 0.2747158744667885, + "auprc": 0.39014141526279067 + }, + "direction_drift_packet_median": { + "auroc": 0.27425782043469427, + "auprc": 0.3856779925200905 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.27794582063782247, + "auprc": 0.39282901472283743 + }, + "direction_drift_total": { + "auroc": 0.1923290219378428, + "auprc": 0.33774376855846544 + }, + "flow_consistency": { + "auroc": 0.7640258988421693, + "auprc": 0.706578164997293 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.48923545094454596, + "auprc": 0.574759969999462 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.47569446983546615, + "auprc": 0.5641378581105375 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.48533557282145035, + "auprc": 0.5753578510235516 + }, + "kinetic_energy": { + "auroc": 0.8723746648385132, + "auprc": 0.8417734627956057 + }, + "kinetic_flow": { + "auroc": 0.7455184186471663, + "auprc": 0.6304143990912712 + }, + "kinetic_packet": { + "auroc": 0.7755045297582774, + "auprc": 0.685292000665803 + }, + "packet_consistency": { + "auroc": 0.4525446475726183, + "auprc": 0.45718848293258074 + }, + "pna_flow": { + "auroc": 0.24140542352224253, + "auprc": 0.38168905396104913 + }, + "pna_packet_max": { + "auroc": 0.4453059465772902, + "auprc": 0.49707433887667435 + }, + "pna_packet_mean": { + "auroc": 0.48923545094454596, + "auprc": 0.574759969999462 + }, + "pna_packet_median": { + "auroc": 0.47569446983546615, + "auprc": 0.5641378581105375 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.48533557282145035, + "auprc": 0.5753578510235516 + }, + "terminal_flow": { + "auroc": 0.7440493550680479, + "auprc": 0.684860857932829 + }, + "terminal_norm": { + "auroc": 0.7713605728214503, + "auprc": 0.7283032113770885 + }, + "terminal_packet": { + "auroc": 0.7505349278894984, + "auprc": 0.7087200808750722 + }, + "velocity_flow": { + "auroc": 0.7002644322567539, + "auprc": 0.5906861420875543 + }, + "velocity_packet": { + "auroc": 0.5949176721511273, + "auprc": 0.6015761918825564 + }, + "velocity_total": { + "auroc": 0.8426867611212676, + "auprc": 0.8271572981918531 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "arc_length": 0.945527380952381, + "causal_surprisal_flow": 0.3494083333333333, + "causal_surprisal_packet_max": 0.04638027210884353, + "causal_surprisal_packet_mean": 0.05906700680272109, + "causal_surprisal_packet_median": 0.07356870748299321, + "causal_surprisal_packet_trimmed10_mean": 0.06064625850340137, + "causal_surprisal_total": 0.475516156462585, + "consistency_total": 0.8231306122448979, + "curvature_flow": 0.19436292517006803, + "curvature_packet": 0.4144917517006803, + "curvature_total": 0.18480918367346938, + "direction_drift_flow": 0.5352926870748299, + "direction_drift_packet_max": 0.07703095238095238, + "direction_drift_packet_mean": 0.055429676870748304, + "direction_drift_packet_median": 0.06265195578231293, + "direction_drift_packet_trimmed10_mean": 0.0595701530612245, + "direction_drift_total": 0.049091496598639456, + "flow_consistency": 0.8225268707482993, + "kappa2_speed2norm_packet_mean": 0.11476887755102039, + "kappa2_speed2norm_packet_median": 0.12158520408163265, + "kappa2_speed2norm_packet_trimmed10_mean": 0.12054744897959184, + "kinetic_energy": 0.9487961734693877, + "kinetic_flow": 0.6610986394557823, + "kinetic_packet": 0.896800850340136, + "packet_consistency": 0.6943408163265307, + "pna_flow": 0.14138520408163266, + "pna_packet_max": 0.1070280612244898, + "pna_packet_mean": 0.11476887755102039, + "pna_packet_median": 0.12158520408163265, + "pna_packet_trimmed10_mean": 0.12054744897959184, + "terminal_flow": 0.9134945578231293, + "terminal_norm": 0.9527562925170068, + "terminal_packet": 0.9537341836734694, + "velocity_flow": 0.5697705782312924, + "velocity_packet": 0.8926013605442178, + "velocity_total": 0.8064229591836735 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "arc_length": 0.9455954081632653, + "causal_surprisal_flow": 0.3511681972789115, + "causal_surprisal_packet_max": 0.047212755102040815, + "causal_surprisal_packet_mean": 0.06084387755102041, + "causal_surprisal_packet_median": 0.07646734693877552, + "causal_surprisal_packet_trimmed10_mean": 0.06240527210884354, + "causal_surprisal_total": 0.4764765306122449, + "consistency_total": 0.820712074829932, + "curvature_flow": 0.18778996598639452, + "curvature_packet": 0.39779574829931974, + "curvature_total": 0.16929353741496597, + "direction_drift_flow": 0.5389708333333333, + "direction_drift_packet_max": 0.05888673469387755, + "direction_drift_packet_mean": 0.034027721088435374, + "direction_drift_packet_median": 0.03988622448979592, + "direction_drift_packet_trimmed10_mean": 0.0369108843537415, + "direction_drift_total": 0.038476870748299315, + "flow_consistency": 0.8187884353741497, + "kappa2_speed2norm_packet_mean": 0.0672704081632653, + "kappa2_speed2norm_packet_median": 0.07382874149659864, + "kappa2_speed2norm_packet_trimmed10_mean": 0.07185051020408163, + "kinetic_energy": 0.9490414965986396, + "kinetic_flow": 0.6401109693877549, + "kinetic_packet": 0.9087278061224492, + "packet_consistency": 0.7209550170068028, + "pna_flow": 0.14143078231292516, + "pna_packet_max": 0.07383894557823129, + "pna_packet_mean": 0.0672704081632653, + "pna_packet_median": 0.07382874149659864, + "pna_packet_trimmed10_mean": 0.07185051020408163, + "terminal_flow": 0.9212962585034014, + "terminal_norm": 0.9577369047619049, + "terminal_packet": 0.9641336734693877, + "velocity_flow": 0.5535858843537416, + "velocity_packet": 0.9287268707482993, + "velocity_total": 0.7882221088435375 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "arc_length": 0.9571613945578231, + "causal_surprisal_flow": 0.35405578231292517, + "causal_surprisal_packet_max": 0.0426358843537415, + "causal_surprisal_packet_mean": 0.046629421768707484, + "causal_surprisal_packet_median": 0.049694217687074826, + "causal_surprisal_packet_trimmed10_mean": 0.04717057823129252, + "causal_surprisal_total": 0.4852091836734694, + "consistency_total": 0.8703688775510205, + "curvature_flow": 0.23120017006802723, + "curvature_packet": 0.6248813775510205, + "curvature_total": 0.3522593537414966, + "direction_drift_flow": 0.5192018707482993, + "direction_drift_packet_max": 0.30575960884353737, + "direction_drift_packet_mean": 0.32167321428571427, + "direction_drift_packet_median": 0.34117176870748295, + "direction_drift_packet_trimmed10_mean": 0.33754591836734693, + "direction_drift_total": 0.18809566326530613, + "flow_consistency": 0.889475, + "kappa2_speed2norm_packet_mean": 0.7072905612244897, + "kappa2_speed2norm_packet_median": 0.7127993197278911, + "kappa2_speed2norm_packet_trimmed10_mean": 0.718464030612245, + "kinetic_energy": 0.9584041666666668, + "kinetic_flow": 0.8475615646258503, + "kinetic_packet": 0.7982530612244898, + "packet_consistency": 0.3484559523809524, + "pna_flow": 0.12845051020408163, + "pna_packet_max": 0.5313858843537416, + "pna_packet_mean": 0.7072905612244897, + "pna_packet_median": 0.7127993197278911, + "pna_packet_trimmed10_mean": 0.718464030612245, + "terminal_flow": 0.869277551020408, + "terminal_norm": 0.9166632653061225, + "terminal_packet": 0.8480934523809524, + "velocity_flow": 0.7616703231292516, + "velocity_packet": 0.4768443027210884, + "velocity_total": 0.9236306972789118 + }, + "DrDoS_NTP": { + "_n": 588.0, + "arc_length": 0.5672280612244898, + "causal_surprisal_flow": 0.8404882653061223, + "causal_surprisal_packet_max": 0.5727752551020407, + "causal_surprisal_packet_mean": 0.22938163265306125, + "causal_surprisal_packet_median": 0.21605221088435372, + "causal_surprisal_packet_trimmed10_mean": 0.15843537414965986, + "causal_surprisal_total": 0.45925850340136054, + "consistency_total": 0.8454284013605442, + "curvature_flow": 0.555187925170068, + "curvature_packet": 0.5431574829931973, + "curvature_total": 0.5539472789115646, + "direction_drift_flow": 0.3981800170068027, + "direction_drift_packet_max": 0.5785554421768708, + "direction_drift_packet_mean": 0.0937076530612245, + "direction_drift_packet_median": 0.07291930272108843, + "direction_drift_packet_trimmed10_mean": 0.07614676870748299, + "direction_drift_total": 0.14326828231292515, + "flow_consistency": 0.8553778911564625, + "kappa2_speed2norm_packet_mean": 0.3325306972789116, + "kappa2_speed2norm_packet_median": 0.24929608843537418, + "kappa2_speed2norm_packet_trimmed10_mean": 0.26300578231292515, + "kinetic_energy": 0.5677451530612244, + "kinetic_flow": 0.8985654761904761, + "kinetic_packet": 0.7161416666666667, + "packet_consistency": 0.5352324829931971, + "pna_flow": 0.215183843537415, + "pna_packet_max": 0.8490802721088435, + "pna_packet_mean": 0.3325306972789116, + "pna_packet_median": 0.24929608843537418, + "pna_packet_trimmed10_mean": 0.26300578231292515, + "terminal_flow": 0.8413051870748298, + "terminal_norm": 0.40200569727891156, + "terminal_packet": 0.44336743197278905, + "velocity_flow": 0.9011068027210885, + "velocity_packet": 0.8748965986394559, + "velocity_total": 0.6238259353741498 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "arc_length": 0.9597736394557823, + "causal_surprisal_flow": 0.3088158163265306, + "causal_surprisal_packet_max": 0.04301462585034014, + "causal_surprisal_packet_mean": 0.04569013605442177, + "causal_surprisal_packet_median": 0.04821904761904762, + "causal_surprisal_packet_trimmed10_mean": 0.04618333333333334, + "causal_surprisal_total": 0.3733914965986394, + "consistency_total": 0.930220068027211, + "curvature_flow": 0.3760728741496599, + "curvature_packet": 0.5673916666666667, + "curvature_total": 0.386463350340136, + "direction_drift_flow": 0.4871635204081633, + "direction_drift_packet_max": 0.3736239795918368, + "direction_drift_packet_mean": 0.5875693877551021, + "direction_drift_packet_median": 0.6069395408163266, + "direction_drift_packet_trimmed10_mean": 0.6047076530612244, + "direction_drift_total": 0.33570552721088437, + "flow_consistency": 0.9475598639455781, + "kappa2_speed2norm_packet_mean": 0.8299939625850339, + "kappa2_speed2norm_packet_median": 0.8338185374149659, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8420210034013604, + "kinetic_energy": 0.9594738945578232, + "kinetic_flow": 0.8792928571428571, + "kinetic_packet": 0.6909659013605443, + "packet_consistency": 0.11617482993197278, + "pna_flow": 0.18744268707482992, + "pna_packet_max": 0.577909693877551, + "pna_packet_mean": 0.8299939625850339, + "pna_packet_median": 0.8338185374149659, + "pna_packet_trimmed10_mean": 0.8420210034013604, + "terminal_flow": 0.6822072278911565, + "terminal_norm": 0.7970743197278912, + "terminal_packet": 0.6864380952380952, + "velocity_flow": 0.8631462585034013, + "velocity_packet": 0.07784149659863945, + "velocity_total": 0.9859085034013605 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "arc_length": 0.950954081632653, + "causal_surprisal_flow": 0.35108486394557825, + "causal_surprisal_packet_max": 0.0470828231292517, + "causal_surprisal_packet_mean": 0.06020969387755102, + "causal_surprisal_packet_median": 0.07531547619047618, + "causal_surprisal_packet_trimmed10_mean": 0.06188299319727892, + "causal_surprisal_total": 0.47692278911564623, + "consistency_total": 0.8281304421768708, + "curvature_flow": 0.20426326530612243, + "curvature_packet": 0.4021501700680272, + "curvature_total": 0.18087780612244897, + "direction_drift_flow": 0.535410119047619, + "direction_drift_packet_max": 0.062118537414965994, + "direction_drift_packet_mean": 0.052134013605442175, + "direction_drift_packet_median": 0.058673809523809524, + "direction_drift_packet_trimmed10_mean": 0.05564234693877552, + "direction_drift_total": 0.047600510204081625, + "flow_consistency": 0.8274681972789116, + "kappa2_speed2norm_packet_mean": 0.09770102040816327, + "kappa2_speed2norm_packet_median": 0.10436105442176871, + "kappa2_speed2norm_packet_trimmed10_mean": 0.10315340136054421, + "kinetic_energy": 0.954167857142857, + "kinetic_flow": 0.6569880102040816, + "kinetic_packet": 0.8956889455782313, + "packet_consistency": 0.6913541666666666, + "pna_flow": 0.14527908163265305, + "pna_packet_max": 0.08808044217687075, + "pna_packet_mean": 0.09770102040816327, + "pna_packet_median": 0.10436105442176871, + "pna_packet_trimmed10_mean": 0.10315340136054421, + "terminal_flow": 0.9062703231292517, + "terminal_norm": 0.9497508503401361, + "terminal_packet": 0.9504954081632653, + "velocity_flow": 0.5709833333333333, + "velocity_packet": 0.8872226190476191, + "velocity_total": 0.790371768707483 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "arc_length": 0.7637472789115645, + "causal_surprisal_flow": 0.38729251700680273, + "causal_surprisal_packet_max": 0.09860289115646259, + "causal_surprisal_packet_mean": 0.11305102040816327, + "causal_surprisal_packet_median": 0.13086113945578232, + "causal_surprisal_packet_trimmed10_mean": 0.10283554421768709, + "causal_surprisal_total": 0.42650544217687075, + "consistency_total": 0.5171503401360544, + "curvature_flow": 0.5490329931972789, + "curvature_packet": 0.678448724489796, + "curvature_total": 0.5822486394557823, + "direction_drift_flow": 0.36079090136054426, + "direction_drift_packet_max": 0.3287583333333334, + "direction_drift_packet_mean": 0.28626879251700676, + "direction_drift_packet_median": 0.29038018707482993, + "direction_drift_packet_trimmed10_mean": 0.28936955782312923, + "direction_drift_total": 0.20997755102040816, + "flow_consistency": 0.535324149659864, + "kappa2_speed2norm_packet_mean": 0.7447856292517007, + "kappa2_speed2norm_packet_median": 0.7023957482993197, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7205149659863946, + "kinetic_energy": 0.7636261904761904, + "kinetic_flow": 0.7244622448979592, + "kinetic_packet": 0.6792062925170067, + "packet_consistency": 0.2343756802721088, + "pna_flow": 0.47845646258503405, + "pna_packet_max": 0.6753679421768708, + "pna_packet_mean": 0.7447856292517007, + "pna_packet_median": 0.7023957482993197, + "pna_packet_trimmed10_mean": 0.7205149659863946, + "terminal_flow": 0.45297806122448975, + "terminal_norm": 0.48177653061224485, + "terminal_packet": 0.5298127551020408, + "velocity_flow": 0.7099417517006803, + "velocity_packet": 0.5136273809523809, + "velocity_total": 0.8153402210884354 + }, + "DrDoS_UDP": { + "_n": 588.0, + "arc_length": 0.7647484693877551, + "causal_surprisal_flow": 0.38420697278911564, + "causal_surprisal_packet_max": 0.09690833333333333, + "causal_surprisal_packet_mean": 0.1136187074829932, + "causal_surprisal_packet_median": 0.13771156462585032, + "causal_surprisal_packet_trimmed10_mean": 0.1085095238095238, + "causal_surprisal_total": 0.4267447278911565, + "consistency_total": 0.5132426870748299, + "curvature_flow": 0.5424334183673469, + "curvature_packet": 0.66800518707483, + "curvature_total": 0.570772619047619, + "direction_drift_flow": 0.3618847789115646, + "direction_drift_packet_max": 0.32812117346938774, + "direction_drift_packet_mean": 0.29080680272108844, + "direction_drift_packet_median": 0.2922781462585034, + "direction_drift_packet_trimmed10_mean": 0.29667636054421764, + "direction_drift_total": 0.2100500850340136, + "flow_consistency": 0.5339527210884354, + "kappa2_speed2norm_packet_mean": 0.7389195578231292, + "kappa2_speed2norm_packet_median": 0.6951000850340137, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7269829931972789, + "kinetic_energy": 0.7645186224489795, + "kinetic_flow": 0.7266430272108844, + "kinetic_packet": 0.6760074829931972, + "packet_consistency": 0.2154642006802721, + "pna_flow": 0.4587044217687075, + "pna_packet_max": 0.665770918367347, + "pna_packet_mean": 0.7389195578231292, + "pna_packet_median": 0.6951000850340137, + "pna_packet_trimmed10_mean": 0.7269829931972789, + "terminal_flow": 0.4430232993197279, + "terminal_norm": 0.47447687074829925, + "terminal_packet": 0.5218731292517007, + "velocity_flow": 0.7144996598639456, + "velocity_packet": 0.5052562925170069, + "velocity_total": 0.8203690476190476 + }, + "LDAP": { + "_n": 588.0, + "arc_length": 0.9433774659863946, + "causal_surprisal_flow": 0.3482993197278912, + "causal_surprisal_packet_max": 0.04789336734693877, + "causal_surprisal_packet_mean": 0.06139727891156463, + "causal_surprisal_packet_median": 0.07653316326530613, + "causal_surprisal_packet_trimmed10_mean": 0.0632984693877551, + "causal_surprisal_total": 0.46833290816326534, + "consistency_total": 0.8249357142857142, + "curvature_flow": 0.18084948979591833, + "curvature_packet": 0.4014748299319728, + "curvature_total": 0.16731139455782312, + "direction_drift_flow": 0.5430313775510204, + "direction_drift_packet_max": 0.05453214285714286, + "direction_drift_packet_mean": 0.03245867346938775, + "direction_drift_packet_median": 0.03820646258503401, + "direction_drift_packet_trimmed10_mean": 0.035256632653061226, + "direction_drift_total": 0.03771683673469387, + "flow_consistency": 0.8232673469387756, + "kappa2_speed2norm_packet_mean": 0.06556071428571428, + "kappa2_speed2norm_packet_median": 0.07208545918367348, + "kappa2_speed2norm_packet_trimmed10_mean": 0.07045510204081633, + "kinetic_energy": 0.9471263605442177, + "kinetic_flow": 0.6205816326530611, + "kinetic_packet": 0.9123693877551019, + "packet_consistency": 0.7216964285714286, + "pna_flow": 0.1398374149659864, + "pna_packet_max": 0.07028843537414967, + "pna_packet_mean": 0.06556071428571428, + "pna_packet_median": 0.07208545918367348, + "pna_packet_trimmed10_mean": 0.07045510204081633, + "terminal_flow": 0.9239401360544217, + "terminal_norm": 0.9584380952380952, + "terminal_packet": 0.9658210884353742, + "velocity_flow": 0.5517874149659864, + "velocity_packet": 0.9258824829931973, + "velocity_total": 0.7715982142857142 + }, + "MSSQL": { + "_n": 588.0, + "arc_length": 0.9580238095238096, + "causal_surprisal_flow": 0.3568387755102041, + "causal_surprisal_packet_max": 0.04254404761904762, + "causal_surprisal_packet_mean": 0.046250340136054426, + "causal_surprisal_packet_median": 0.049091836734693875, + "causal_surprisal_packet_trimmed10_mean": 0.046797619047619046, + "causal_surprisal_total": 0.4931561224489796, + "consistency_total": 0.8708477891156463, + "curvature_flow": 0.247322193877551, + "curvature_packet": 0.6288874149659863, + "curvature_total": 0.36341173469387755, + "direction_drift_flow": 0.515556462585034, + "direction_drift_packet_max": 0.3151110544217687, + "direction_drift_packet_mean": 0.3245038265306122, + "direction_drift_packet_median": 0.3437671768707483, + "direction_drift_packet_trimmed10_mean": 0.34035314625850344, + "direction_drift_total": 0.19236335034013607, + "flow_consistency": 0.8913944727891157, + "kappa2_speed2norm_packet_mean": 0.7214525510204083, + "kappa2_speed2norm_packet_median": 0.7268802721088434, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7326460034013604, + "kinetic_energy": 0.9591072278911564, + "kinetic_flow": 0.8489275510204082, + "kinetic_packet": 0.7976318027210885, + "packet_consistency": 0.3352962585034013, + "pna_flow": 0.13283418367346939, + "pna_packet_max": 0.5409115646258503, + "pna_packet_mean": 0.7214525510204083, + "pna_packet_median": 0.7268802721088434, + "pna_packet_trimmed10_mean": 0.7326460034013604, + "terminal_flow": 0.8616501700680271, + "terminal_norm": 0.9127993197278912, + "terminal_packet": 0.84298231292517, + "velocity_flow": 0.7764257653061224, + "velocity_packet": 0.46459285714285714, + "velocity_total": 0.9349102040816327 + }, + "NetBIOS": { + "_n": 588.0, + "arc_length": 0.95024268707483, + "causal_surprisal_flow": 0.3154622448979592, + "causal_surprisal_packet_max": 0.04314234693877551, + "causal_surprisal_packet_mean": 0.045857482993197286, + "causal_surprisal_packet_median": 0.048617176870748305, + "causal_surprisal_packet_trimmed10_mean": 0.04641785714285715, + "causal_surprisal_total": 0.3910768707482993, + "consistency_total": 0.9287561224489795, + "curvature_flow": 0.4059527210884354, + "curvature_packet": 0.5753260204081632, + "curvature_total": 0.41646726190476185, + "direction_drift_flow": 0.48001598639455784, + "direction_drift_packet_max": 0.3994106292517007, + "direction_drift_packet_mean": 0.6135436224489796, + "direction_drift_packet_median": 0.6312470238095238, + "direction_drift_packet_trimmed10_mean": 0.6302792517006803, + "direction_drift_total": 0.3495796768707483, + "flow_consistency": 0.9453440476190477, + "kappa2_speed2norm_packet_mean": 0.8442238095238095, + "kappa2_speed2norm_packet_median": 0.8476697278911567, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8554307823129251, + "kinetic_energy": 0.9498748299319728, + "kinetic_flow": 0.8685423469387755, + "kinetic_packet": 0.6857164965986395, + "packet_consistency": 0.11996437074829934, + "pna_flow": 0.21108843537414967, + "pna_packet_max": 0.602414880952381, + "pna_packet_mean": 0.8442238095238095, + "pna_packet_median": 0.8476697278911567, + "pna_packet_trimmed10_mean": 0.8554307823129251, + "terminal_flow": 0.6676191326530612, + "terminal_norm": 0.7921355442176871, + "terminal_packet": 0.6793151360544218, + "velocity_flow": 0.8543908163265307, + "velocity_packet": 0.06887619047619048, + "velocity_total": 0.9778557823129251 + }, + "Portmap": { + "_n": 588.0, + "arc_length": 0.9517189625850341, + "causal_surprisal_flow": 0.31084149659863947, + "causal_surprisal_packet_max": 0.0440860544217687, + "causal_surprisal_packet_mean": 0.04670408163265307, + "causal_surprisal_packet_median": 0.04862465986394558, + "causal_surprisal_packet_trimmed10_mean": 0.04765085034013605, + "causal_surprisal_total": 0.37978341836734697, + "consistency_total": 0.9273721088435374, + "curvature_flow": 0.3522345238095238, + "curvature_packet": 0.5656033163265306, + "curvature_total": 0.3697723639455782, + "direction_drift_flow": 0.4902258503401361, + "direction_drift_packet_max": 0.3974188775510204, + "direction_drift_packet_mean": 0.6112255952380953, + "direction_drift_packet_median": 0.6297484693877551, + "direction_drift_packet_trimmed10_mean": 0.6278706632653062, + "direction_drift_total": 0.35376870748299316, + "flow_consistency": 0.9441802721088435, + "kappa2_speed2norm_packet_mean": 0.8360003401360544, + "kappa2_speed2norm_packet_median": 0.8394005102040817, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8475994897959185, + "kinetic_energy": 0.951389455782313, + "kinetic_flow": 0.867998469387755, + "kinetic_packet": 0.6853746598639456, + "packet_consistency": 0.1271469387755102, + "pna_flow": 0.1791891156462585, + "pna_packet_max": 0.5942753401360544, + "pna_packet_mean": 0.8360003401360544, + "pna_packet_median": 0.8394005102040817, + "pna_packet_trimmed10_mean": 0.8475994897959185, + "terminal_flow": 0.6959539115646259, + "terminal_norm": 0.8037881802721087, + "terminal_packet": 0.6847418367346939, + "velocity_flow": 0.8515211734693878, + "velocity_packet": 0.0725124149659864, + "velocity_total": 0.9762544217687075 + }, + "Syn": { + "_n": 588.0, + "arc_length": 0.9349430272108845, + "causal_surprisal_flow": 0.27848537414965985, + "causal_surprisal_packet_max": 0.22626870748299321, + "causal_surprisal_packet_mean": 0.22865391156462583, + "causal_surprisal_packet_median": 0.24106785714285714, + "causal_surprisal_packet_trimmed10_mean": 0.26820765306122446, + "causal_surprisal_total": 0.2836229591836735, + "consistency_total": 0.81121037414966, + "curvature_flow": 0.5122018707482994, + "curvature_packet": 0.25468061224489796, + "curvature_total": 0.2441333333333333, + "direction_drift_flow": 0.4286350340136055, + "direction_drift_packet_max": 0.08611207482993197, + "direction_drift_packet_mean": 0.05000042517006803, + "direction_drift_packet_median": 0.0589640306122449, + "direction_drift_packet_trimmed10_mean": 0.05421828231292517, + "direction_drift_total": 0.055476020408163275, + "flow_consistency": 0.7940647108843538, + "kappa2_speed2norm_packet_mean": 0.055575680272108845, + "kappa2_speed2norm_packet_median": 0.039405102040816334, + "kappa2_speed2norm_packet_trimmed10_mean": 0.05590323129251701, + "kinetic_energy": 0.9354942176870747, + "kinetic_flow": 0.6256260204081633, + "kinetic_packet": 0.942279081632653, + "packet_consistency": 0.9000465136054422, + "pna_flow": 0.2514, + "pna_packet_max": 0.15273103741496596, + "pna_packet_mean": 0.055575680272108845, + "pna_packet_median": 0.039405102040816334, + "pna_packet_trimmed10_mean": 0.05590323129251701, + "terminal_flow": 0.8923566326530612, + "terminal_norm": 0.9394384353741496, + "terminal_packet": 0.9559102040816326, + "velocity_flow": 0.5607844387755102, + "velocity_packet": 0.8854261904761905, + "velocity_total": 0.8491394557823128 + }, + "TFTP": { + "_n": 588.0, + "arc_length": 0.786360544217687, + "causal_surprisal_flow": 0.3722085034013606, + "causal_surprisal_packet_max": 0.12778248299319728, + "causal_surprisal_packet_mean": 0.1049234693877551, + "causal_surprisal_packet_median": 0.0830858843537415, + "causal_surprisal_packet_trimmed10_mean": 0.09998656462585034, + "causal_surprisal_total": 0.4242605442176871, + "consistency_total": 0.6294839285714287, + "curvature_flow": 0.28318418367346937, + "curvature_packet": 0.6425763605442177, + "curvature_total": 0.4519334183673469, + "direction_drift_flow": 0.45769880952380954, + "direction_drift_packet_max": 0.5928075680272109, + "direction_drift_packet_mean": 0.505910544217687, + "direction_drift_packet_median": 0.3852025510204082, + "direction_drift_packet_trimmed10_mean": 0.5004091836734694, + "direction_drift_total": 0.4081943877551021, + "flow_consistency": 0.6388260204081633, + "kappa2_speed2norm_packet_mean": 0.7481295068027212, + "kappa2_speed2norm_packet_median": 0.7075000850340137, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7426150510204081, + "kinetic_energy": 0.7870225340136053, + "kinetic_flow": 0.7236360544217687, + "kinetic_packet": 0.7322379251700679, + "packet_consistency": 0.4035447278911564, + "pna_flow": 0.17169923469387754, + "pna_packet_max": 0.717920493197279, + "pna_packet_mean": 0.7481295068027212, + "pna_packet_median": 0.7075000850340137, + "pna_packet_trimmed10_mean": 0.7426150510204081, + "terminal_flow": 0.8387242346938776, + "terminal_norm": 0.844496768707483, + "terminal_packet": 0.7624341836734695, + "velocity_flow": 0.6672785714285713, + "velocity_packet": 0.5867511904761905, + "velocity_total": 0.7841421768707483 + }, + "UDP": { + "_n": 588.0, + "arc_length": 0.7500422619047619, + "causal_surprisal_flow": 0.38877568027210885, + "causal_surprisal_packet_max": 0.09814744897959185, + "causal_surprisal_packet_mean": 0.11557993197278912, + "causal_surprisal_packet_median": 0.13956675170068028, + "causal_surprisal_packet_trimmed10_mean": 0.10908103741496598, + "causal_surprisal_total": 0.43201130952380956, + "consistency_total": 0.48454472789115643, + "curvature_flow": 0.5730527210884354, + "curvature_packet": 0.6841624149659863, + "curvature_total": 0.6016858843537415, + "direction_drift_flow": 0.3460761904761905, + "direction_drift_packet_max": 0.3399375, + "direction_drift_packet_mean": 0.3011954081632653, + "direction_drift_packet_median": 0.3039444727891156, + "direction_drift_packet_trimmed10_mean": 0.30642083333333336, + "direction_drift_total": 0.22324336734693878, + "flow_consistency": 0.503477806122449, + "kappa2_speed2norm_packet_mean": 0.7369653911564625, + "kappa2_speed2norm_packet_median": 0.7010587585034014, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7201734693877551, + "kinetic_energy": 0.7497542517006802, + "kinetic_flow": 0.7133671768707482, + "kinetic_packet": 0.6725149659863946, + "packet_consistency": 0.22068775510204083, + "pna_flow": 0.4881097789115646, + "pna_packet_max": 0.671903486394558, + "pna_packet_mean": 0.7369653911564625, + "pna_packet_median": 0.7010587585034014, + "pna_packet_trimmed10_mean": 0.7201734693877551, + "terminal_flow": 0.4137039115646258, + "terminal_norm": 0.44742925170068026, + "terminal_packet": 0.5066867346938777, + "velocity_flow": 0.7019147959183674, + "velocity_packet": 0.5191301020408163, + "velocity_total": 0.8083767857142857 + }, + "UDPLag": { + "_n": 588.0, + "arc_length": 0.9156125850340137, + "causal_surprisal_flow": 0.3012263605442177, + "causal_surprisal_packet_max": 0.2052011904761905, + "causal_surprisal_packet_mean": 0.21379302721088433, + "causal_surprisal_packet_median": 0.27182729591836735, + "causal_surprisal_packet_trimmed10_mean": 0.23982925170068026, + "causal_surprisal_total": 0.3122316326530612, + "consistency_total": 0.7836986394557823, + "curvature_flow": 0.48074081632653065, + "curvature_packet": 0.28779268707482997, + "curvature_total": 0.2749763605442177, + "direction_drift_flow": 0.429210119047619, + "direction_drift_packet_max": 0.08926683673469388, + "direction_drift_packet_mean": 0.06912908163265306, + "direction_drift_packet_median": 0.07663044217687075, + "direction_drift_packet_trimmed10_mean": 0.07301819727891157, + "direction_drift_total": 0.06550357142857142, + "flow_consistency": 0.7717313775510205, + "kappa2_speed2norm_packet_mean": 0.11952704081632654, + "kappa2_speed2norm_packet_median": 0.11081751700680273, + "kappa2_speed2norm_packet_trimmed10_mean": 0.11809115646258503, + "kinetic_energy": 0.9160613945578231, + "kinetic_flow": 0.6293863945578232, + "kinetic_packet": 0.9142340136054421, + "packet_consistency": 0.8128841836734693, + "pna_flow": 0.2632397959183673, + "pna_packet_max": 0.15885374149659864, + "pna_packet_mean": 0.11952704081632654, + "pna_packet_median": 0.11081751700680273, + "pna_packet_trimmed10_mean": 0.11809115646258503, + "terminal_flow": 0.8481389455782312, + "terminal_norm": 0.891446088435374, + "terminal_packet": 0.9092119047619046, + "velocity_flow": 0.5741910714285713, + "velocity_packet": 0.853515986394558, + "velocity_total": 0.8465841836734694 + }, + "WebDDoS": { + "_n": 438.0, + "arc_length": 0.7333707762557079, + "causal_surprisal_flow": 0.33158219178082193, + "causal_surprisal_packet_max": 0.3321643835616438, + "causal_surprisal_packet_mean": 0.25392534246575343, + "causal_surprisal_packet_median": 0.2662095890410959, + "causal_surprisal_packet_trimmed10_mean": 0.24676929223744293, + "causal_surprisal_total": 0.3014821917808219, + "consistency_total": 0.35002922374429224, + "curvature_flow": 0.6161297945205478, + "curvature_packet": 0.57475, + "curvature_total": 0.7105952054794521, + "direction_drift_flow": 0.3004607305936073, + "direction_drift_packet_max": 0.5416359589041096, + "direction_drift_packet_mean": 0.49739006849315065, + "direction_drift_packet_median": 0.4830294520547945, + "direction_drift_packet_trimmed10_mean": 0.44271643835616437, + "direction_drift_total": 0.41941038812785386, + "flow_consistency": 0.3366589041095891, + "kappa2_speed2norm_packet_mean": 0.579276598173516, + "kappa2_speed2norm_packet_median": 0.573841210045662, + "kappa2_speed2norm_packet_trimmed10_mean": 0.560399200913242, + "kinetic_energy": 0.7332828767123287, + "kinetic_flow": 0.7394857305936073, + "kinetic_packet": 0.5122767123287671, + "packet_consistency": 0.5103969178082192, + "pna_flow": 0.41425570776255705, + "pna_packet_max": 0.5085817351598173, + "pna_packet_mean": 0.579276598173516, + "pna_packet_median": 0.573841210045662, + "pna_packet_trimmed10_mean": 0.560399200913242, + "terminal_flow": 0.3854098173515982, + "terminal_norm": 0.5291216894977169, + "terminal_packet": 0.4867502283105023, + "velocity_flow": 0.7287680365296804, + "velocity_packet": 0.5747517123287671, + "velocity_total": 0.8158853881278539 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/baseline_seed43_to_cicddos2019.log b/artifacts/route_comparison/cross/baseline_seed43_to_cicddos2019.log new file mode 100644 index 0000000..e9b6f04 --- /dev/null +++ b/artifacts/route_comparison/cross/baseline_seed43_to_cicddos2019.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 8,993,376 target rows; label distribution top: + Syn 1,495,248 + NetBIOS 702,760 + UDP 611,999 + MSSQL 523,845 + LDAP 509,665 +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 19.7s +[eval] scoring attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done in 18.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/baseline_seed43_to_cicddos2019.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/baseline_seed43_to_cicddos2019.npz + +=== overall AUROC top-10 === + kinetic_energy AUROC=0.8724 AUPRC=0.8418 + arc_length AUROC=0.8714 AUPRC=0.8386 + velocity_total AUROC=0.8427 AUPRC=0.8272 + kinetic_packet AUROC=0.7755 AUPRC=0.6853 + terminal_norm AUROC=0.7714 AUPRC=0.7283 + flow_consistency AUROC=0.7640 AUPRC=0.7066 + consistency_total AUROC=0.7566 AUPRC=0.6854 + terminal_packet AUROC=0.7505 AUPRC=0.7087 + kinetic_flow AUROC=0.7455 AUPRC=0.6304 + terminal_flow AUROC=0.7440 AUPRC=0.6849 diff --git a/artifacts/route_comparison/cross/baseline_seed43_to_cicddos2019.npz b/artifacts/route_comparison/cross/baseline_seed43_to_cicddos2019.npz new file mode 100644 index 0000000..74b08b3 Binary files /dev/null and b/artifacts/route_comparison/cross/baseline_seed43_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/baseline_seed43_to_cicids2017.json b/artifacts/route_comparison/cross/baseline_seed43_to_cicids2017.json new file mode 100644 index 0000000..0832ed2 --- /dev/null +++ b/artifacts/route_comparison/cross/baseline_seed43_to_cicids2017.json @@ -0,0 +1,740 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.7079719137625518, + "auprc": 0.6417618668353385 + }, + "causal_surprisal_flow": { + "auroc": 0.5981295481393976, + "auprc": 0.4962079595248921 + }, + "causal_surprisal_packet_max": { + "auroc": 0.6291681039574719, + "auprc": 0.5298300833182221 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.5269302347903131, + "auprc": 0.44493715469434636 + }, + "causal_surprisal_packet_median": { + "auroc": 0.3459256423508565, + "auprc": 0.30923337398993067 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.4767064308919079, + "auprc": 0.3633201847464167 + }, + "causal_surprisal_total": { + "auroc": 0.5432917675723568, + "auprc": 0.4204060061951355 + }, + "consistency_total": { + "auroc": 0.643241154754873, + "auprc": 0.44539018150876086 + }, + "curvature_flow": { + "auroc": 0.35986079444772595, + "auprc": 0.31575617141308854 + }, + "curvature_packet": { + "auroc": 0.5521249261665682, + "auprc": 0.3980574216901013 + }, + "curvature_total": { + "auroc": 0.5474514397519197, + "auprc": 0.386190372039817 + }, + "direction_drift_flow": { + "auroc": 0.2681736119314826, + "auprc": 0.2824722610474529 + }, + "direction_drift_packet_max": { + "auroc": 0.6199608165977556, + "auprc": 0.5515343034266218 + }, + "direction_drift_packet_mean": { + "auroc": 0.44367102776137035, + "auprc": 0.3806282031857116 + }, + "direction_drift_packet_median": { + "auroc": 0.4580485528647371, + "auprc": 0.3984533650484684 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.39752557590076787, + "auprc": 0.34334440434245794 + }, + "direction_drift_total": { + "auroc": 0.5167016317188422, + "auprc": 0.4424495064370303 + }, + "flow_consistency": { + "auroc": 0.627889035735381, + "auprc": 0.4371897063500606 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.4453330847607797, + "auprc": 0.34450524627237583 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.4331528795038393, + "auprc": 0.3390443448788761 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.4354207471943296, + "auprc": 0.3402861477551592 + }, + "kinetic_energy": { + "auroc": 0.7079437758417011, + "auprc": 0.6419054369657666 + }, + "kinetic_flow": { + "auroc": 0.7591357279976373, + "auprc": 0.5908490939428378 + }, + "kinetic_packet": { + "auroc": 0.7369563422917897, + "auprc": 0.6508862205677839 + }, + "packet_consistency": { + "auroc": 0.751065409037212, + "auprc": 0.6156003006244727 + }, + "pna_flow": { + "auroc": 0.12610205995274662, + "auprc": 0.25224725478257015 + }, + "pna_packet_max": { + "auroc": 0.4776310248080331, + "auprc": 0.36881117828180965 + }, + "pna_packet_mean": { + "auroc": 0.4453330847607797, + "auprc": 0.34450524627237583 + }, + "pna_packet_median": { + "auroc": 0.4331528795038393, + "auprc": 0.3390443448788761 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.4354207471943296, + "auprc": 0.3402861477551592 + }, + "terminal_flow": { + "auroc": 0.8407436724748966, + "auprc": 0.7496845616736054 + }, + "terminal_norm": { + "auroc": 0.7665288541051387, + "auprc": 0.7198151468167523 + }, + "terminal_packet": { + "auroc": 0.7897897962197283, + "auprc": 0.733265909753062 + }, + "velocity_flow": { + "auroc": 0.7376471352628471, + "auprc": 0.5516418592153491 + }, + "velocity_packet": { + "auroc": 0.8111237448316596, + "auprc": 0.6389897091727041 + }, + "velocity_total": { + "auroc": 0.6851314161252214, + "auprc": 0.602554205379026 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "arc_length": 0.7069968468468468, + "causal_surprisal_flow": 0.7173349849849849, + "causal_surprisal_packet_max": 0.9789273273273273, + "causal_surprisal_packet_mean": 0.9594831831831832, + "causal_surprisal_packet_median": 0.7104347597597598, + "causal_surprisal_packet_trimmed10_mean": 0.8498928678678679, + "causal_surprisal_total": 0.8920292792792791, + "consistency_total": 0.7341996996996997, + "curvature_flow": 0.07574174174174174, + "curvature_packet": 0.5600614864864866, + "curvature_total": 0.5067404654654654, + "direction_drift_flow": 0.5623746996996998, + "direction_drift_packet_max": 0.7928027777777777, + "direction_drift_packet_mean": 0.7639346846846847, + "direction_drift_packet_median": 0.7722418168168168, + "direction_drift_packet_trimmed10_mean": 0.6519672672672672, + "direction_drift_total": 0.8310952702702703, + "flow_consistency": 0.7256057057057056, + "kappa2_speed2norm_packet_mean": 0.4939333333333333, + "kappa2_speed2norm_packet_median": 0.47667567567567565, + "kappa2_speed2norm_packet_trimmed10_mean": 0.44617424924924926, + "kinetic_energy": 0.7170728228228229, + "kinetic_flow": 0.4289842342342343, + "kinetic_packet": 0.8845496996996997, + "packet_consistency": 0.8586830330330332, + "pna_flow": 0.054435060060060055, + "pna_packet_max": 0.49417252252252253, + "pna_packet_mean": 0.4939333333333333, + "pna_packet_median": 0.47667567567567565, + "pna_packet_trimmed10_mean": 0.44617424924924926, + "terminal_flow": 0.6948656906906906, + "terminal_norm": 0.9111572072072073, + "terminal_packet": 0.9326043543543544, + "velocity_flow": 0.42111936936936945, + "velocity_packet": 0.8157436936936937, + "velocity_total": 0.5103732732732733 + }, + "DDoS": { + "_n": 666.0, + "arc_length": 0.8603165915915917, + "causal_surprisal_flow": 0.7124729729729729, + "causal_surprisal_packet_max": 0.6373301801801803, + "causal_surprisal_packet_mean": 0.5298456456456456, + "causal_surprisal_packet_median": 0.23487927927927932, + "causal_surprisal_packet_trimmed10_mean": 0.5079623123123121, + "causal_surprisal_total": 0.6900037537537538, + "consistency_total": 0.7159728228228228, + "curvature_flow": 0.21277274774774774, + "curvature_packet": 0.6330205705705706, + "curvature_total": 0.6042352852852854, + "direction_drift_flow": 0.35350593093093097, + "direction_drift_packet_max": 0.7444890390390391, + "direction_drift_packet_mean": 0.538499099099099, + "direction_drift_packet_median": 0.5672662162162161, + "direction_drift_packet_trimmed10_mean": 0.4572087087087087, + "direction_drift_total": 0.6629563063063064, + "flow_consistency": 0.6887722222222221, + "kappa2_speed2norm_packet_mean": 0.4526635135135135, + "kappa2_speed2norm_packet_median": 0.4687959459459459, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4319961711711712, + "kinetic_energy": 0.861562912912913, + "kinetic_flow": 0.833853003003003, + "kinetic_packet": 0.8999252252252251, + "packet_consistency": 0.9194912912912913, + "pna_flow": 0.05235465465465465, + "pna_packet_max": 0.4872726726726727, + "pna_packet_mean": 0.4526635135135135, + "pna_packet_median": 0.4687959459459459, + "pna_packet_trimmed10_mean": 0.4319961711711712, + "terminal_flow": 0.9853716216216216, + "terminal_norm": 0.9680806306306305, + "terminal_packet": 0.9509615615615614, + "velocity_flow": 0.8332304804804804, + "velocity_packet": 0.9157385885885884, + "velocity_total": 0.7409084084084083 + }, + "DoS GoldenEye": { + "_n": 666.0, + "arc_length": 0.6617075825825824, + "causal_surprisal_flow": 0.7172303303303303, + "causal_surprisal_packet_max": 0.6859710210210209, + "causal_surprisal_packet_mean": 0.592421021021021, + "causal_surprisal_packet_median": 0.27137537537537537, + "causal_surprisal_packet_trimmed10_mean": 0.5568656156156157, + "causal_surprisal_total": 0.6743776276276275, + "consistency_total": 0.6212301801801802, + "curvature_flow": 0.13868228228228227, + "curvature_packet": 0.6708641141141141, + "curvature_total": 0.6394355855855857, + "direction_drift_flow": 0.24888656156156153, + "direction_drift_packet_max": 0.8752436186186188, + "direction_drift_packet_mean": 0.7271252252252252, + "direction_drift_packet_median": 0.7019147897897897, + "direction_drift_packet_trimmed10_mean": 0.6463102102102101, + "direction_drift_total": 0.8291783783783784, + "flow_consistency": 0.622015915915916, + "kappa2_speed2norm_packet_mean": 0.5773938438438438, + "kappa2_speed2norm_packet_median": 0.5590003753753754, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5617622372372373, + "kinetic_energy": 0.6606254504504504, + "kinetic_flow": 0.8754373873873873, + "kinetic_packet": 0.7591208708708708, + "packet_consistency": 0.78532515015015, + "pna_flow": 0.027088288288288284, + "pna_packet_max": 0.6221846096096096, + "pna_packet_mean": 0.5773938438438438, + "pna_packet_median": 0.5590003753753754, + "pna_packet_trimmed10_mean": 0.5617622372372373, + "terminal_flow": 0.9788665165165166, + "terminal_norm": 0.8903682432432433, + "terminal_packet": 0.8773152402402402, + "velocity_flow": 0.8479238738738739, + "velocity_packet": 0.8308172672672673, + "velocity_total": 0.676011111111111 + }, + "DoS Hulk": { + "_n": 666.0, + "arc_length": 0.7160529279279281, + "causal_surprisal_flow": 0.7182890390390391, + "causal_surprisal_packet_max": 0.7211102852852852, + "causal_surprisal_packet_mean": 0.6158963963963964, + "causal_surprisal_packet_median": 0.15398048048048046, + "causal_surprisal_packet_trimmed10_mean": 0.4905555555555555, + "causal_surprisal_total": 0.6938450450450451, + "consistency_total": 0.6006453453453454, + "curvature_flow": 0.43751231231231236, + "curvature_packet": 0.6828487237237236, + "curvature_total": 0.6655065315315316, + "direction_drift_flow": 0.43323783783783787, + "direction_drift_packet_max": 0.891761036036036, + "direction_drift_packet_mean": 0.47303430930930934, + "direction_drift_packet_median": 0.5109627627627628, + "direction_drift_packet_trimmed10_mean": 0.34290848348348346, + "direction_drift_total": 0.6018214714714714, + "flow_consistency": 0.5368148648648648, + "kappa2_speed2norm_packet_mean": 0.5367417417417418, + "kappa2_speed2norm_packet_median": 0.5095472972972973, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4905630630630631, + "kinetic_energy": 0.7141831831831833, + "kinetic_flow": 0.8109915915915916, + "kinetic_packet": 0.8288467717717718, + "packet_consistency": 0.9477167417417417, + "pna_flow": 0.15539264264264263, + "pna_packet_max": 0.6860147147147148, + "pna_packet_mean": 0.5367417417417418, + "pna_packet_median": 0.5095472972972973, + "pna_packet_trimmed10_mean": 0.4905630630630631, + "terminal_flow": 0.8647834084084085, + "terminal_norm": 0.8005481981981982, + "terminal_packet": 0.8533163663663663, + "velocity_flow": 0.8023972222222222, + "velocity_packet": 0.9243388888888889, + "velocity_total": 0.7181876126126127 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "arc_length": 0.8134684684684685, + "causal_surprisal_flow": 0.7127411411411412, + "causal_surprisal_packet_max": 0.6823564564564565, + "causal_surprisal_packet_mean": 0.6240780780780779, + "causal_surprisal_packet_median": 0.45254819819819825, + "causal_surprisal_packet_trimmed10_mean": 0.5861030030030029, + "causal_surprisal_total": 0.7332876126126127, + "consistency_total": 0.5643921921921922, + "curvature_flow": 0.4236100600600601, + "curvature_packet": 0.8111614114114113, + "curvature_total": 0.7795872372372372, + "direction_drift_flow": 0.22379534534534531, + "direction_drift_packet_max": 0.7154987987987987, + "direction_drift_packet_mean": 0.5707393393393393, + "direction_drift_packet_median": 0.5592978228228228, + "direction_drift_packet_trimmed10_mean": 0.5153286786786787, + "direction_drift_total": 0.6405815315315315, + "flow_consistency": 0.565279054054054, + "kappa2_speed2norm_packet_mean": 0.5593506006006006, + "kappa2_speed2norm_packet_median": 0.5543966216216216, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5535691441441442, + "kinetic_energy": 0.8134722972972974, + "kinetic_flow": 0.7152168168168169, + "kinetic_packet": 0.8919378378378379, + "packet_consistency": 0.6662001501501501, + "pna_flow": 0.19396171171171173, + "pna_packet_max": 0.5028923423423424, + "pna_packet_mean": 0.5593506006006006, + "pna_packet_median": 0.5543966216216216, + "pna_packet_trimmed10_mean": 0.5535691441441442, + "terminal_flow": 0.8305987987987988, + "terminal_norm": 0.891956006006006, + "terminal_packet": 0.9157745495495495, + "velocity_flow": 0.7136157657657657, + "velocity_packet": 0.8301308558558558, + "velocity_total": 0.6588965465465466 + }, + "DoS Slowloris": { + "_n": 666.0, + "arc_length": 0.6894987237237238, + "causal_surprisal_flow": 0.5861758258258258, + "causal_surprisal_packet_max": 0.5877782282282282, + "causal_surprisal_packet_mean": 0.5816274774774775, + "causal_surprisal_packet_median": 0.5870261261261261, + "causal_surprisal_packet_trimmed10_mean": 0.5268465465465465, + "causal_surprisal_total": 0.49343888888888887, + "consistency_total": 0.5896481231231232, + "curvature_flow": 0.29113933933933933, + "curvature_packet": 0.6443587087087087, + "curvature_total": 0.6223962462462463, + "direction_drift_flow": 0.23133235735735735, + "direction_drift_packet_max": 0.5300945195195195, + "direction_drift_packet_mean": 0.2868292042042042, + "direction_drift_packet_median": 0.2928147147147147, + "direction_drift_packet_trimmed10_mean": 0.26693903903903904, + "direction_drift_total": 0.24061193693693694, + "flow_consistency": 0.5842231231231232, + "kappa2_speed2norm_packet_mean": 0.4028569069069069, + "kappa2_speed2norm_packet_median": 0.4092390390390391, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4006678678678679, + "kinetic_energy": 0.6877496246246246, + "kinetic_flow": 0.6913845345345344, + "kinetic_packet": 0.7686286786786788, + "packet_consistency": 0.6683208708708709, + "pna_flow": 0.14163243243243243, + "pna_packet_max": 0.36465390390390395, + "pna_packet_mean": 0.4028569069069069, + "pna_packet_median": 0.4092390390390391, + "pna_packet_trimmed10_mean": 0.4006678678678679, + "terminal_flow": 0.8214037537537537, + "terminal_norm": 0.8097485735735737, + "terminal_packet": 0.843272972972973, + "velocity_flow": 0.652116966966967, + "velocity_packet": 0.8341243993993993, + "velocity_total": 0.7303609609609609 + }, + "FTP-Patator": { + "_n": 666.0, + "arc_length": 0.2515534534534535, + "causal_surprisal_flow": 0.8039942942942944, + "causal_surprisal_packet_max": 0.8653749999999999, + "causal_surprisal_packet_mean": 0.6709213213213213, + "causal_surprisal_packet_median": 0.5706082582582582, + "causal_surprisal_packet_trimmed10_mean": 0.6112102102102103, + "causal_surprisal_total": 0.6025083333333333, + "consistency_total": 0.6171055555555557, + "curvature_flow": 0.045550150150150154, + "curvature_packet": 0.40019684684684687, + "curvature_total": 0.4054370870870871, + "direction_drift_flow": 0.35081794294294294, + "direction_drift_packet_max": 0.8919950450450451, + "direction_drift_packet_mean": 0.7399471471471472, + "direction_drift_packet_median": 0.7083955705705707, + "direction_drift_packet_trimmed10_mean": 0.6954425675675675, + "direction_drift_total": 0.8861345345345345, + "flow_consistency": 0.6424618618618619, + "kappa2_speed2norm_packet_mean": 0.624428003003003, + "kappa2_speed2norm_packet_median": 0.5968006756756755, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6231599099099099, + "kinetic_energy": 0.24851156156156157, + "kinetic_flow": 0.8553701951951952, + "kinetic_packet": 0.17310645645645645, + "packet_consistency": 0.30271509009009007, + "pna_flow": 0.017325225225225224, + "pna_packet_max": 0.6874481231231231, + "pna_packet_mean": 0.624428003003003, + "pna_packet_median": 0.5968006756756755, + "pna_packet_trimmed10_mean": 0.6231599099099099, + "terminal_flow": 0.9539951951951952, + "terminal_norm": 0.3673291291291291, + "terminal_packet": 0.42922402402402404, + "velocity_flow": 0.7225051051051051, + "velocity_packet": 0.6360665165165166, + "velocity_total": 0.3606906906906907 + }, + "Heartbleed": { + "_n": 1.0, + "arc_length": 0.9460000000000001, + "causal_surprisal_flow": 0.37639999999999996, + "causal_surprisal_packet_max": 0.9513, + "causal_surprisal_packet_mean": 0.5163, + "causal_surprisal_packet_median": 0.5551999999999999, + "causal_surprisal_packet_trimmed10_mean": 0.4535, + "causal_surprisal_total": 0.01319999999999999, + "consistency_total": 0.9715, + "curvature_flow": 0.7916, + "curvature_packet": 0.5126999999999999, + "curvature_total": 0.5375, + "direction_drift_flow": 0.007399999999999962, + "direction_drift_packet_max": 0.6043000000000001, + "direction_drift_packet_mean": 0.03600000000000003, + "direction_drift_packet_median": 0.07809999999999995, + "direction_drift_packet_trimmed10_mean": 0.041200000000000014, + "direction_drift_total": 0.05389999999999995, + "flow_consistency": 0.9547, + "kappa2_speed2norm_packet_mean": 0.2299, + "kappa2_speed2norm_packet_median": 0.22619999999999996, + "kappa2_speed2norm_packet_trimmed10_mean": 0.22419999999999995, + "kinetic_energy": 0.9429, + "kinetic_flow": 0.9994000000000001, + "kinetic_packet": 0.8068, + "packet_consistency": 0.9828, + "pna_flow": 0.010800000000000032, + "pna_packet_max": 0.5443, + "pna_packet_mean": 0.2299, + "pna_packet_median": 0.22619999999999996, + "pna_packet_trimmed10_mean": 0.22419999999999995, + "terminal_flow": 0.9808000000000001, + "terminal_norm": 0.20640000000000003, + "terminal_packet": 0.2239, + "velocity_flow": 0.9966, + "velocity_packet": 0.9814, + "velocity_total": 0.983 + }, + "Infiltration": { + "_n": 7.0, + "arc_length": 0.8032, + "causal_surprisal_flow": 0.5659285714285713, + "causal_surprisal_packet_max": 0.8587714285714285, + "causal_surprisal_packet_mean": 0.5686285714285714, + "causal_surprisal_packet_median": 0.4946, + "causal_surprisal_packet_trimmed10_mean": 0.4824571428571428, + "causal_surprisal_total": 0.2820857142857142, + "consistency_total": 0.7008714285714286, + "curvature_flow": 0.5549, + "curvature_packet": 0.5474714285714286, + "curvature_total": 0.5542142857142858, + "direction_drift_flow": 0.09718571428571426, + "direction_drift_packet_max": 0.7506857142857142, + "direction_drift_packet_mean": 0.34768571428571426, + "direction_drift_packet_median": 0.4192428571428571, + "direction_drift_packet_trimmed10_mean": 0.35071428571428576, + "direction_drift_total": 0.5500714285714285, + "flow_consistency": 0.6920857142857142, + "kappa2_speed2norm_packet_mean": 0.4644, + "kappa2_speed2norm_packet_median": 0.4397, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4546857142857143, + "kinetic_energy": 0.8031142857142857, + "kinetic_flow": 0.9414142857142858, + "kinetic_packet": 0.7394285714285714, + "packet_consistency": 0.7669428571428571, + "pna_flow": 0.024242857142857153, + "pna_packet_max": 0.6624428571428571, + "pna_packet_mean": 0.4644, + "pna_packet_median": 0.4397, + "pna_packet_trimmed10_mean": 0.4546857142857143, + "terminal_flow": 0.8963714285714285, + "terminal_norm": 0.5676428571428571, + "terminal_packet": 0.7421571428571428, + "velocity_flow": 0.8970571428571429, + "velocity_packet": 0.8155428571428571, + "velocity_total": 0.7994714285714286 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "arc_length": 0.9902692192192193, + "causal_surprisal_flow": 0.028404804804804805, + "causal_surprisal_packet_max": 0.16737117117117117, + "causal_surprisal_packet_mean": 0.1329731981981982, + "causal_surprisal_packet_median": 0.09976576576576576, + "causal_surprisal_packet_trimmed10_mean": 0.20058963963963966, + "causal_surprisal_total": 0.03590465465465466, + "consistency_total": 0.6500403903903903, + "curvature_flow": 0.5221018768768768, + "curvature_packet": 0.36298888888888886, + "curvature_total": 0.39121261261261264, + "direction_drift_flow": 0.1411888888888889, + "direction_drift_packet_max": 0.11565105105105106, + "direction_drift_packet_mean": 0.12091426426426427, + "direction_drift_packet_median": 0.17414084084084083, + "direction_drift_packet_trimmed10_mean": 0.13553423423423422, + "direction_drift_total": 0.06193873873873874, + "flow_consistency": 0.6333018018018018, + "kappa2_speed2norm_packet_mean": 0.20155075075075074, + "kappa2_speed2norm_packet_median": 0.1441318318318318, + "kappa2_speed2norm_packet_trimmed10_mean": 0.21109459459459456, + "kinetic_energy": 0.9903842342342343, + "kinetic_flow": 0.7027722222222222, + "kinetic_packet": 0.949787987987988, + "packet_consistency": 0.9071894144144145, + "pna_flow": 0.2500201201201201, + "pna_packet_max": 0.24603363363363367, + "pna_packet_mean": 0.20155075075075074, + "pna_packet_median": 0.1441318318318318, + "pna_packet_trimmed10_mean": 0.21109459459459456, + "terminal_flow": 0.9423046546546545, + "terminal_norm": 0.9902288288288287, + "terminal_packet": 0.98123003003003, + "velocity_flow": 0.7067581831831832, + "velocity_packet": 0.7945060060060062, + "velocity_total": 0.9824588588588588 + }, + "Portscan": { + "_n": 666.0, + "arc_length": 0.9951740240240241, + "causal_surprisal_flow": 0.016575975975975977, + "causal_surprisal_packet_max": 0.019809309309309308, + "causal_surprisal_packet_mean": 0.02059549549549551, + "causal_surprisal_packet_median": 0.04531126126126126, + "causal_surprisal_packet_trimmed10_mean": 0.024363363363363366, + "causal_surprisal_total": 0.02615780780780782, + "consistency_total": 0.6441256756756757, + "curvature_flow": 0.6024292792792794, + "curvature_packet": 0.325503003003003, + "curvature_total": 0.39375052552552553, + "direction_drift_flow": 0.11174286786786787, + "direction_drift_packet_max": 0.038029804804804807, + "direction_drift_packet_mean": 0.05640285285285285, + "direction_drift_packet_median": 0.07650720720720722, + "direction_drift_packet_trimmed10_mean": 0.06851771771771772, + "direction_drift_total": 0.01855750750750751, + "flow_consistency": 0.6084466966966967, + "kappa2_speed2norm_packet_mean": 0.08982297297297298, + "kappa2_speed2norm_packet_median": 0.09417822822822823, + "kappa2_speed2norm_packet_trimmed10_mean": 0.09448423423423424, + "kinetic_energy": 0.995106906906907, + "kinetic_flow": 0.6780518018018017, + "kinetic_packet": 0.9676503003003004, + "packet_consistency": 0.9484792792792792, + "pna_flow": 0.320139039039039, + "pna_packet_max": 0.13007132132132132, + "pna_packet_mean": 0.08982297297297298, + "pna_packet_median": 0.09417822822822823, + "pna_packet_trimmed10_mean": 0.09448423423423424, + "terminal_flow": 0.7658554804804805, + "terminal_norm": 0.9924213213213212, + "terminal_packet": 0.9940891891891892, + "velocity_flow": 0.6911768768768769, + "velocity_packet": 0.812824024024024, + "velocity_total": 0.9943177177177177 + }, + "SSH-Patator": { + "_n": 666.0, + "arc_length": 0.37338378378378373, + "causal_surprisal_flow": 0.992203003003003, + "causal_surprisal_packet_max": 0.8955265765765765, + "causal_surprisal_packet_mean": 0.5309097597597597, + "causal_surprisal_packet_median": 0.324693993993994, + "causal_surprisal_packet_trimmed10_mean": 0.424934984984985, + "causal_surprisal_total": 0.6580620870870871, + "consistency_total": 0.7297573573573573, + "curvature_flow": 0.8360481981981982, + "curvature_packet": 0.4454072072072072, + "curvature_total": 0.4784605105105105, + "direction_drift_flow": 0.05792890390390391, + "direction_drift_packet_max": 0.640459009009009, + "direction_drift_packet_mean": 0.21342237237237238, + "direction_drift_packet_median": 0.2709506006006006, + "direction_drift_packet_trimmed10_mean": 0.2442873873873874, + "direction_drift_total": 0.45677004504504504, + "flow_consistency": 0.7380852852852853, + "kappa2_speed2norm_packet_mean": 0.5505804804804805, + "kappa2_speed2norm_packet_median": 0.5533880630630631, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5760469969969971, + "kinetic_energy": 0.3704366366366366, + "kinetic_flow": 0.9661639639639639, + "kinetic_packet": 0.2588186936936937, + "packet_consistency": 0.47783791291291294, + "pna_flow": 0.06760765765765765, + "pna_packet_max": 0.575754054054054, + "pna_packet_mean": 0.5505804804804805, + "pna_packet_median": 0.5533880630630631, + "pna_packet_trimmed10_mean": 0.5760469969969971, + "terminal_flow": 0.5568917417417416, + "terminal_norm": 0.1294518018018018, + "terminal_packet": 0.201781981981982, + "velocity_flow": 0.9506617117117118, + "velocity_packet": 0.6937998498498499, + "velocity_total": 0.4380078078078078 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "arc_length": 0.8481712328767121, + "causal_surprisal_flow": 0.41205616438356163, + "causal_surprisal_packet_max": 0.9664465753424657, + "causal_surprisal_packet_mean": 0.597431506849315, + "causal_surprisal_packet_median": 0.4089479452054795, + "causal_surprisal_packet_trimmed10_mean": 0.3804835616438356, + "causal_surprisal_total": 0.031541095890410965, + "consistency_total": 0.3696541095890411, + "curvature_flow": 0.4580958904109589, + "curvature_packet": 0.4387027397260274, + "curvature_total": 0.45890958904109586, + "direction_drift_flow": 0.006586986301369856, + "direction_drift_packet_max": 0.29345068493150683, + "direction_drift_packet_mean": 0.006319178082191779, + "direction_drift_packet_median": 0.01441917808219179, + "direction_drift_packet_trimmed10_mean": 0.0064109589041095915, + "direction_drift_total": 0.009694520547945205, + "flow_consistency": 0.14060958904109588, + "kappa2_speed2norm_packet_mean": 0.168672602739726, + "kappa2_speed2norm_packet_median": 0.17653150684931507, + "kappa2_speed2norm_packet_trimmed10_mean": 0.17010958904109588, + "kinetic_energy": 0.8410342465753424, + "kinetic_flow": 0.9986904109589041, + "kinetic_packet": 0.6205595890410959, + "packet_consistency": 0.9435315068493151, + "pna_flow": 0.007152054794520593, + "pna_packet_max": 0.2952123287671233, + "pna_packet_mean": 0.168672602739726, + "pna_packet_median": 0.17653150684931507, + "pna_packet_trimmed10_mean": 0.17010958904109588, + "terminal_flow": 0.9057616438356165, + "terminal_norm": 0.1384945205479452, + "terminal_packet": 0.19100410958904107, + "velocity_flow": 0.9974, + "velocity_packet": 0.9697630136986303, + "velocity_total": 0.9741287671232877 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "arc_length": 0.7073307692307692, + "causal_surprisal_flow": 0.7388538461538462, + "causal_surprisal_packet_max": 0.7009769230769232, + "causal_surprisal_packet_mean": 0.5924384615384616, + "causal_surprisal_packet_median": 0.15633076923076925, + "causal_surprisal_packet_trimmed10_mean": 0.5203692307692307, + "causal_surprisal_total": 0.9118615384615385, + "consistency_total": 0.6380846153846154, + "curvature_flow": 0.13243076923076924, + "curvature_packet": 0.7197692307692307, + "curvature_total": 0.6663538461538462, + "direction_drift_flow": 0.5186923076923077, + "direction_drift_packet_max": 0.9299846153846154, + "direction_drift_packet_mean": 0.8170923076923077, + "direction_drift_packet_median": 0.8575846153846154, + "direction_drift_packet_trimmed10_mean": 0.6710230769230769, + "direction_drift_total": 0.8777615384615385, + "flow_consistency": 0.6408076923076922, + "kappa2_speed2norm_packet_mean": 0.6200076923076923, + "kappa2_speed2norm_packet_median": 0.595, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5802076923076923, + "kinetic_energy": 0.7073692307692308, + "kinetic_flow": 0.6615230769230769, + "kinetic_packet": 0.8407923076923077, + "packet_consistency": 0.8086461538461538, + "pna_flow": 0.05436153846153846, + "pna_packet_max": 0.6038769230769231, + "pna_packet_mean": 0.6200076923076923, + "pna_packet_median": 0.595, + "pna_packet_trimmed10_mean": 0.5802076923076923, + "terminal_flow": 0.9502538461538461, + "terminal_norm": 0.9214384615384617, + "terminal_packet": 0.8957999999999999, + "velocity_flow": 0.6040461538461539, + "velocity_packet": 0.8420769230769231, + "velocity_total": 0.6625769230769231 + }, + "Web Attack - XSS": { + "_n": 18.0, + "arc_length": 0.8776, + "causal_surprisal_flow": 0.38327222222222224, + "causal_surprisal_packet_max": 0.9569111111111112, + "causal_surprisal_packet_mean": 0.56845, + "causal_surprisal_packet_median": 0.4772388888888889, + "causal_surprisal_packet_trimmed10_mean": 0.38085, + "causal_surprisal_total": 0.0157611111111111, + "consistency_total": 0.43174999999999997, + "curvature_flow": 0.5076222222222223, + "curvature_packet": 0.33405555555555555, + "curvature_total": 0.3654222222222222, + "direction_drift_flow": 0.005322222222222197, + "direction_drift_packet_max": 0.32285555555555556, + "direction_drift_packet_mean": 0.004544444444444425, + "direction_drift_packet_median": 0.00660555555555555, + "direction_drift_packet_trimmed10_mean": 0.004211111111111091, + "direction_drift_total": 0.007577777777777757, + "flow_consistency": 0.10532777777777778, + "kappa2_speed2norm_packet_mean": 0.11406666666666668, + "kappa2_speed2norm_packet_median": 0.08483333333333334, + "kappa2_speed2norm_packet_trimmed10_mean": 0.10457222222222223, + "kinetic_energy": 0.8708277777777778, + "kinetic_flow": 0.9997388888888888, + "kinetic_packet": 0.6552388888888889, + "packet_consistency": 0.9715944444444444, + "pna_flow": 0.005700000000000038, + "pna_packet_max": 0.3037444444444445, + "pna_packet_mean": 0.11406666666666668, + "pna_packet_median": 0.08483333333333334, + "pna_packet_trimmed10_mean": 0.10457222222222223, + "terminal_flow": 0.93105, + "terminal_norm": 0.1280888888888889, + "terminal_packet": 0.16972222222222222, + "velocity_flow": 0.99805, + "velocity_packet": 0.9906722222222223, + "velocity_total": 0.9891055555555556 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/baseline_seed43_to_cicids2017.log b/artifacts/route_comparison/cross/baseline_seed43_to_cicids2017.log new file mode 100644 index 0000000..d9f4df6 --- /dev/null +++ b/artifacts/route_comparison/cross/baseline_seed43_to_cicids2017.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 2,025,564 target rows; label distribution top: + normal 1,521,748 + Portscan 159,040 + DoS Hulk 158,454 + DDoS 95,144 + Infiltration - Portscan 71,714 +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 19.8s +[eval] scoring attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done in 13.5s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/baseline_seed43_to_cicids2017.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/baseline_seed43_to_cicids2017.npz + +=== overall AUROC top-10 === + terminal_flow AUROC=0.8407 AUPRC=0.7497 + velocity_packet AUROC=0.8111 AUPRC=0.6390 + terminal_packet AUROC=0.7898 AUPRC=0.7333 + terminal_norm AUROC=0.7665 AUPRC=0.7198 + kinetic_flow AUROC=0.7591 AUPRC=0.5908 + packet_consistency AUROC=0.7511 AUPRC=0.6156 + velocity_flow AUROC=0.7376 AUPRC=0.5516 + kinetic_packet AUROC=0.7370 AUPRC=0.6509 + arc_length AUROC=0.7080 AUPRC=0.6418 + kinetic_energy AUROC=0.7079 AUPRC=0.6419 diff --git a/artifacts/route_comparison/cross/baseline_seed43_to_cicids2017.npz b/artifacts/route_comparison/cross/baseline_seed43_to_cicids2017.npz new file mode 100644 index 0000000..8ffc21d Binary files /dev/null and b/artifacts/route_comparison/cross/baseline_seed43_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/baseline_seed44_to_cicddos2019.json b/artifacts/route_comparison/cross/baseline_seed44_to_cicddos2019.json new file mode 100644 index 0000000..a9504ac --- /dev/null +++ b/artifacts/route_comparison/cross/baseline_seed44_to_cicddos2019.json @@ -0,0 +1,818 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.8867624923826933, + "auprc": 0.9041573622334986 + }, + "causal_surprisal_flow": { + "auroc": 0.31506808856388385, + "auprc": 0.3745649481684632 + }, + "causal_surprisal_packet_max": { + "auroc": 0.27164233698964046, + "auprc": 0.3649185818756798 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.23454449014828355, + "auprc": 0.35294912999319006 + }, + "causal_surprisal_packet_median": { + "auroc": 0.24239034633353648, + "auprc": 0.35320433217261166 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.2287956682916921, + "auprc": 0.35173254739822274 + }, + "causal_surprisal_total": { + "auroc": 0.3064685659150925, + "auprc": 0.3726736501336373 + }, + "consistency_total": { + "auroc": 0.7729119490148284, + "auprc": 0.6882371997917422 + }, + "curvature_flow": { + "auroc": 0.3128977401990656, + "auprc": 0.3744158997613049 + }, + "curvature_packet": { + "auroc": 0.6072890920170627, + "auprc": 0.5375188779711481 + }, + "curvature_total": { + "auroc": 0.4420982429412959, + "auprc": 0.43407897458059963 + }, + "direction_drift_flow": { + "auroc": 0.3619694698354662, + "auprc": 0.3931268813154801 + }, + "direction_drift_packet_max": { + "auroc": 0.25754026000406255, + "auprc": 0.35596162161073264 + }, + "direction_drift_packet_mean": { + "auroc": 0.26807279605931345, + "auprc": 0.35965244263583085 + }, + "direction_drift_packet_median": { + "auroc": 0.2801047582774731, + "auprc": 0.36412752711926266 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.2735107607150111, + "auprc": 0.36176133812858613 + }, + "direction_drift_total": { + "auroc": 0.19862774223034735, + "auprc": 0.33981554011745074 + }, + "flow_consistency": { + "auroc": 0.7759223440991265, + "auprc": 0.7202890963889963 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.2778763812715824, + "auprc": 0.36647603621995667 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.2856928498882795, + "auprc": 0.36824990938524627 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.28191644830387974, + "auprc": 0.36703509087973124 + }, + "kinetic_energy": { + "auroc": 0.8868181952061751, + "auprc": 0.9043498113408589 + }, + "kinetic_flow": { + "auroc": 0.8006327493398335, + "auprc": 0.6943618253215931 + }, + "kinetic_packet": { + "auroc": 0.7777482023156611, + "auprc": 0.7440029978898662 + }, + "packet_consistency": { + "auroc": 0.495939036156815, + "auprc": 0.48192742459279286 + }, + "pna_flow": { + "auroc": 0.1700121673776153, + "auprc": 0.333252136543686 + }, + "pna_packet_max": { + "auroc": 0.2610434694292098, + "auprc": 0.3692449619016188 + }, + "pna_packet_mean": { + "auroc": 0.2778763812715824, + "auprc": 0.36647603621995667 + }, + "pna_packet_median": { + "auroc": 0.2856928498882795, + "auprc": 0.36824990938524627 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.28191644830387974, + "auprc": 0.36703509087973124 + }, + "terminal_flow": { + "auroc": 0.6869265437741215, + "auprc": 0.6266148790817085 + }, + "terminal_norm": { + "auroc": 0.7175831403615681, + "auprc": 0.6755835270808468 + }, + "terminal_packet": { + "auroc": 0.620713817794028, + "auprc": 0.633907850980495 + }, + "velocity_flow": { + "auroc": 0.7343444139752183, + "auprc": 0.6258348215433147 + }, + "velocity_packet": { + "auroc": 0.7493401482835669, + "auprc": 0.6867835471375802 + }, + "velocity_total": { + "auroc": 0.9006121419865933, + "auprc": 0.9088447988194888 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "arc_length": 0.9971642857142857, + "causal_surprisal_flow": 0.2821119047619048, + "causal_surprisal_packet_max": 0.2510464285714286, + "causal_surprisal_packet_mean": 0.24854574829931975, + "causal_surprisal_packet_median": 0.31976887755102035, + "causal_surprisal_packet_trimmed10_mean": 0.2543544217687075, + "causal_surprisal_total": 0.29749404761904763, + "consistency_total": 0.7771280612244897, + "curvature_flow": 0.1929595238095238, + "curvature_packet": 0.7852811224489796, + "curvature_total": 0.5381964285714286, + "direction_drift_flow": 0.4216358843537415, + "direction_drift_packet_max": 0.11063996598639456, + "direction_drift_packet_mean": 0.0946702380952381, + "direction_drift_packet_median": 0.10502032312925169, + "direction_drift_packet_trimmed10_mean": 0.1008515306122449, + "direction_drift_total": 0.08030697278911564, + "flow_consistency": 0.7810295918367346, + "kappa2_speed2norm_packet_mean": 0.20129574829931973, + "kappa2_speed2norm_packet_median": 0.21746768707482994, + "kappa2_speed2norm_packet_trimmed10_mean": 0.21538945578231292, + "kinetic_energy": 0.997262074829932, + "kinetic_flow": 0.8905554421768708, + "kinetic_packet": 0.9518877551020407, + "packet_consistency": 0.6755493197278911, + "pna_flow": 0.11626377551020409, + "pna_packet_max": 0.1890156462585034, + "pna_packet_mean": 0.20129574829931973, + "pna_packet_median": 0.21746768707482994, + "pna_packet_trimmed10_mean": 0.21538945578231292, + "terminal_flow": 0.8836933673469388, + "terminal_norm": 0.9367971088435374, + "terminal_packet": 0.9058921768707482, + "velocity_flow": 0.6510061224489796, + "velocity_packet": 0.9212531462585034, + "velocity_total": 0.9905645408163265 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "arc_length": 0.9976714285714287, + "causal_surprisal_flow": 0.282687074829932, + "causal_surprisal_packet_max": 0.2542663265306122, + "causal_surprisal_packet_mean": 0.2520880952380952, + "causal_surprisal_packet_median": 0.32789625850340137, + "causal_surprisal_packet_trimmed10_mean": 0.25832006802721086, + "causal_surprisal_total": 0.29750663265306126, + "consistency_total": 0.7710417517006802, + "curvature_flow": 0.19097517006802725, + "curvature_packet": 0.8047816326530611, + "curvature_total": 0.5607182823129252, + "direction_drift_flow": 0.4370900510204082, + "direction_drift_packet_max": 0.09967499999999999, + "direction_drift_packet_mean": 0.07548180272108844, + "direction_drift_packet_median": 0.08443392857142856, + "direction_drift_packet_trimmed10_mean": 0.08056326530612246, + "direction_drift_total": 0.07120892857142858, + "flow_consistency": 0.7732811224489798, + "kappa2_speed2norm_packet_mean": 0.19792074829931977, + "kappa2_speed2norm_packet_median": 0.21392534013605444, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2118797619047619, + "kinetic_energy": 0.9977663265306123, + "kinetic_flow": 0.8945988095238095, + "kinetic_packet": 0.9650011904761906, + "packet_consistency": 0.7075168367346939, + "pna_flow": 0.11623214285714287, + "pna_packet_max": 0.18614438775510206, + "pna_packet_mean": 0.19792074829931977, + "pna_packet_median": 0.21392534013605444, + "pna_packet_trimmed10_mean": 0.2118797619047619, + "terminal_flow": 0.8975219387755102, + "terminal_norm": 0.9483683673469389, + "terminal_packet": 0.9322277210884354, + "velocity_flow": 0.6279780612244897, + "velocity_packet": 0.9436193877551022, + "velocity_total": 0.9932943877551019 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "arc_length": 0.988625, + "causal_surprisal_flow": 0.29080765306122447, + "causal_surprisal_packet_max": 0.23607585034013606, + "causal_surprisal_packet_mean": 0.22621479591836735, + "causal_surprisal_packet_median": 0.2523559523809524, + "causal_surprisal_packet_trimmed10_mean": 0.22787074829931972, + "causal_surprisal_total": 0.31481224489795917, + "consistency_total": 0.8877867346938776, + "curvature_flow": 0.20201564625850338, + "curvature_packet": 0.6068511904761904, + "curvature_total": 0.3353800170068027, + "direction_drift_flow": 0.43753954081632657, + "direction_drift_packet_max": 0.252606462585034, + "direction_drift_packet_mean": 0.37029217687074834, + "direction_drift_packet_median": 0.4005432823129252, + "direction_drift_packet_trimmed10_mean": 0.39324838435374154, + "direction_drift_total": 0.2147675170068027, + "flow_consistency": 0.9052943877551021, + "kappa2_speed2norm_packet_mean": 0.34122695578231294, + "kappa2_speed2norm_packet_median": 0.3638585034013605, + "kappa2_speed2norm_packet_trimmed10_mean": 0.36265484693877553, + "kinetic_energy": 0.9888386054421768, + "kinetic_flow": 0.894382993197279, + "kinetic_packet": 0.8091566326530615, + "packet_consistency": 0.33860663265306123, + "pna_flow": 0.10806615646258504, + "pna_packet_max": 0.22257448979591837, + "pna_packet_mean": 0.34122695578231294, + "pna_packet_median": 0.3638585034013605, + "pna_packet_trimmed10_mean": 0.36265484693877553, + "terminal_flow": 0.7781037414965987, + "terminal_norm": 0.8572489795918368, + "terminal_packet": 0.6040875850340135, + "velocity_flow": 0.8517187074829933, + "velocity_packet": 0.6695535714285713, + "velocity_total": 0.9901181972789116 + }, + "DrDoS_NTP": { + "_n": 588.0, + "arc_length": 0.6588973639455782, + "causal_surprisal_flow": 0.7149105442176871, + "causal_surprisal_packet_max": 0.7892095238095237, + "causal_surprisal_packet_mean": 0.33700739795918366, + "causal_surprisal_packet_median": 0.23350620748299322, + "causal_surprisal_packet_trimmed10_mean": 0.2726443027210884, + "causal_surprisal_total": 0.3647318027210884, + "consistency_total": 0.8207231292517007, + "curvature_flow": 0.6884755102040816, + "curvature_packet": 0.8534117346938775, + "curvature_total": 0.8414736394557824, + "direction_drift_flow": 0.12861743197278913, + "direction_drift_packet_max": 0.7122377551020409, + "direction_drift_packet_mean": 0.28458010204081635, + "direction_drift_packet_median": 0.2563418367346939, + "direction_drift_packet_trimmed10_mean": 0.24919166666666664, + "direction_drift_total": 0.40903775510204077, + "flow_consistency": 0.8208586734693877, + "kappa2_speed2norm_packet_mean": 0.6834635204081632, + "kappa2_speed2norm_packet_median": 0.6095947278911565, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6334511904761905, + "kinetic_energy": 0.6623177721088436, + "kinetic_flow": 0.9116841836734695, + "kinetic_packet": 0.8546017857142857, + "packet_consistency": 0.7630416666666666, + "pna_flow": 0.17627431972789115, + "pna_packet_max": 0.8362930272108843, + "pna_packet_mean": 0.6834635204081632, + "pna_packet_median": 0.6095947278911565, + "pna_packet_trimmed10_mean": 0.6334511904761905, + "terminal_flow": 0.7902416666666667, + "terminal_norm": 0.5563931972789116, + "terminal_packet": 0.5445201530612244, + "velocity_flow": 0.9163988095238095, + "velocity_packet": 0.9254243197278912, + "velocity_total": 0.6514860544217687 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "arc_length": 0.9758089285714284, + "causal_surprisal_flow": 0.2684761904761905, + "causal_surprisal_packet_max": 0.18738537414965983, + "causal_surprisal_packet_mean": 0.17382431972789117, + "causal_surprisal_packet_median": 0.18139489795918368, + "causal_surprisal_packet_trimmed10_mean": 0.17392431972789116, + "causal_surprisal_total": 0.28378299319727884, + "consistency_total": 0.9321176020408163, + "curvature_flow": 0.37771190476190475, + "curvature_packet": 0.4714931122448979, + "curvature_total": 0.3486213435374149, + "direction_drift_flow": 0.33859277210884353, + "direction_drift_packet_max": 0.2371777210884354, + "direction_drift_packet_mean": 0.4222362244897959, + "direction_drift_packet_median": 0.4564295068027211, + "direction_drift_packet_trimmed10_mean": 0.44822448979591833, + "direction_drift_total": 0.2351812925170068, + "flow_consistency": 0.9605931972789115, + "kappa2_speed2norm_packet_mean": 0.24329651360544222, + "kappa2_speed2norm_packet_median": 0.26302933673469386, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2608941326530613, + "kinetic_energy": 0.9757559523809525, + "kinetic_flow": 0.889439455782313, + "kinetic_packet": 0.6495651360544217, + "packet_consistency": 0.14864353741496597, + "pna_flow": 0.15567363945578233, + "pna_packet_max": 0.13622789115646258, + "pna_packet_mean": 0.24329651360544222, + "pna_packet_median": 0.26302933673469386, + "pna_packet_trimmed10_mean": 0.2608941326530613, + "terminal_flow": 0.567888180272109, + "terminal_norm": 0.5856533163265306, + "terminal_packet": 0.39542346938775513, + "velocity_flow": 0.8761501700680271, + "velocity_packet": 0.522381462585034, + "velocity_total": 0.9903867346938775 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "arc_length": 0.9990210884353742, + "causal_surprisal_flow": 0.28224132653061224, + "causal_surprisal_packet_max": 0.25053180272108844, + "causal_surprisal_packet_mean": 0.248187925170068, + "causal_surprisal_packet_median": 0.3191502551020408, + "causal_surprisal_packet_trimmed10_mean": 0.25416751700680273, + "causal_surprisal_total": 0.2973312925170068, + "consistency_total": 0.7808690476190475, + "curvature_flow": 0.20327295918367347, + "curvature_packet": 0.7738263605442177, + "curvature_total": 0.532637074829932, + "direction_drift_flow": 0.4302505102040816, + "direction_drift_packet_max": 0.10444872448979592, + "direction_drift_packet_mean": 0.09094829931972788, + "direction_drift_packet_median": 0.10106700680272108, + "direction_drift_packet_trimmed10_mean": 0.09698401360544218, + "direction_drift_total": 0.0781937074829932, + "flow_consistency": 0.7841035714285715, + "kappa2_speed2norm_packet_mean": 0.1823780612244898, + "kappa2_speed2norm_packet_median": 0.19763962585034012, + "kappa2_speed2norm_packet_trimmed10_mean": 0.1953028911564626, + "kinetic_energy": 0.999084693877551, + "kinetic_flow": 0.9008052721088435, + "kinetic_packet": 0.9496111394557823, + "packet_consistency": 0.6811147959183673, + "pna_flow": 0.11784319727891157, + "pna_packet_max": 0.17112261904761905, + "pna_packet_mean": 0.1823780612244898, + "pna_packet_median": 0.19763962585034012, + "pna_packet_trimmed10_mean": 0.1953028911564626, + "terminal_flow": 0.8761103741496598, + "terminal_norm": 0.9278613095238096, + "terminal_packet": 0.9023732993197281, + "velocity_flow": 0.6345251700680272, + "velocity_packet": 0.9246256802721089, + "velocity_total": 0.9983710884353741 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "arc_length": 0.7340109693877552, + "causal_surprisal_flow": 0.32600561224489794, + "causal_surprisal_packet_max": 0.2689474489795919, + "causal_surprisal_packet_mean": 0.23692414965986397, + "causal_surprisal_packet_median": 0.20763792517006804, + "causal_surprisal_packet_trimmed10_mean": 0.2240363945578231, + "causal_surprisal_total": 0.34623622448979596, + "consistency_total": 0.6033006802721088, + "curvature_flow": 0.2671579931972789, + "curvature_packet": 0.4673638605442177, + "curvature_total": 0.2839345238095238, + "direction_drift_flow": 0.28391173469387754, + "direction_drift_packet_max": 0.32380824829931976, + "direction_drift_packet_mean": 0.3377169217687075, + "direction_drift_packet_median": 0.3450511904761905, + "direction_drift_packet_trimmed10_mean": 0.33226913265306124, + "direction_drift_total": 0.2486809523809524, + "flow_consistency": 0.5873469387755103, + "kappa2_speed2norm_packet_mean": 0.23508613945578233, + "kappa2_speed2norm_packet_median": 0.24601496598639458, + "kappa2_speed2norm_packet_trimmed10_mean": 0.23110306122448976, + "kinetic_energy": 0.7334948979591838, + "kinetic_flow": 0.6973736394557823, + "kinetic_packet": 0.6025034013605441, + "packet_consistency": 0.339103231292517, + "pna_flow": 0.2323612244897959, + "pna_packet_max": 0.23939132653061224, + "pna_packet_mean": 0.23508613945578233, + "pna_packet_median": 0.24601496598639458, + "pna_packet_trimmed10_mean": 0.23110306122448976, + "terminal_flow": 0.3903401360544218, + "terminal_norm": 0.4281054421768707, + "terminal_packet": 0.34759115646258504, + "velocity_flow": 0.7252289115646259, + "velocity_packet": 0.6926833333333333, + "velocity_total": 0.8309018707482992 + }, + "DrDoS_UDP": { + "_n": 588.0, + "arc_length": 0.7368607993197278, + "causal_surprisal_flow": 0.326278231292517, + "causal_surprisal_packet_max": 0.26555442176870747, + "causal_surprisal_packet_mean": 0.23589574829931972, + "causal_surprisal_packet_median": 0.20803384353741497, + "causal_surprisal_packet_trimmed10_mean": 0.2307828231292517, + "causal_surprisal_total": 0.34741037414965986, + "consistency_total": 0.6004062925170068, + "curvature_flow": 0.2629511904761905, + "curvature_packet": 0.4708068027210884, + "curvature_total": 0.27762423469387754, + "direction_drift_flow": 0.2824073129251701, + "direction_drift_packet_max": 0.3027982993197279, + "direction_drift_packet_mean": 0.3314003401360544, + "direction_drift_packet_median": 0.34125416666666664, + "direction_drift_packet_trimmed10_mean": 0.3337081632653061, + "direction_drift_total": 0.2396375850340136, + "flow_consistency": 0.5877437074829932, + "kappa2_speed2norm_packet_mean": 0.23909914965986395, + "kappa2_speed2norm_packet_median": 0.25033809523809525, + "kappa2_speed2norm_packet_trimmed10_mean": 0.24032006802721087, + "kinetic_energy": 0.7362132653061224, + "kinetic_flow": 0.6941874149659863, + "kinetic_packet": 0.6104427721088436, + "packet_consistency": 0.32472712585034014, + "pna_flow": 0.2235511904761905, + "pna_packet_max": 0.23622517006802718, + "pna_packet_mean": 0.23909914965986395, + "pna_packet_median": 0.25033809523809525, + "pna_packet_trimmed10_mean": 0.24032006802721087, + "terminal_flow": 0.3800996598639456, + "terminal_norm": 0.42274574829931977, + "terminal_packet": 0.33987976190476193, + "velocity_flow": 0.7282775510204081, + "velocity_packet": 0.6932896258503402, + "velocity_total": 0.8308340136054422 + }, + "LDAP": { + "_n": 588.0, + "arc_length": 0.9980687925170069, + "causal_surprisal_flow": 0.28243350340136053, + "causal_surprisal_packet_max": 0.2534409863945578, + "causal_surprisal_packet_mean": 0.25159897959183675, + "causal_surprisal_packet_median": 0.32625646258503405, + "causal_surprisal_packet_trimmed10_mean": 0.25815204081632653, + "causal_surprisal_total": 0.29687431972789113, + "consistency_total": 0.776153231292517, + "curvature_flow": 0.19478715986394557, + "curvature_packet": 0.8035965986394559, + "curvature_total": 0.5635945578231293, + "direction_drift_flow": 0.468116156462585, + "direction_drift_packet_max": 0.10547431972789115, + "direction_drift_packet_mean": 0.08177627551020408, + "direction_drift_packet_median": 0.09135212585034014, + "direction_drift_packet_trimmed10_mean": 0.08735297619047619, + "direction_drift_total": 0.07582602040816327, + "flow_consistency": 0.7783688775510204, + "kappa2_speed2norm_packet_mean": 0.20606326530612246, + "kappa2_speed2norm_packet_median": 0.22237049319727892, + "kappa2_speed2norm_packet_trimmed10_mean": 0.22041768707482992, + "kinetic_energy": 0.9981850340136055, + "kinetic_flow": 0.8933727040816327, + "kinetic_packet": 0.965714455782313, + "packet_consistency": 0.7088847789115647, + "pna_flow": 0.11845136054421769, + "pna_packet_max": 0.19537202380952381, + "pna_packet_mean": 0.20606326530612246, + "pna_packet_median": 0.22237049319727892, + "pna_packet_trimmed10_mean": 0.22041768707482992, + "terminal_flow": 0.9027292517006803, + "terminal_norm": 0.9519110544217688, + "terminal_packet": 0.9368785714285713, + "velocity_flow": 0.6065949829931973, + "velocity_packet": 0.9417972789115646, + "velocity_total": 0.9929794217687075 + }, + "MSSQL": { + "_n": 588.0, + "arc_length": 0.9864273809523809, + "causal_surprisal_flow": 0.29218979591836736, + "causal_surprisal_packet_max": 0.23586037414965985, + "causal_surprisal_packet_mean": 0.22583367346938776, + "causal_surprisal_packet_median": 0.25123375850340135, + "causal_surprisal_packet_trimmed10_mean": 0.22735119047619048, + "causal_surprisal_total": 0.3179743197278912, + "consistency_total": 0.888043962585034, + "curvature_flow": 0.2099724489795918, + "curvature_packet": 0.5948409863945577, + "curvature_total": 0.3242525510204082, + "direction_drift_flow": 0.4224137755102041, + "direction_drift_packet_max": 0.24621802721088434, + "direction_drift_packet_mean": 0.35435340136054416, + "direction_drift_packet_median": 0.3856447278911565, + "direction_drift_packet_trimmed10_mean": 0.37770340136054414, + "direction_drift_total": 0.21055884353741494, + "flow_consistency": 0.9058120748299321, + "kappa2_speed2norm_packet_mean": 0.32737193877551013, + "kappa2_speed2norm_packet_median": 0.3495172619047619, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3483369047619047, + "kinetic_energy": 0.9865732142857143, + "kinetic_flow": 0.8933212585034015, + "kinetic_packet": 0.8035246598639455, + "packet_consistency": 0.3284360544217687, + "pna_flow": 0.10860323129251702, + "pna_packet_max": 0.21642704081632652, + "pna_packet_mean": 0.32737193877551013, + "pna_packet_median": 0.3495172619047619, + "pna_packet_trimmed10_mean": 0.3483369047619047, + "terminal_flow": 0.7658434523809523, + "terminal_norm": 0.846162755102041, + "terminal_packet": 0.5921187074829932, + "velocity_flow": 0.8530928571428572, + "velocity_packet": 0.6640636054421768, + "velocity_total": 0.9889146258503401 + }, + "NetBIOS": { + "_n": 588.0, + "arc_length": 0.9632598639455783, + "causal_surprisal_flow": 0.2739571428571429, + "causal_surprisal_packet_max": 0.18751649659863945, + "causal_surprisal_packet_mean": 0.17509200680272108, + "causal_surprisal_packet_median": 0.18294880952380954, + "causal_surprisal_packet_trimmed10_mean": 0.17520612244897957, + "causal_surprisal_total": 0.29631156462585034, + "consistency_total": 0.9289171768707484, + "curvature_flow": 0.3926081632653061, + "curvature_packet": 0.4514583333333333, + "curvature_total": 0.3486934523809524, + "direction_drift_flow": 0.32597840136054423, + "direction_drift_packet_max": 0.22378690476190477, + "direction_drift_packet_mean": 0.39607006802721084, + "direction_drift_packet_median": 0.43013086734693873, + "direction_drift_packet_trimmed10_mean": 0.4216506802721089, + "direction_drift_total": 0.22610544217687076, + "flow_consistency": 0.95751768707483, + "kappa2_speed2norm_packet_mean": 0.22723979591836738, + "kappa2_speed2norm_packet_median": 0.24617848639455783, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2437144557823129, + "kinetic_energy": 0.9630875, + "kinetic_flow": 0.8769566326530613, + "kinetic_packet": 0.6324288265306122, + "packet_consistency": 0.14017117346938776, + "pna_flow": 0.1679482993197279, + "pna_packet_max": 0.13204923469387758, + "pna_packet_mean": 0.22723979591836738, + "pna_packet_median": 0.24617848639455783, + "pna_packet_trimmed10_mean": 0.2437144557823129, + "terminal_flow": 0.5500280612244899, + "terminal_norm": 0.5798847789115648, + "terminal_packet": 0.38232176870748297, + "velocity_flow": 0.8666470238095237, + "velocity_packet": 0.5084583333333333, + "velocity_total": 0.9828044217687074 + }, + "Portmap": { + "_n": 588.0, + "arc_length": 0.9662614795918368, + "causal_surprisal_flow": 0.2706219387755102, + "causal_surprisal_packet_max": 0.18829438775510207, + "causal_surprisal_packet_mean": 0.17495136054421767, + "causal_surprisal_packet_median": 0.18274319727891156, + "causal_surprisal_packet_trimmed10_mean": 0.1750784013605442, + "causal_surprisal_total": 0.2906562925170068, + "consistency_total": 0.9290333333333334, + "curvature_flow": 0.3520789115646259, + "curvature_packet": 0.4581517857142857, + "curvature_total": 0.3227154761904762, + "direction_drift_flow": 0.35182406462585036, + "direction_drift_packet_max": 0.23307448979591838, + "direction_drift_packet_mean": 0.41740867346938776, + "direction_drift_packet_median": 0.4514455782312925, + "direction_drift_packet_trimmed10_mean": 0.4433641156462585, + "direction_drift_total": 0.23317261904761905, + "flow_consistency": 0.9573960884353742, + "kappa2_speed2norm_packet_mean": 0.24015425170068028, + "kappa2_speed2norm_packet_median": 0.2596993197278912, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2577006802721088, + "kinetic_energy": 0.9660790816326531, + "kinetic_flow": 0.8785602040816327, + "kinetic_packet": 0.6330224489795918, + "packet_consistency": 0.1524031462585034, + "pna_flow": 0.1484285714285714, + "pna_packet_max": 0.13775102040816325, + "pna_packet_mean": 0.24015425170068028, + "pna_packet_median": 0.2596993197278912, + "pna_packet_trimmed10_mean": 0.2577006802721088, + "terminal_flow": 0.5863977891156462, + "terminal_norm": 0.5976429421768708, + "terminal_packet": 0.3898931972789115, + "velocity_flow": 0.8643098639455782, + "velocity_packet": 0.508129081632653, + "velocity_total": 0.9814471088435375 + }, + "Syn": { + "_n": 588.0, + "arc_length": 0.8871641156462586, + "causal_surprisal_flow": 0.2602622448979592, + "causal_surprisal_packet_max": 0.21502406462585036, + "causal_surprisal_packet_mean": 0.22035901360544216, + "causal_surprisal_packet_median": 0.23375714285714286, + "causal_surprisal_packet_trimmed10_mean": 0.22131020408163263, + "causal_surprisal_total": 0.2550987244897959, + "consistency_total": 0.8122421768707483, + "curvature_flow": 0.27434183673469387, + "curvature_packet": 0.5406127551020409, + "curvature_total": 0.3931670068027211, + "direction_drift_flow": 0.47385493197278905, + "direction_drift_packet_max": 0.13275544217687074, + "direction_drift_packet_mean": 0.08212380952380953, + "direction_drift_packet_median": 0.07636768707482994, + "direction_drift_packet_trimmed10_mean": 0.07969727891156463, + "direction_drift_total": 0.09538452380952381, + "flow_consistency": 0.7960513605442177, + "kappa2_speed2norm_packet_mean": 0.15895714285714285, + "kappa2_speed2norm_packet_median": 0.15655374149659865, + "kappa2_speed2norm_packet_trimmed10_mean": 0.15325527210884354, + "kinetic_energy": 0.8873912414965985, + "kinetic_flow": 0.5728747448979592, + "kinetic_packet": 0.9623049319727891, + "packet_consistency": 0.9141095238095238, + "pna_flow": 0.15058945578231295, + "pna_packet_max": 0.2476749149659864, + "pna_packet_mean": 0.15895714285714285, + "pna_packet_median": 0.15655374149659865, + "pna_packet_trimmed10_mean": 0.15325527210884354, + "terminal_flow": 0.892372193877551, + "terminal_norm": 0.944956037414966, + "terminal_packet": 0.9827698979591837, + "velocity_flow": 0.5596770408163265, + "velocity_packet": 0.8763069727891156, + "velocity_total": 0.8108448129251702 + }, + "TFTP": { + "_n": 588.0, + "arc_length": 0.8256408163265305, + "causal_surprisal_flow": 0.29636955782312924, + "causal_surprisal_packet_max": 0.25618469387755105, + "causal_surprisal_packet_mean": 0.23841462585034012, + "causal_surprisal_packet_median": 0.1701187074829932, + "causal_surprisal_packet_trimmed10_mean": 0.2259244897959184, + "causal_surprisal_total": 0.2998918367346939, + "consistency_total": 0.6941865646258504, + "curvature_flow": 0.4221042517006803, + "curvature_packet": 0.6580965986394558, + "curvature_total": 0.5048199829931973, + "direction_drift_flow": 0.28373818027210884, + "direction_drift_packet_max": 0.33353903061224494, + "direction_drift_packet_mean": 0.28744591836734695, + "direction_drift_packet_median": 0.29483596938775514, + "direction_drift_packet_trimmed10_mean": 0.29789591836734697, + "direction_drift_total": 0.22950578231292515, + "flow_consistency": 0.6974860544217687, + "kappa2_speed2norm_packet_mean": 0.29521947278911564, + "kappa2_speed2norm_packet_median": 0.30156335034013604, + "kappa2_speed2norm_packet_trimmed10_mean": 0.29139251700680274, + "kinetic_energy": 0.8242525510204082, + "kinetic_flow": 0.7414499999999999, + "kinetic_packet": 0.7696515306122449, + "packet_consistency": 0.4772931972789115, + "pna_flow": 0.2023171768707483, + "pna_packet_max": 0.3487767857142857, + "pna_packet_mean": 0.29521947278911564, + "pna_packet_median": 0.30156335034013604, + "pna_packet_trimmed10_mean": 0.29139251700680274, + "terminal_flow": 0.7736928571428571, + "terminal_norm": 0.756742857142857, + "terminal_packet": 0.5076068027210884, + "velocity_flow": 0.7033366496598641, + "velocity_packet": 0.7876162414965986, + "velocity_total": 0.8326625850340137 + }, + "UDP": { + "_n": 588.0, + "arc_length": 0.7175975340136055, + "causal_surprisal_flow": 0.32892993197278914, + "causal_surprisal_packet_max": 0.26795544217687073, + "causal_surprisal_packet_mean": 0.23707244897959184, + "causal_surprisal_packet_median": 0.20567755102040816, + "causal_surprisal_packet_trimmed10_mean": 0.2291030612244898, + "causal_surprisal_total": 0.3519527210884354, + "consistency_total": 0.5774637755102041, + "curvature_flow": 0.2743267006802721, + "curvature_packet": 0.4720841836734694, + "curvature_total": 0.2895197278911565, + "direction_drift_flow": 0.26860527210884355, + "direction_drift_packet_max": 0.30211173469387753, + "direction_drift_packet_mean": 0.31695680272108845, + "direction_drift_packet_median": 0.3262008503401361, + "direction_drift_packet_trimmed10_mean": 0.3165154761904762, + "direction_drift_total": 0.2379840136054422, + "flow_consistency": 0.5598443877551021, + "kappa2_speed2norm_packet_mean": 0.2395982993197279, + "kappa2_speed2norm_packet_median": 0.2496985544217687, + "kappa2_speed2norm_packet_trimmed10_mean": 0.23799651360544216, + "kinetic_energy": 0.7168959183673469, + "kinetic_flow": 0.6766208333333332, + "kinetic_packet": 0.6023443877551021, + "packet_consistency": 0.3328211734693877, + "pna_flow": 0.23631326530612246, + "pna_packet_max": 0.23203554421768707, + "pna_packet_mean": 0.2395982993197279, + "pna_packet_median": 0.2496985544217687, + "pna_packet_trimmed10_mean": 0.23799651360544216, + "terminal_flow": 0.35771037414965984, + "terminal_norm": 0.3965172619047619, + "terminal_packet": 0.33268231292517003, + "velocity_flow": 0.7141133503401361, + "velocity_packet": 0.6968125850340137, + "velocity_total": 0.8182275510204082 + }, + "UDPLag": { + "_n": 588.0, + "arc_length": 0.8752769557823128, + "causal_surprisal_flow": 0.2766636054421769, + "causal_surprisal_packet_max": 0.21776938775510205, + "causal_surprisal_packet_mean": 0.22058384353741498, + "causal_surprisal_packet_median": 0.23322891156462588, + "causal_surprisal_packet_trimmed10_mean": 0.21960867346938776, + "causal_surprisal_total": 0.2749654761904762, + "consistency_total": 0.7854624149659865, + "curvature_flow": 0.2768438775510204, + "curvature_packet": 0.49190297619047624, + "curvature_total": 0.35573911564625854, + "direction_drift_flow": 0.4449950680272109, + "direction_drift_packet_max": 0.13469498299319727, + "direction_drift_packet_mean": 0.08818724489795919, + "direction_drift_packet_median": 0.08382704081632653, + "direction_drift_packet_trimmed10_mean": 0.08427057823129251, + "direction_drift_total": 0.09143486394557823, + "flow_consistency": 0.7689571428571429, + "kappa2_speed2norm_packet_mean": 0.11532585034013607, + "kappa2_speed2norm_packet_median": 0.11975238095238094, + "kappa2_speed2norm_packet_trimmed10_mean": 0.10926224489795919, + "kinetic_energy": 0.8750982142857142, + "kinetic_flow": 0.5777017006802722, + "kinetic_packet": 0.9262467687074829, + "packet_consistency": 0.8574349489795917, + "pna_flow": 0.16089761904761907, + "pna_packet_max": 0.19269778911564625, + "pna_packet_mean": 0.11532585034013607, + "pna_packet_median": 0.11975238095238094, + "pna_packet_trimmed10_mean": 0.10926224489795919, + "terminal_flow": 0.8423775510204082, + "terminal_norm": 0.8908248299319729, + "terminal_packet": 0.9171789115646258, + "velocity_flow": 0.5728979591836735, + "velocity_packet": 0.874124149659864, + "velocity_total": 0.8196985544217688 + }, + "WebDDoS": { + "_n": 438.0, + "arc_length": 0.7262614155251141, + "causal_surprisal_flow": 0.29646575342465753, + "causal_surprisal_packet_max": 0.3001219178082192, + "causal_surprisal_packet_mean": 0.301825799086758, + "causal_surprisal_packet_median": 0.2994945205479452, + "causal_surprisal_packet_trimmed10_mean": 0.27295730593607304, + "causal_surprisal_total": 0.26682043378995435, + "consistency_total": 0.5067214611872146, + "curvature_flow": 0.6133155251141553, + "curvature_packet": 0.6234865296803653, + "curvature_total": 0.78105, + "direction_drift_flow": 0.3511497716894978, + "direction_drift_packet_max": 0.614095205479452, + "direction_drift_packet_mean": 0.6137797945205479, + "direction_drift_packet_median": 0.6180437214611872, + "direction_drift_packet_trimmed10_mean": 0.5858771689497717, + "direction_drift_total": 0.4685399543378995, + "flow_consistency": 0.49812945205479453, + "kappa2_speed2norm_packet_mean": 0.6971623287671233, + "kappa2_speed2norm_packet_median": 0.6936463470319635, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6814228310502283, + "kinetic_energy": 0.7267892694063928, + "kinetic_flow": 0.7016107305936073, + "kinetic_packet": 0.4501374429223744, + "packet_consistency": 0.5565747716894978, + "pna_flow": 0.4121662100456621, + "pna_packet_max": 0.6059452054794521, + "pna_packet_mean": 0.6971623287671233, + "pna_packet_median": 0.6936463470319635, + "pna_packet_trimmed10_mean": 0.6814228310502283, + "terminal_flow": 0.35892739726027395, + "terminal_norm": 0.5209310502283104, + "terminal_packet": 0.5105988584474885, + "velocity_flow": 0.731065296803653, + "velocity_packet": 0.5336107305936073, + "velocity_total": 0.7747671232876713 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/baseline_seed44_to_cicddos2019.log b/artifacts/route_comparison/cross/baseline_seed44_to_cicddos2019.log new file mode 100644 index 0000000..11d4e5a --- /dev/null +++ b/artifacts/route_comparison/cross/baseline_seed44_to_cicddos2019.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 8,993,376 target rows; label distribution top: + Syn 1,495,248 + NetBIOS 702,760 + UDP 611,999 + MSSQL 523,845 + LDAP 509,665 +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 20.1s +[eval] scoring attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done in 18.8s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/baseline_seed44_to_cicddos2019.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/baseline_seed44_to_cicddos2019.npz + +=== overall AUROC top-10 === + velocity_total AUROC=0.9006 AUPRC=0.9088 + kinetic_energy AUROC=0.8868 AUPRC=0.9043 + arc_length AUROC=0.8868 AUPRC=0.9042 + kinetic_flow AUROC=0.8006 AUPRC=0.6944 + kinetic_packet AUROC=0.7777 AUPRC=0.7440 + flow_consistency AUROC=0.7759 AUPRC=0.7203 + consistency_total AUROC=0.7729 AUPRC=0.6882 + velocity_packet AUROC=0.7493 AUPRC=0.6868 + velocity_flow AUROC=0.7343 AUPRC=0.6258 + terminal_norm AUROC=0.7176 AUPRC=0.6756 diff --git a/artifacts/route_comparison/cross/baseline_seed44_to_cicddos2019.npz b/artifacts/route_comparison/cross/baseline_seed44_to_cicddos2019.npz new file mode 100644 index 0000000..3bdcb2f Binary files /dev/null and b/artifacts/route_comparison/cross/baseline_seed44_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/baseline_seed44_to_cicids2017.json b/artifacts/route_comparison/cross/baseline_seed44_to_cicids2017.json new file mode 100644 index 0000000..e9f1907 --- /dev/null +++ b/artifacts/route_comparison/cross/baseline_seed44_to_cicids2017.json @@ -0,0 +1,740 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/baseline_ciciot2023_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.7153435469580627, + "auprc": 0.6834095142169927 + }, + "causal_surprisal_flow": { + "auroc": 0.6007553676904902, + "auprc": 0.49922118197019416 + }, + "causal_surprisal_packet_max": { + "auroc": 0.5576113998818665, + "auprc": 0.4320240335487841 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.4873618945658595, + "auprc": 0.44603104109466385 + }, + "causal_surprisal_packet_median": { + "auroc": 0.4669065711754282, + "auprc": 0.40425883624123726 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.4280064678086237, + "auprc": 0.3485215894480974 + }, + "causal_surprisal_total": { + "auroc": 0.5467657412876551, + "auprc": 0.436507730336349 + }, + "consistency_total": { + "auroc": 0.6399157339043119, + "auprc": 0.4434544431760349 + }, + "curvature_flow": { + "auroc": 0.4076045038393385, + "auprc": 0.36110673360886514 + }, + "curvature_packet": { + "auroc": 0.7210015948021264, + "auprc": 0.6377402440517578 + }, + "curvature_total": { + "auroc": 0.6936812463083284, + "auprc": 0.6123222474767227 + }, + "direction_drift_flow": { + "auroc": 0.26819103662138216, + "auprc": 0.2829100519541495 + }, + "direction_drift_packet_max": { + "auroc": 0.5996168266391022, + "auprc": 0.493486730552885 + }, + "direction_drift_packet_mean": { + "auroc": 0.3506164131718842, + "auprc": 0.3139303942896503 + }, + "direction_drift_packet_median": { + "auroc": 0.35547402539870054, + "auprc": 0.31799483920640276 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.3246381792675723, + "auprc": 0.30091002707820796 + }, + "direction_drift_total": { + "auroc": 0.4173773848198465, + "auprc": 0.3866138225575735 + }, + "flow_consistency": { + "auroc": 0.6240422622563496, + "auprc": 0.4264868836829149 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.4683431999409332, + "auprc": 0.3504879530810602 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.4554119462492617, + "auprc": 0.3484800172782262 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.44210168340224454, + "auprc": 0.33962636236067445 + }, + "kinetic_energy": { + "auroc": 0.7131036916715889, + "auprc": 0.682461180032523 + }, + "kinetic_flow": { + "auroc": 0.6551423730064974, + "auprc": 0.4864072449760858 + }, + "kinetic_packet": { + "auroc": 0.7622990918487891, + "auprc": 0.7052580071917329 + }, + "packet_consistency": { + "auroc": 0.7607724822799764, + "auprc": 0.5867370261874004 + }, + "pna_flow": { + "auroc": 0.1762909554046072, + "auprc": 0.2611717962106277 + }, + "pna_packet_max": { + "auroc": 0.5826127362669817, + "auprc": 0.45663925218678664 + }, + "pna_packet_mean": { + "auroc": 0.4683431999409332, + "auprc": 0.3504879530810602 + }, + "pna_packet_median": { + "auroc": 0.4554119462492617, + "auprc": 0.3484800172782262 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.44210168340224454, + "auprc": 0.33962636236067445 + }, + "terminal_flow": { + "auroc": 0.8933466479621973, + "auprc": 0.8197249260142305 + }, + "terminal_norm": { + "auroc": 0.7877397223862965, + "auprc": 0.7427003963344155 + }, + "terminal_packet": { + "auroc": 0.7957379725339634, + "auprc": 0.7503205799391209 + }, + "velocity_flow": { + "auroc": 0.7224335056113407, + "auprc": 0.5330251097090206 + }, + "velocity_packet": { + "auroc": 0.7980794226225634, + "auprc": 0.6232798840051581 + }, + "velocity_total": { + "auroc": 0.6963040608387477, + "auprc": 0.6043780502506949 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "arc_length": 0.9290424924924924, + "causal_surprisal_flow": 0.7008294294294295, + "causal_surprisal_packet_max": 0.9049220720720721, + "causal_surprisal_packet_mean": 0.9475322822822824, + "causal_surprisal_packet_median": 0.8285863363363363, + "causal_surprisal_packet_trimmed10_mean": 0.8067683183183183, + "causal_surprisal_total": 0.7765370870870871, + "consistency_total": 0.7901318318318318, + "curvature_flow": 0.0727042042042042, + "curvature_packet": 0.8030890390390392, + "curvature_total": 0.7191790540540541, + "direction_drift_flow": 0.44885803303303307, + "direction_drift_packet_max": 0.556768093093093, + "direction_drift_packet_mean": 0.31131786786786786, + "direction_drift_packet_median": 0.37306418918918915, + "direction_drift_packet_trimmed10_mean": 0.2515963963963964, + "direction_drift_total": 0.3610584084084084, + "flow_consistency": 0.709401051051051, + "kappa2_speed2norm_packet_mean": 0.43303205705705705, + "kappa2_speed2norm_packet_median": 0.42906936936936935, + "kappa2_speed2norm_packet_trimmed10_mean": 0.34723558558558554, + "kinetic_energy": 0.9337515015015015, + "kinetic_flow": 0.45916471471471476, + "kinetic_packet": 0.9735337837837839, + "packet_consistency": 0.931404954954955, + "pna_flow": 0.0411036036036036, + "pna_packet_max": 0.6115253003003003, + "pna_packet_mean": 0.43303205705705705, + "pna_packet_median": 0.42906936936936935, + "pna_packet_trimmed10_mean": 0.34723558558558554, + "terminal_flow": 0.8567273273273273, + "terminal_norm": 0.9600581081081081, + "terminal_packet": 0.978268918918919, + "velocity_flow": 0.42802267267267263, + "velocity_packet": 0.9187617117117117, + "velocity_total": 0.6084057057057056 + }, + "DDoS": { + "_n": 666.0, + "arc_length": 0.9345273273273272, + "causal_surprisal_flow": 0.7623115615615615, + "causal_surprisal_packet_max": 0.6651857357357357, + "causal_surprisal_packet_mean": 0.6588590090090091, + "causal_surprisal_packet_median": 0.768471021021021, + "causal_surprisal_packet_trimmed10_mean": 0.5994606606606606, + "causal_surprisal_total": 0.8690746246246246, + "consistency_total": 0.6861394894894894, + "curvature_flow": 0.30479564564564565, + "curvature_packet": 0.9454219219219218, + "curvature_total": 0.936028078078078, + "direction_drift_flow": 0.23209512012012012, + "direction_drift_packet_max": 0.608296021021021, + "direction_drift_packet_mean": 0.2933174924924925, + "direction_drift_packet_median": 0.2988839339339339, + "direction_drift_packet_trimmed10_mean": 0.25851576576576574, + "direction_drift_total": 0.38180420420420424, + "flow_consistency": 0.6692114114114114, + "kappa2_speed2norm_packet_mean": 0.5356588588588589, + "kappa2_speed2norm_packet_median": 0.5351052552552552, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5043204954954955, + "kinetic_energy": 0.9345953453453453, + "kinetic_flow": 0.7732440690690693, + "kinetic_packet": 0.9524585585585587, + "packet_consistency": 0.8725863363363363, + "pna_flow": 0.08166411411411413, + "pna_packet_max": 0.5690346096096096, + "pna_packet_mean": 0.5356588588588589, + "pna_packet_median": 0.5351052552552552, + "pna_packet_trimmed10_mean": 0.5043204954954955, + "terminal_flow": 0.9873923423423423, + "terminal_norm": 0.9740321321321321, + "terminal_packet": 0.9613645645645645, + "velocity_flow": 0.7558402402402402, + "velocity_packet": 0.8994873873873874, + "velocity_total": 0.7418795795795795 + }, + "DoS GoldenEye": { + "_n": 666.0, + "arc_length": 0.529343993993994, + "causal_surprisal_flow": 0.754495945945946, + "causal_surprisal_packet_max": 0.6540764264264266, + "causal_surprisal_packet_mean": 0.6337971471471472, + "causal_surprisal_packet_median": 0.5861003003003002, + "causal_surprisal_packet_trimmed10_mean": 0.6005708708708708, + "causal_surprisal_total": 0.762525, + "consistency_total": 0.6237912912912914, + "curvature_flow": 0.19895495495495497, + "curvature_packet": 0.802327027027027, + "curvature_total": 0.7799412912912912, + "direction_drift_flow": 0.2780322822822823, + "direction_drift_packet_max": 0.7682457957957958, + "direction_drift_packet_mean": 0.5031591591591591, + "direction_drift_packet_median": 0.5169017267267266, + "direction_drift_packet_trimmed10_mean": 0.4585922672672673, + "direction_drift_total": 0.6645400150150149, + "flow_consistency": 0.6374905405405404, + "kappa2_speed2norm_packet_mean": 0.528715990990991, + "kappa2_speed2norm_packet_median": 0.5373710210210211, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5094461711711711, + "kinetic_energy": 0.5266274774774775, + "kinetic_flow": 0.6917366366366365, + "kinetic_packet": 0.7237065315315316, + "packet_consistency": 0.7231959459459459, + "pna_flow": 0.06802072072072071, + "pna_packet_max": 0.6045251501501501, + "pna_packet_mean": 0.528715990990991, + "pna_packet_median": 0.5373710210210211, + "pna_packet_trimmed10_mean": 0.5094461711711711, + "terminal_flow": 0.9874100600600599, + "terminal_norm": 0.893144069069069, + "terminal_packet": 0.8142462462462464, + "velocity_flow": 0.7323972972972973, + "velocity_packet": 0.7975360360360362, + "velocity_total": 0.6097051051051051 + }, + "DoS Hulk": { + "_n": 666.0, + "arc_length": 0.7779510510510511, + "causal_surprisal_flow": 0.7689434684684684, + "causal_surprisal_packet_max": 0.8089862612612612, + "causal_surprisal_packet_mean": 0.8237225975975977, + "causal_surprisal_packet_median": 0.7206403903903904, + "causal_surprisal_packet_trimmed10_mean": 0.6563426426426425, + "causal_surprisal_total": 0.8670163663663664, + "consistency_total": 0.5786512012012012, + "curvature_flow": 0.4974714714714715, + "curvature_packet": 0.8701532282282282, + "curvature_total": 0.8700130630630628, + "direction_drift_flow": 0.19311966966966965, + "direction_drift_packet_max": 0.7272003753753754, + "direction_drift_packet_mean": 0.22559789789789791, + "direction_drift_packet_median": 0.23601824324324325, + "direction_drift_packet_trimmed10_mean": 0.17514144144144145, + "direction_drift_total": 0.2965981981981982, + "flow_consistency": 0.5471539039039038, + "kappa2_speed2norm_packet_mean": 0.4620437687687688, + "kappa2_speed2norm_packet_median": 0.4260737987987988, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3948786036036036, + "kinetic_energy": 0.7751114864864864, + "kinetic_flow": 0.7803334834834834, + "kinetic_packet": 0.8741885885885885, + "packet_consistency": 0.9032451951951952, + "pna_flow": 0.18274429429429428, + "pna_packet_max": 0.6680262762762763, + "pna_packet_mean": 0.4620437687687688, + "pna_packet_median": 0.4260737987987988, + "pna_packet_trimmed10_mean": 0.3948786036036036, + "terminal_flow": 0.9294137387387388, + "terminal_norm": 0.8418783783783782, + "terminal_packet": 0.8537983483483484, + "velocity_flow": 0.7762073573573575, + "velocity_packet": 0.9123297297297297, + "velocity_total": 0.7743830330330331 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "arc_length": 0.8287656906906906, + "causal_surprisal_flow": 0.7019680180180181, + "causal_surprisal_packet_max": 0.5536396396396397, + "causal_surprisal_packet_mean": 0.5150901651651651, + "causal_surprisal_packet_median": 0.5109668168168169, + "causal_surprisal_packet_trimmed10_mean": 0.5108707207207208, + "causal_surprisal_total": 0.713144894894895, + "consistency_total": 0.5721770270270271, + "curvature_flow": 0.5417328078078079, + "curvature_packet": 0.9708379879879879, + "curvature_total": 0.9654851351351351, + "direction_drift_flow": 0.19589572072072073, + "direction_drift_packet_max": 0.7259068318318318, + "direction_drift_packet_mean": 0.48924219219219217, + "direction_drift_packet_median": 0.5356036786786786, + "direction_drift_packet_trimmed10_mean": 0.4346346846846847, + "direction_drift_total": 0.6054177927927928, + "flow_consistency": 0.5604938438438438, + "kappa2_speed2norm_packet_mean": 0.515556981981982, + "kappa2_speed2norm_packet_median": 0.47487537537537533, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4757757507507507, + "kinetic_energy": 0.8233979729729729, + "kinetic_flow": 0.6664777777777777, + "kinetic_packet": 0.9160633633633634, + "packet_consistency": 0.7155065315315315, + "pna_flow": 0.30003723723723724, + "pna_packet_max": 0.555527027027027, + "pna_packet_mean": 0.515556981981982, + "pna_packet_median": 0.47487537537537533, + "pna_packet_trimmed10_mean": 0.4757757507507507, + "terminal_flow": 0.9002307807807808, + "terminal_norm": 0.8900534534534534, + "terminal_packet": 0.8981320570570572, + "velocity_flow": 0.7019465465465466, + "velocity_packet": 0.8692575825825825, + "velocity_total": 0.7159897147147147 + }, + "DoS Slowloris": { + "_n": 666.0, + "arc_length": 0.7222538288288289, + "causal_surprisal_flow": 0.5896225225225225, + "causal_surprisal_packet_max": 0.5358415915915916, + "causal_surprisal_packet_mean": 0.5656945945945947, + "causal_surprisal_packet_median": 0.6218328078078078, + "causal_surprisal_packet_trimmed10_mean": 0.528922972972973, + "causal_surprisal_total": 0.48889947447447446, + "consistency_total": 0.58370990990991, + "curvature_flow": 0.3274168168168168, + "curvature_packet": 0.8957004504504504, + "curvature_total": 0.8999486486486487, + "direction_drift_flow": 0.1619635135135135, + "direction_drift_packet_max": 0.47393656156156155, + "direction_drift_packet_mean": 0.2508533033033033, + "direction_drift_packet_median": 0.26266051051051054, + "direction_drift_packet_trimmed10_mean": 0.2364223723723724, + "direction_drift_total": 0.23151066066066064, + "flow_consistency": 0.5991668168168169, + "kappa2_speed2norm_packet_mean": 0.5380986486486488, + "kappa2_speed2norm_packet_median": 0.5391524774774774, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5337826576576576, + "kinetic_energy": 0.716701951951952, + "kinetic_flow": 0.609146996996997, + "kinetic_packet": 0.8214726726726728, + "packet_consistency": 0.6206097597597597, + "pna_flow": 0.1873825825825826, + "pna_packet_max": 0.42475495495495497, + "pna_packet_mean": 0.5380986486486488, + "pna_packet_median": 0.5391524774774774, + "pna_packet_trimmed10_mean": 0.5337826576576576, + "terminal_flow": 0.8596024024024025, + "terminal_norm": 0.8379301801801801, + "terminal_packet": 0.8320783783783784, + "velocity_flow": 0.7451482732732733, + "velocity_packet": 0.8333366366366367, + "velocity_total": 0.7396463963963963 + }, + "FTP-Patator": { + "_n": 666.0, + "arc_length": 0.2342882132132132, + "causal_surprisal_flow": 0.7529228228228229, + "causal_surprisal_packet_max": 0.5526451201201201, + "causal_surprisal_packet_mean": 0.3075600600600601, + "causal_surprisal_packet_median": 0.1786355855855856, + "causal_surprisal_packet_trimmed10_mean": 0.21008093093093094, + "causal_surprisal_total": 0.5165836336336336, + "consistency_total": 0.6169524024024025, + "curvature_flow": 0.34459774774774776, + "curvature_packet": 0.5591742492492492, + "curvature_total": 0.5551355855855856, + "direction_drift_flow": 0.568513963963964, + "direction_drift_packet_max": 0.9162165915915916, + "direction_drift_packet_mean": 0.8233324324324323, + "direction_drift_packet_median": 0.721846096096096, + "direction_drift_packet_trimmed10_mean": 0.7622906156156155, + "direction_drift_total": 0.9707231231231231, + "flow_consistency": 0.6418595345345345, + "kappa2_speed2norm_packet_mean": 0.5222095345345346, + "kappa2_speed2norm_packet_median": 0.45906463963963967, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4903508258258258, + "kinetic_energy": 0.22967462462462465, + "kinetic_flow": 0.4947678678678679, + "kinetic_packet": 0.2937036786786787, + "packet_consistency": 0.4642543543543544, + "pna_flow": 0.17683198198198197, + "pna_packet_max": 0.7325434684684685, + "pna_packet_mean": 0.5222095345345346, + "pna_packet_median": 0.45906463963963967, + "pna_packet_trimmed10_mean": 0.4903508258258258, + "terminal_flow": 0.9643154654654654, + "terminal_norm": 0.44615255255255254, + "terminal_packet": 0.5181387387387387, + "velocity_flow": 0.57720990990991, + "velocity_packet": 0.6379232732732733, + "velocity_total": 0.3587313813813814 + }, + "Heartbleed": { + "_n": 1.0, + "arc_length": 0.961, + "causal_surprisal_flow": 0.39759999999999995, + "causal_surprisal_packet_max": 0.9180999999999999, + "causal_surprisal_packet_mean": 0.42989999999999995, + "causal_surprisal_packet_median": 0.40049999999999997, + "causal_surprisal_packet_trimmed10_mean": 0.37339999999999995, + "causal_surprisal_total": 0.01200000000000001, + "consistency_total": 0.7169000000000001, + "curvature_flow": 0.9490999999999998, + "curvature_packet": 0.5771999999999999, + "curvature_total": 0.6261, + "direction_drift_flow": 0.009299999999999975, + "direction_drift_packet_max": 0.5439, + "direction_drift_packet_mean": 0.028299999999999992, + "direction_drift_packet_median": 0.05559999999999998, + "direction_drift_packet_trimmed10_mean": 0.031000000000000028, + "direction_drift_total": 0.04820000000000002, + "flow_consistency": 0.6619999999999999, + "kappa2_speed2norm_packet_mean": 0.10109999999999997, + "kappa2_speed2norm_packet_median": 0.10570000000000002, + "kappa2_speed2norm_packet_trimmed10_mean": 0.09999999999999998, + "kinetic_energy": 0.9548, + "kinetic_flow": 0.9978, + "kinetic_packet": 0.8190999999999999, + "packet_consistency": 0.9692, + "pna_flow": 0.011199999999999988, + "pna_packet_max": 0.3405, + "pna_packet_mean": 0.10109999999999997, + "pna_packet_median": 0.10570000000000002, + "pna_packet_trimmed10_mean": 0.09999999999999998, + "terminal_flow": 0.9847, + "terminal_norm": 0.32010000000000005, + "terminal_packet": 0.3408, + "velocity_flow": 0.9943, + "velocity_packet": 0.9791000000000001, + "velocity_total": 0.9824 + }, + "Infiltration": { + "_n": 7.0, + "arc_length": 0.9125142857142856, + "causal_surprisal_flow": 0.39515714285714293, + "causal_surprisal_packet_max": 0.6246714285714285, + "causal_surprisal_packet_mean": 0.3197, + "causal_surprisal_packet_median": 0.24314285714285713, + "causal_surprisal_packet_trimmed10_mean": 0.2285, + "causal_surprisal_total": 0.1736, + "consistency_total": 0.8145714285714285, + "curvature_flow": 0.7412428571428571, + "curvature_packet": 0.8265428571428572, + "curvature_total": 0.8542000000000001, + "direction_drift_flow": 0.07514285714285715, + "direction_drift_packet_max": 0.711, + "direction_drift_packet_mean": 0.30624285714285715, + "direction_drift_packet_median": 0.31764285714285706, + "direction_drift_packet_trimmed10_mean": 0.32102857142857144, + "direction_drift_total": 0.49347142857142856, + "flow_consistency": 0.7757999999999999, + "kappa2_speed2norm_packet_mean": 0.4221857142857143, + "kappa2_speed2norm_packet_median": 0.43778571428571433, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4142, + "kinetic_energy": 0.9123428571428571, + "kinetic_flow": 0.8941, + "kinetic_packet": 0.8773857142857143, + "packet_consistency": 0.8200571428571429, + "pna_flow": 0.07804285714285715, + "pna_packet_max": 0.5698, + "pna_packet_mean": 0.4221857142857143, + "pna_packet_median": 0.43778571428571433, + "pna_packet_trimmed10_mean": 0.4142, + "terminal_flow": 0.9341857142857143, + "terminal_norm": 0.7540714285714285, + "terminal_packet": 0.8604428571428571, + "velocity_flow": 0.8975714285714286, + "velocity_packet": 0.8109142857142857, + "velocity_total": 0.8719428571428571 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "arc_length": 0.9911674174174174, + "causal_surprisal_flow": 0.02148588588588589, + "causal_surprisal_packet_max": 0.0303445945945946, + "causal_surprisal_packet_mean": 0.024060960960960963, + "causal_surprisal_packet_median": 0.06188153153153153, + "causal_surprisal_packet_trimmed10_mean": 0.027892792792792796, + "causal_surprisal_total": 0.014484684684684695, + "consistency_total": 0.7682582582582581, + "curvature_flow": 0.2750106606606607, + "curvature_packet": 0.5499803303303303, + "curvature_total": 0.40835570570570573, + "direction_drift_flow": 0.2334972972972973, + "direction_drift_packet_max": 0.10661186186186186, + "direction_drift_packet_mean": 0.11442192192192192, + "direction_drift_packet_median": 0.12838693693693692, + "direction_drift_packet_trimmed10_mean": 0.13267282282282283, + "direction_drift_total": 0.054665015015015014, + "flow_consistency": 0.7078367117117117, + "kappa2_speed2norm_packet_mean": 0.4104207207207207, + "kappa2_speed2norm_packet_median": 0.44608333333333333, + "kappa2_speed2norm_packet_trimmed10_mean": 0.434560960960961, + "kinetic_energy": 0.9914034534534534, + "kinetic_flow": 0.5547234234234234, + "kinetic_packet": 0.9686727477477478, + "packet_consistency": 0.9066555555555555, + "pna_flow": 0.1325746246246246, + "pna_packet_max": 0.37276028528528526, + "pna_packet_mean": 0.4104207207207207, + "pna_packet_median": 0.44608333333333333, + "pna_packet_trimmed10_mean": 0.434560960960961, + "terminal_flow": 0.9599641141141141, + "terminal_norm": 0.9916333333333334, + "terminal_packet": 0.991366066066066, + "velocity_flow": 0.7657412162162163, + "velocity_packet": 0.7193179429429428, + "velocity_total": 0.978798948948949 + }, + "Portscan": { + "_n": 666.0, + "arc_length": 0.9926897897897897, + "causal_surprisal_flow": 0.014202552552552558, + "causal_surprisal_packet_max": 0.02094984984984985, + "causal_surprisal_packet_mean": 0.021033783783783795, + "causal_surprisal_packet_median": 0.08734714714714714, + "causal_surprisal_packet_trimmed10_mean": 0.026871621621621624, + "causal_surprisal_total": 0.011956906906906916, + "consistency_total": 0.748281981981982, + "curvature_flow": 0.5104188438438437, + "curvature_packet": 0.4757222222222222, + "curvature_total": 0.43279932432432433, + "direction_drift_flow": 0.23553926426426425, + "direction_drift_packet_max": 0.23545750750750755, + "direction_drift_packet_mean": 0.19968273273273274, + "direction_drift_packet_median": 0.22197777777777775, + "direction_drift_packet_trimmed10_mean": 0.22274376876876875, + "direction_drift_total": 0.06402552552552553, + "flow_consistency": 0.7025010510510511, + "kappa2_speed2norm_packet_mean": 0.4362867867867868, + "kappa2_speed2norm_packet_median": 0.4637659159159159, + "kappa2_speed2norm_packet_trimmed10_mean": 0.46008776276276275, + "kinetic_energy": 0.9926806306306305, + "kinetic_flow": 0.5348115615615614, + "kinetic_packet": 0.9448987987987988, + "packet_consistency": 0.8893895645645645, + "pna_flow": 0.2901292042042042, + "pna_packet_max": 0.45748543543543546, + "pna_packet_mean": 0.4362867867867868, + "pna_packet_median": 0.4637659159159159, + "pna_packet_trimmed10_mean": 0.46008776276276275, + "terminal_flow": 0.9470086336336336, + "terminal_norm": 0.9921417417417417, + "terminal_packet": 0.9894980480480481, + "velocity_flow": 0.7601843843843844, + "velocity_packet": 0.6566759759759758, + "velocity_total": 0.9891777777777778 + }, + "SSH-Patator": { + "_n": 666.0, + "arc_length": 0.18350427927927926, + "causal_surprisal_flow": 0.9911803303303304, + "causal_surprisal_packet_max": 0.8047866366366366, + "causal_surprisal_packet_mean": 0.3790533783783784, + "causal_surprisal_packet_median": 0.31029692192192193, + "causal_surprisal_packet_trimmed10_mean": 0.31510045045045043, + "causal_surprisal_total": 0.5173647147147148, + "consistency_total": 0.4319623873873874, + "curvature_flow": 0.9472070570570571, + "curvature_packet": 0.3553037537537537, + "curvature_total": 0.38070570570570567, + "direction_drift_flow": 0.1656412912912913, + "direction_drift_packet_max": 0.8733380630630629, + "direction_drift_packet_mean": 0.33993603603603606, + "direction_drift_packet_median": 0.3058133633633634, + "direction_drift_packet_trimmed10_mean": 0.35577372372372373, + "direction_drift_total": 0.593198948948949, + "flow_consistency": 0.4697108108108108, + "kappa2_speed2norm_packet_mean": 0.3479222222222222, + "kappa2_speed2norm_packet_median": 0.2935475225225225, + "kappa2_speed2norm_packet_trimmed10_mean": 0.31666704204204205, + "kinetic_energy": 0.17802312312312313, + "kinetic_flow": 0.9397181681681681, + "kinetic_packet": 0.1627106606606607, + "packet_consistency": 0.5496532282282282, + "pna_flow": 0.32764489489489484, + "pna_packet_max": 0.8384060060060059, + "pna_packet_mean": 0.3479222222222222, + "pna_packet_median": 0.2935475225225225, + "pna_packet_trimmed10_mean": 0.31666704204204205, + "terminal_flow": 0.5388564564564563, + "terminal_norm": 0.12295382882882885, + "terminal_packet": 0.18215165165165165, + "velocity_flow": 0.9450798798798797, + "velocity_packet": 0.7090816066066065, + "velocity_total": 0.405562987987988 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "arc_length": 0.8964561643835616, + "causal_surprisal_flow": 0.23143287671232876, + "causal_surprisal_packet_max": 0.8689712328767124, + "causal_surprisal_packet_mean": 0.4665493150684932, + "causal_surprisal_packet_median": 0.4261986301369863, + "causal_surprisal_packet_trimmed10_mean": 0.40196575342465757, + "causal_surprisal_total": 0.02108219178082192, + "consistency_total": 0.6248958904109589, + "curvature_flow": 0.8075178082191781, + "curvature_packet": 0.5093068493150684, + "curvature_total": 0.523972602739726, + "direction_drift_flow": 0.0031657534246575703, + "direction_drift_packet_max": 0.6312657534246575, + "direction_drift_packet_mean": 0.02248630136986301, + "direction_drift_packet_median": 0.026494520547945204, + "direction_drift_packet_trimmed10_mean": 0.02237123287671233, + "direction_drift_total": 0.03751164383561644, + "flow_consistency": 0.592113698630137, + "kappa2_speed2norm_packet_mean": 0.1355095890410959, + "kappa2_speed2norm_packet_median": 0.11399041095890411, + "kappa2_speed2norm_packet_trimmed10_mean": 0.1245041095890411, + "kinetic_energy": 0.8864027397260273, + "kinetic_flow": 0.9988972602739726, + "kinetic_packet": 0.6335369863013699, + "packet_consistency": 0.9704602739726027, + "pna_flow": 0.003258904109589032, + "pna_packet_max": 0.4953835616438356, + "pna_packet_mean": 0.1355095890410959, + "pna_packet_median": 0.11399041095890411, + "pna_packet_trimmed10_mean": 0.1245041095890411, + "terminal_flow": 0.8936328767123288, + "terminal_norm": 0.22704794520547944, + "terminal_packet": 0.3062205479452055, + "velocity_flow": 0.9982876712328766, + "velocity_packet": 0.9771150684931507, + "velocity_total": 0.9809602739726027 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "arc_length": 0.7392615384615384, + "causal_surprisal_flow": 0.751776923076923, + "causal_surprisal_packet_max": 0.6011384615384615, + "causal_surprisal_packet_mean": 0.5965384615384616, + "causal_surprisal_packet_median": 0.6093692307692308, + "causal_surprisal_packet_trimmed10_mean": 0.5656384615384615, + "causal_surprisal_total": 0.8991230769230769, + "consistency_total": 0.6371461538461538, + "curvature_flow": 0.24726153846153845, + "curvature_packet": 0.913176923076923, + "curvature_total": 0.8881538461538463, + "direction_drift_flow": 0.6492153846153847, + "direction_drift_packet_max": 0.7949923076923077, + "direction_drift_packet_mean": 0.4018, + "direction_drift_packet_median": 0.31016923076923075, + "direction_drift_packet_trimmed10_mean": 0.30666153846153843, + "direction_drift_total": 0.5059769230769231, + "flow_consistency": 0.6316615384615385, + "kappa2_speed2norm_packet_mean": 0.47596153846153844, + "kappa2_speed2norm_packet_median": 0.3437, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3544153846153847, + "kinetic_energy": 0.7366615384615385, + "kinetic_flow": 0.5156076923076923, + "kinetic_packet": 0.8877538461538461, + "packet_consistency": 0.8396307692307693, + "pna_flow": 0.16518461538461537, + "pna_packet_max": 0.8008384615384616, + "pna_packet_mean": 0.47596153846153844, + "pna_packet_median": 0.3437, + "pna_packet_trimmed10_mean": 0.3544153846153847, + "terminal_flow": 0.9539307692307692, + "terminal_norm": 0.9363230769230769, + "terminal_packet": 0.8944923076923077, + "velocity_flow": 0.5479384615384615, + "velocity_packet": 0.8918153846153846, + "velocity_total": 0.6622076923076923 + }, + "Web Attack - XSS": { + "_n": 18.0, + "arc_length": 0.9795833333333334, + "causal_surprisal_flow": 0.21560555555555555, + "causal_surprisal_packet_max": 0.8725666666666667, + "causal_surprisal_packet_mean": 0.45826666666666666, + "causal_surprisal_packet_median": 0.4091722222222222, + "causal_surprisal_packet_trimmed10_mean": 0.4105944444444445, + "causal_surprisal_total": 0.01164444444444445, + "consistency_total": 0.597388888888889, + "curvature_flow": 0.8038944444444444, + "curvature_packet": 0.7530055555555555, + "curvature_total": 0.7839944444444444, + "direction_drift_flow": 0.00119444444444443, + "direction_drift_packet_max": 0.4449888888888889, + "direction_drift_packet_mean": 0.02577777777777778, + "direction_drift_packet_median": 0.036361111111111094, + "direction_drift_packet_trimmed10_mean": 0.027122222222222228, + "direction_drift_total": 0.04345555555555556, + "flow_consistency": 0.5239888888888888, + "kappa2_speed2norm_packet_mean": 0.13001666666666667, + "kappa2_speed2norm_packet_median": 0.09742777777777777, + "kappa2_speed2norm_packet_trimmed10_mean": 0.11802777777777777, + "kinetic_energy": 0.9779222222222221, + "kinetic_flow": 0.9999, + "kinetic_packet": 0.8345, + "packet_consistency": 0.97405, + "pna_flow": 0.00015555555555555077, + "pna_packet_max": 0.4841388888888889, + "pna_packet_mean": 0.13001666666666667, + "pna_packet_median": 0.09742777777777777, + "pna_packet_trimmed10_mean": 0.11802777777777777, + "terminal_flow": 0.9216444444444445, + "terminal_norm": 0.3079388888888889, + "terminal_packet": 0.42825, + "velocity_flow": 0.9991222222222222, + "velocity_packet": 0.991438888888889, + "velocity_total": 0.9904111111111111 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/baseline_seed44_to_cicids2017.log b/artifacts/route_comparison/cross/baseline_seed44_to_cicids2017.log new file mode 100644 index 0000000..c9cf7c4 --- /dev/null +++ b/artifacts/route_comparison/cross/baseline_seed44_to_cicids2017.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 2,025,564 target rows; label distribution top: + normal 1,521,748 + Portscan 159,040 + DoS Hulk 158,454 + DDoS 95,144 + Infiltration - Portscan 71,714 +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 20.1s +[eval] scoring attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done in 13.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/baseline_seed44_to_cicids2017.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/baseline_seed44_to_cicids2017.npz + +=== overall AUROC top-10 === + terminal_flow AUROC=0.8933 AUPRC=0.8197 + velocity_packet AUROC=0.7981 AUPRC=0.6233 + terminal_packet AUROC=0.7957 AUPRC=0.7503 + terminal_norm AUROC=0.7877 AUPRC=0.7427 + kinetic_packet AUROC=0.7623 AUPRC=0.7053 + packet_consistency AUROC=0.7608 AUPRC=0.5867 + velocity_flow AUROC=0.7224 AUPRC=0.5330 + curvature_packet AUROC=0.7210 AUPRC=0.6377 + arc_length AUROC=0.7153 AUPRC=0.6834 + kinetic_energy AUROC=0.7131 AUPRC=0.6825 diff --git a/artifacts/route_comparison/cross/baseline_seed44_to_cicids2017.npz b/artifacts/route_comparison/cross/baseline_seed44_to_cicids2017.npz new file mode 100644 index 0000000..ba86cd4 Binary files /dev/null and b/artifacts/route_comparison/cross/baseline_seed44_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/legacy_unified_baseline_ddos2019_to_cicids2017.json b/artifacts/route_comparison/cross/legacy_unified_baseline_ddos2019_to_cicids2017.json new file mode 100644 index 0000000..380f578 --- /dev/null +++ b/artifacts/route_comparison/cross/legacy_unified_baseline_ddos2019_to_cicids2017.json @@ -0,0 +1,740 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/runs/unified_cfm_cicddos2019_within_2026_04_25", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.5812745717660956, + "auprc": 0.41528099513328 + }, + "causal_surprisal_flow": { + "auroc": 0.4780168783225044, + "auprc": 0.45548014696220684 + }, + "causal_surprisal_packet_max": { + "auroc": 0.6872270894861192, + "auprc": 0.5091805441332831 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.5094761370348493, + "auprc": 0.4651302580217575 + }, + "causal_surprisal_packet_median": { + "auroc": 0.34926743207324273, + "auprc": 0.3929509793742549 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.3795833579444773, + "auprc": 0.40097655341647226 + }, + "causal_surprisal_total": { + "auroc": 0.21249968251624338, + "auprc": 0.27143795209026256 + }, + "consistency_total": { + "auroc": 0.47448141612522154, + "auprc": 0.3677388044690715 + }, + "curvature_flow": { + "auroc": 0.4514126550502068, + "auprc": 0.3785606455191044 + }, + "curvature_packet": { + "auroc": 0.7952873080330776, + "auprc": 0.720106394399832 + }, + "curvature_total": { + "auroc": 0.7697823981098642, + "auprc": 0.7047291205782545 + }, + "direction_drift_flow": { + "auroc": 0.2683627215002953, + "auprc": 0.28183093000941134 + }, + "direction_drift_packet_max": { + "auroc": 0.7408597312463084, + "auprc": 0.6239343890362381 + }, + "direction_drift_packet_mean": { + "auroc": 0.7435843620791495, + "auprc": 0.6762129923627507 + }, + "direction_drift_packet_median": { + "auroc": 0.6943228071470762, + "auprc": 0.6412917252569927 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.7088877141169523, + "auprc": 0.6224057972900386 + }, + "direction_drift_total": { + "auroc": 0.6705548360897815, + "auprc": 0.539998398150035 + }, + "flow_consistency": { + "auroc": 0.5418826343768458, + "auprc": 0.4045726011356618 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.8554897740696987, + "auprc": 0.8190766188769686 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.8523801609568813, + "auprc": 0.80902827032331 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.8599373670998227, + "auprc": 0.8250513843872781 + }, + "kinetic_energy": { + "auroc": 0.5810106024808033, + "auprc": 0.41585639640981925 + }, + "kinetic_flow": { + "auroc": 0.6585600634967513, + "auprc": 0.5049414808880961 + }, + "kinetic_packet": { + "auroc": 0.5823710499113999, + "auprc": 0.4169732337863508 + }, + "packet_consistency": { + "auroc": 0.2776241139988187, + "auprc": 0.2848126052831199 + }, + "pna_flow": { + "auroc": 0.3031884746012995, + "auprc": 0.2926613211796529 + }, + "pna_packet_max": { + "auroc": 0.7765787212049616, + "auprc": 0.6715829531959291 + }, + "pna_packet_mean": { + "auroc": 0.8554897740696987, + "auprc": 0.8190766188769686 + }, + "pna_packet_median": { + "auroc": 0.8523801609568813, + "auprc": 0.80902827032331 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.8599373670998227, + "auprc": 0.8250513843872781 + }, + "terminal_flow": { + "auroc": 0.5850773405197873, + "auprc": 0.5848393531842264 + }, + "terminal_norm": { + "auroc": 0.5541489737152983, + "auprc": 0.39918274331969983 + }, + "terminal_packet": { + "auroc": 0.6112699867099822, + "auprc": 0.45141374719897925 + }, + "velocity_flow": { + "auroc": 0.637647844063792, + "auprc": 0.46270922691834154 + }, + "velocity_packet": { + "auroc": 0.5100767277023035, + "auprc": 0.3649463616034952 + }, + "velocity_total": { + "auroc": 0.5548146485528647, + "auprc": 0.38842759205484884 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "arc_length": 0.6046727477477477, + "causal_surprisal_flow": 0.29218873873873874, + "causal_surprisal_packet_max": 0.8443237237237237, + "causal_surprisal_packet_mean": 0.7252069069069069, + "causal_surprisal_packet_median": 0.42078813813813815, + "causal_surprisal_packet_trimmed10_mean": 0.36183093093093094, + "causal_surprisal_total": 0.24520075075075076, + "consistency_total": 0.051845345345345344, + "curvature_flow": 0.1652249249249249, + "curvature_packet": 0.8635688438438438, + "curvature_total": 0.8220015015015013, + "direction_drift_flow": 0.6621124624624625, + "direction_drift_packet_max": 0.7996131381381382, + "direction_drift_packet_mean": 0.9199324324324325, + "direction_drift_packet_median": 0.8406852102102104, + "direction_drift_packet_trimmed10_mean": 0.8543425675675675, + "direction_drift_total": 0.8785626876876877, + "flow_consistency": 0.06269279279279279, + "kappa2_speed2norm_packet_mean": 0.938386036036036, + "kappa2_speed2norm_packet_median": 0.9512750750750751, + "kappa2_speed2norm_packet_trimmed10_mean": 0.932615015015015, + "kinetic_energy": 0.6070957207207206, + "kinetic_flow": 0.2055, + "kinetic_packet": 0.6707870870870871, + "packet_consistency": 0.1332093093093093, + "pna_flow": 0.5343930930930931, + "pna_packet_max": 0.7741379129129129, + "pna_packet_mean": 0.938386036036036, + "pna_packet_median": 0.9512750750750751, + "pna_packet_trimmed10_mean": 0.932615015015015, + "terminal_flow": 0.24651906906906906, + "terminal_norm": 0.5744000750750752, + "terminal_packet": 0.721492117117117, + "velocity_flow": 0.21634369369369372, + "velocity_packet": 0.4757162912912913, + "velocity_total": 0.3719418918918918 + }, + "DDoS": { + "_n": 666.0, + "arc_length": 0.6549128378378377, + "causal_surprisal_flow": 0.6947655405405405, + "causal_surprisal_packet_max": 0.675013963963964, + "causal_surprisal_packet_mean": 0.2977078078078078, + "causal_surprisal_packet_median": 0.228734984984985, + "causal_surprisal_packet_trimmed10_mean": 0.19569414414414416, + "causal_surprisal_total": 0.31055675675675676, + "consistency_total": 0.7164797297297297, + "curvature_flow": 0.09756666666666666, + "curvature_packet": 0.9273075075075076, + "curvature_total": 0.9067930930930931, + "direction_drift_flow": 0.15628213213213213, + "direction_drift_packet_max": 0.9092247747747747, + "direction_drift_packet_mean": 0.9345572072072074, + "direction_drift_packet_median": 0.8866476726726726, + "direction_drift_packet_trimmed10_mean": 0.8845926426426427, + "direction_drift_total": 0.8828791291291291, + "flow_consistency": 0.751413963963964, + "kappa2_speed2norm_packet_mean": 0.9948181681681683, + "kappa2_speed2norm_packet_median": 0.9885894894894895, + "kappa2_speed2norm_packet_trimmed10_mean": 0.990611111111111, + "kinetic_energy": 0.6566366366366366, + "kinetic_flow": 0.706547072072072, + "kinetic_packet": 0.6552347597597596, + "packet_consistency": 0.2842924924924925, + "pna_flow": 0.038330480480480475, + "pna_packet_max": 0.9551475975975975, + "pna_packet_mean": 0.9948181681681683, + "pna_packet_median": 0.9885894894894895, + "pna_packet_trimmed10_mean": 0.990611111111111, + "terminal_flow": 0.9967079579579579, + "terminal_norm": 0.7600882882882883, + "terminal_packet": 0.7588561561561562, + "velocity_flow": 0.6832614114114114, + "velocity_packet": 0.5255900900900901, + "velocity_total": 0.5792912162162162 + }, + "DoS GoldenEye": { + "_n": 666.0, + "arc_length": 0.6464698198198198, + "causal_surprisal_flow": 0.7162578078078078, + "causal_surprisal_packet_max": 0.6845154654654654, + "causal_surprisal_packet_mean": 0.34994699699699694, + "causal_surprisal_packet_median": 0.13220375375375376, + "causal_surprisal_packet_trimmed10_mean": 0.22134039039039038, + "causal_surprisal_total": 0.276431981981982, + "consistency_total": 0.4591188438438439, + "curvature_flow": 0.08394174174174174, + "curvature_packet": 0.8719936936936938, + "curvature_total": 0.8552604354354355, + "direction_drift_flow": 0.22321291291291293, + "direction_drift_packet_max": 0.8041616366366366, + "direction_drift_packet_mean": 0.8244482732732732, + "direction_drift_packet_median": 0.7978076576576576, + "direction_drift_packet_trimmed10_mean": 0.7816909909909909, + "direction_drift_total": 0.7780391891891892, + "flow_consistency": 0.6088645645645646, + "kappa2_speed2norm_packet_mean": 0.9329202702702702, + "kappa2_speed2norm_packet_median": 0.9248574324324323, + "kappa2_speed2norm_packet_trimmed10_mean": 0.929912087087087, + "kinetic_energy": 0.645963963963964, + "kinetic_flow": 0.8328420420420422, + "kinetic_packet": 0.6318228228228229, + "packet_consistency": 0.2139542042042042, + "pna_flow": 0.027179054054054057, + "pna_packet_max": 0.8505622372372371, + "pna_packet_mean": 0.9329202702702702, + "pna_packet_median": 0.9248574324324323, + "pna_packet_trimmed10_mean": 0.929912087087087, + "terminal_flow": 0.9821929429429429, + "terminal_norm": 0.6705807057057057, + "terminal_packet": 0.697046921921922, + "velocity_flow": 0.7577175675675675, + "velocity_packet": 0.49619819819819816, + "velocity_total": 0.5579850600600601 + }, + "DoS Hulk": { + "_n": 666.0, + "arc_length": 0.6091046546546547, + "causal_surprisal_flow": 0.7186021021021021, + "causal_surprisal_packet_max": 0.8090012012012012, + "causal_surprisal_packet_mean": 0.7522475975975976, + "causal_surprisal_packet_median": 0.3845636636636637, + "causal_surprisal_packet_trimmed10_mean": 0.5320759009009008, + "causal_surprisal_total": 0.3414476726726727, + "consistency_total": 0.27973956456456456, + "curvature_flow": 0.31256981981981985, + "curvature_packet": 0.9238472972972972, + "curvature_total": 0.9157184684684684, + "direction_drift_flow": 0.15122725225225225, + "direction_drift_packet_max": 0.8141361111111111, + "direction_drift_packet_mean": 0.7562383633633634, + "direction_drift_packet_median": 0.753862912912913, + "direction_drift_packet_trimmed10_mean": 0.6685171921921922, + "direction_drift_total": 0.7033648648648648, + "flow_consistency": 0.45900180180180183, + "kappa2_speed2norm_packet_mean": 0.9673738738738739, + "kappa2_speed2norm_packet_median": 0.9472385885885886, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9567436186186187, + "kinetic_energy": 0.6090001501501503, + "kinetic_flow": 0.5830687687687688, + "kinetic_packet": 0.6299162162162162, + "packet_consistency": 0.1561457957957958, + "pna_flow": 0.16471441441441442, + "pna_packet_max": 0.907514864864865, + "pna_packet_mean": 0.9673738738738739, + "pna_packet_median": 0.9472385885885886, + "pna_packet_trimmed10_mean": 0.9567436186186187, + "terminal_flow": 0.735415990990991, + "terminal_norm": 0.5720223723723724, + "terminal_packet": 0.6633635135135135, + "velocity_flow": 0.6122643393393393, + "velocity_packet": 0.52813003003003, + "velocity_total": 0.5514151651651651 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "arc_length": 0.6243016516516516, + "causal_surprisal_flow": 0.2840367867867868, + "causal_surprisal_packet_max": 0.5048167417417417, + "causal_surprisal_packet_mean": 0.27820105105105103, + "causal_surprisal_packet_median": 0.22285825825825828, + "causal_surprisal_packet_trimmed10_mean": 0.18780593093093093, + "causal_surprisal_total": 0.15194459459459458, + "consistency_total": 0.6077822822822823, + "curvature_flow": 0.8500942942942944, + "curvature_packet": 0.9645836336336336, + "curvature_total": 0.9726655405405404, + "direction_drift_flow": 0.3626737237237237, + "direction_drift_packet_max": 0.8549720720720722, + "direction_drift_packet_mean": 0.7569888138138139, + "direction_drift_packet_median": 0.6857968468468469, + "direction_drift_packet_trimmed10_mean": 0.6726095345345345, + "direction_drift_total": 0.7126554804804806, + "flow_consistency": 0.6819993243243242, + "kappa2_speed2norm_packet_mean": 0.9589755255255255, + "kappa2_speed2norm_packet_median": 0.9387682432432433, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9556407657657657, + "kinetic_energy": 0.6217882882882882, + "kinetic_flow": 0.6109768768768769, + "kinetic_packet": 0.6267873873873873, + "packet_consistency": 0.4521012012012012, + "pna_flow": 0.6277331081081081, + "pna_packet_max": 0.8388184684684684, + "pna_packet_mean": 0.9589755255255255, + "pna_packet_median": 0.9387682432432433, + "pna_packet_trimmed10_mean": 0.9556407657657657, + "terminal_flow": 0.8061137387387388, + "terminal_norm": 0.5447397147147147, + "terminal_packet": 0.6251596096096095, + "velocity_flow": 0.7169120870870872, + "velocity_packet": 0.5923165915915916, + "velocity_total": 0.6495857357357357 + }, + "DoS Slowloris": { + "_n": 666.0, + "arc_length": 0.7260903153153153, + "causal_surprisal_flow": 0.07813363363363364, + "causal_surprisal_packet_max": 0.49209339339339336, + "causal_surprisal_packet_mean": 0.2851882132132132, + "causal_surprisal_packet_median": 0.3791439189189189, + "causal_surprisal_packet_trimmed10_mean": 0.27932957957957955, + "causal_surprisal_total": 0.05345435435435435, + "consistency_total": 0.7523212462462461, + "curvature_flow": 0.6770844594594595, + "curvature_packet": 0.877012012012012, + "curvature_total": 0.8367936186186186, + "direction_drift_flow": 0.18583400900900898, + "direction_drift_packet_max": 0.799168918918919, + "direction_drift_packet_mean": 0.597954954954955, + "direction_drift_packet_median": 0.47286463963963965, + "direction_drift_packet_trimmed10_mean": 0.5263732732732733, + "direction_drift_total": 0.537667942942943, + "flow_consistency": 0.7681340840840842, + "kappa2_speed2norm_packet_mean": 0.8354861861861861, + "kappa2_speed2norm_packet_median": 0.7894707207207208, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8163454954954955, + "kinetic_energy": 0.7251545045045045, + "kinetic_flow": 0.7011823573573575, + "kinetic_packet": 0.727484984984985, + "packet_consistency": 0.4654924174174174, + "pna_flow": 0.39388723723723723, + "pna_packet_max": 0.7975924924924926, + "pna_packet_mean": 0.8354861861861861, + "pna_packet_median": 0.7894707207207208, + "pna_packet_trimmed10_mean": 0.8163454954954955, + "terminal_flow": 0.7129396396396397, + "terminal_norm": 0.5196166666666667, + "terminal_packet": 0.6279822072072071, + "velocity_flow": 0.8027068318318319, + "velocity_packet": 0.6346189939939939, + "velocity_total": 0.7239962462462461 + }, + "FTP-Patator": { + "_n": 666.0, + "arc_length": 0.2991004504504504, + "causal_surprisal_flow": 0.962397072072072, + "causal_surprisal_packet_max": 0.814740990990991, + "causal_surprisal_packet_mean": 0.5852768018018019, + "causal_surprisal_packet_median": 0.2377665165165165, + "causal_surprisal_packet_trimmed10_mean": 0.4236932432432432, + "causal_surprisal_total": 0.2643274774774775, + "consistency_total": 0.6699642642642644, + "curvature_flow": 0.7772545795795796, + "curvature_packet": 0.7091581081081081, + "curvature_total": 0.7284933183183183, + "direction_drift_flow": 0.1280927927927928, + "direction_drift_packet_max": 0.8220702702702702, + "direction_drift_packet_mean": 0.9033142642642641, + "direction_drift_packet_median": 0.8914219219219218, + "direction_drift_packet_trimmed10_mean": 0.895474024024024, + "direction_drift_total": 0.8616675675675675, + "flow_consistency": 0.7341286786786786, + "kappa2_speed2norm_packet_mean": 0.8831225225225227, + "kappa2_speed2norm_packet_median": 0.8850995495495495, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9078813063063063, + "kinetic_energy": 0.2961873123123123, + "kinetic_flow": 0.8818797297297296, + "kinetic_packet": 0.4185406906906907, + "packet_consistency": 0.12186666666666668, + "pna_flow": 0.3658481981981982, + "pna_packet_max": 0.7719138138138137, + "pna_packet_mean": 0.8831225225225227, + "pna_packet_median": 0.8850995495495495, + "pna_packet_trimmed10_mean": 0.9078813063063063, + "terminal_flow": 0.4185179429429429, + "terminal_norm": 0.2711722222222222, + "terminal_packet": 0.32926936936936935, + "velocity_flow": 0.732781981981982, + "velocity_packet": 0.4539005255255255, + "velocity_total": 0.42480825825825824 + }, + "Heartbleed": { + "_n": 1.0, + "arc_length": 0.38280000000000003, + "causal_surprisal_flow": 0.006099999999999994, + "causal_surprisal_packet_max": 0.9514, + "causal_surprisal_packet_mean": 0.7726, + "causal_surprisal_packet_median": 0.34919999999999995, + "causal_surprisal_packet_trimmed10_mean": 0.483, + "causal_surprisal_total": 0.028900000000000037, + "consistency_total": 0.7099, + "curvature_flow": 0.016000000000000014, + "curvature_packet": 0.6808000000000001, + "curvature_total": 0.6888000000000001, + "direction_drift_flow": 0.014100000000000001, + "direction_drift_packet_max": 0.819, + "direction_drift_packet_mean": 0.3731, + "direction_drift_packet_median": 0.31079999999999997, + "direction_drift_packet_trimmed10_mean": 0.389, + "direction_drift_total": 0.4629, + "flow_consistency": 0.7399, + "kappa2_speed2norm_packet_mean": 0.6669, + "kappa2_speed2norm_packet_median": 0.7416, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7113, + "kinetic_energy": 0.37360000000000004, + "kinetic_flow": 0.9885999999999999, + "kinetic_packet": 0.5016, + "packet_consistency": 0.29979999999999996, + "pna_flow": 0.006299999999999972, + "pna_packet_max": 0.723, + "pna_packet_mean": 0.6669, + "pna_packet_median": 0.7416, + "pna_packet_trimmed10_mean": 0.7113, + "terminal_flow": 0.9994000000000001, + "terminal_norm": 0.21030000000000004, + "terminal_packet": 0.16790000000000005, + "velocity_flow": 0.9753999999999999, + "velocity_packet": 0.5691999999999999, + "velocity_total": 0.5587 + }, + "Infiltration": { + "_n": 7.0, + "arc_length": 0.3692142857142857, + "causal_surprisal_flow": 0.2628857142857143, + "causal_surprisal_packet_max": 0.8165571428571428, + "causal_surprisal_packet_mean": 0.2844714285714286, + "causal_surprisal_packet_median": 0.20684285714285716, + "causal_surprisal_packet_trimmed10_mean": 0.14821428571428572, + "causal_surprisal_total": 0.0726428571428571, + "consistency_total": 0.6849714285714286, + "curvature_flow": 0.1284, + "curvature_packet": 0.7647714285714287, + "curvature_total": 0.7631714285714286, + "direction_drift_flow": 0.08662857142857142, + "direction_drift_packet_max": 0.7978571428571428, + "direction_drift_packet_mean": 0.6335571428571428, + "direction_drift_packet_median": 0.6079285714285715, + "direction_drift_packet_trimmed10_mean": 0.6140571428571429, + "direction_drift_total": 0.6070428571428571, + "flow_consistency": 0.7105571428571428, + "kappa2_speed2norm_packet_mean": 0.8508857142857144, + "kappa2_speed2norm_packet_median": 0.8690142857142856, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8660285714285714, + "kinetic_energy": 0.36638571428571426, + "kinetic_flow": 0.9434571428571429, + "kinetic_packet": 0.4336428571428571, + "packet_consistency": 0.3141285714285714, + "pna_flow": 0.01841428571428573, + "pna_packet_max": 0.8478857142857144, + "pna_packet_mean": 0.8508857142857144, + "pna_packet_median": 0.8690142857142856, + "pna_packet_trimmed10_mean": 0.8660285714285714, + "terminal_flow": 0.8926571428571428, + "terminal_norm": 0.35382857142857144, + "terminal_packet": 0.37075714285714284, + "velocity_flow": 0.9211571428571428, + "velocity_packet": 0.5779428571428571, + "velocity_total": 0.5544 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "arc_length": 0.7311785285285286, + "causal_surprisal_flow": 0.06461156156156156, + "causal_surprisal_packet_max": 0.35658490990990993, + "causal_surprisal_packet_mean": 0.5019993243243243, + "causal_surprisal_packet_median": 0.49557912912912916, + "causal_surprisal_packet_trimmed10_mean": 0.524500900900901, + "causal_surprisal_total": 0.16055645645645644, + "consistency_total": 0.6366573573573573, + "curvature_flow": 0.23261426426426424, + "curvature_packet": 0.47799054054054063, + "curvature_total": 0.33329264264264263, + "direction_drift_flow": 0.30872657657657654, + "direction_drift_packet_max": 0.335918993993994, + "direction_drift_packet_mean": 0.41973843843843844, + "direction_drift_packet_median": 0.3196772522522522, + "direction_drift_packet_trimmed10_mean": 0.4576112612612613, + "direction_drift_total": 0.23493783783783784, + "flow_consistency": 0.7057104354354354, + "kappa2_speed2norm_packet_mean": 0.6735503003003003, + "kappa2_speed2norm_packet_median": 0.7088816816816818, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7034558558558558, + "kinetic_energy": 0.7325780780780782, + "kinetic_flow": 0.6485305555555556, + "kinetic_packet": 0.4134630630630631, + "packet_consistency": 0.3131469219219219, + "pna_flow": 0.14918108108108108, + "pna_packet_max": 0.5421212462462462, + "pna_packet_mean": 0.6735503003003003, + "pna_packet_median": 0.7088816816816818, + "pna_packet_trimmed10_mean": 0.7034558558558558, + "terminal_flow": 0.36411148648648645, + "terminal_norm": 0.7133224474474475, + "terminal_packet": 0.6903458708708708, + "velocity_flow": 0.4707980480480481, + "velocity_packet": 0.389771021021021, + "velocity_total": 0.6044744744744744 + }, + "Portscan": { + "_n": 666.0, + "arc_length": 0.8266104354354354, + "causal_surprisal_flow": 0.04683678678678679, + "causal_surprisal_packet_max": 0.760328978978979, + "causal_surprisal_packet_mean": 0.9787963963963965, + "causal_surprisal_packet_median": 0.9894214714714715, + "causal_surprisal_packet_trimmed10_mean": 0.9858539039039038, + "causal_surprisal_total": 0.18311081081081082, + "consistency_total": 0.5087325825825826, + "curvature_flow": 0.5589998498498499, + "curvature_packet": 0.6353701201201202, + "curvature_total": 0.6008636636636637, + "direction_drift_flow": 0.40208956456456457, + "direction_drift_packet_max": 0.349033033033033, + "direction_drift_packet_mean": 0.4631990990990992, + "direction_drift_packet_median": 0.4826406906906907, + "direction_drift_packet_trimmed10_mean": 0.49396756756756754, + "direction_drift_total": 0.2593696696696697, + "flow_consistency": 0.5566028528528528, + "kappa2_speed2norm_packet_mean": 0.4319855855855856, + "kappa2_speed2norm_packet_median": 0.46326261261261265, + "kappa2_speed2norm_packet_trimmed10_mean": 0.446971021021021, + "kinetic_energy": 0.8308373873873874, + "kinetic_flow": 0.42830360360360364, + "kinetic_packet": 0.8360187687687689, + "packet_consistency": 0.5878542792792792, + "pna_flow": 0.4752117117117117, + "pna_packet_max": 0.3993578828828829, + "pna_packet_mean": 0.4319855855855856, + "pna_packet_median": 0.46326261261261265, + "pna_packet_trimmed10_mean": 0.446971021021021, + "terminal_flow": 0.30025397897897893, + "terminal_norm": 0.8045287537537538, + "terminal_packet": 0.8894734234234234, + "velocity_flow": 0.45756126126126123, + "velocity_packet": 0.5373810810810811, + "velocity_total": 0.6914942942942942 + }, + "SSH-Patator": { + "_n": 666.0, + "arc_length": 0.13343513513513514, + "causal_surprisal_flow": 0.98295990990991, + "causal_surprisal_packet_max": 0.9004695945945944, + "causal_surprisal_packet_mean": 0.38369421921921915, + "causal_surprisal_packet_median": 0.047006606606606605, + "causal_surprisal_packet_trimmed10_mean": 0.13164084084084082, + "causal_surprisal_total": 0.16266246246246246, + "consistency_total": 0.028255855855855855, + "curvature_flow": 0.8255396396396397, + "curvature_packet": 0.6803654654654654, + "curvature_total": 0.6978627627627627, + "direction_drift_flow": 0.1378261261261261, + "direction_drift_packet_max": 0.9070849849849849, + "direction_drift_packet_mean": 0.8899401651651652, + "direction_drift_packet_median": 0.8478595345345346, + "direction_drift_packet_trimmed10_mean": 0.8832274774774774, + "direction_drift_total": 0.8670103603603603, + "flow_consistency": 0.059865165165165164, + "kappa2_speed2norm_packet_mean": 0.9275053303303303, + "kappa2_speed2norm_packet_median": 0.9150683933933935, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9443768018018018, + "kinetic_energy": 0.12876981981981983, + "kinetic_flow": 0.9386193693693694, + "kinetic_packet": 0.2361716216216216, + "packet_consistency": 0.05940232732732733, + "pna_flow": 0.30158115615615616, + "pna_packet_max": 0.9206147147147148, + "pna_packet_mean": 0.9275053303303303, + "pna_packet_median": 0.9150683933933935, + "pna_packet_trimmed10_mean": 0.9443768018018018, + "terminal_flow": 0.2225243243243243, + "terminal_norm": 0.1538774774774775, + "terminal_packet": 0.1646325075075075, + "velocity_flow": 0.877660135135135, + "velocity_packet": 0.44581426426426424, + "velocity_total": 0.38229414414414414 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "arc_length": 0.259486301369863, + "causal_surprisal_flow": 0.018568493150684883, + "causal_surprisal_packet_max": 0.8969054794520549, + "causal_surprisal_packet_mean": 0.20131506849315067, + "causal_surprisal_packet_median": 0.041276712328767125, + "causal_surprisal_packet_trimmed10_mean": 0.033919178082191775, + "causal_surprisal_total": 0.002747945205479437, + "consistency_total": 0.7114301369863014, + "curvature_flow": 0.0363890410958904, + "curvature_packet": 0.9232493150684933, + "curvature_total": 0.9428178082191782, + "direction_drift_flow": 0.01638767123287668, + "direction_drift_packet_max": 0.8893082191780822, + "direction_drift_packet_mean": 0.5687630136986301, + "direction_drift_packet_median": 0.43628219178082195, + "direction_drift_packet_trimmed10_mean": 0.5204650684931507, + "direction_drift_total": 0.6346438356164383, + "flow_consistency": 0.7468616438356165, + "kappa2_speed2norm_packet_mean": 0.9205561643835617, + "kappa2_speed2norm_packet_median": 0.9251287671232877, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9541506849315068, + "kinetic_energy": 0.2535178082191781, + "kinetic_flow": 0.9867136986301369, + "kinetic_packet": 0.41247123287671233, + "packet_consistency": 0.13681780821917808, + "pna_flow": 0.01285342465753423, + "pna_packet_max": 0.8145041095890411, + "pna_packet_mean": 0.9205561643835617, + "pna_packet_median": 0.9251287671232877, + "pna_packet_trimmed10_mean": 0.9541506849315068, + "terminal_flow": 0.9850465753424659, + "terminal_norm": 0.2411945205479452, + "terminal_packet": 0.21620958904109588, + "velocity_flow": 0.9760712328767124, + "velocity_packet": 0.6486958904109589, + "velocity_total": 0.6272191780821919 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "arc_length": 0.5951076923076923, + "causal_surprisal_flow": 0.7631923076923076, + "causal_surprisal_packet_max": 0.6756307692307693, + "causal_surprisal_packet_mean": 0.5146461538461539, + "causal_surprisal_packet_median": 0.26670000000000005, + "causal_surprisal_packet_trimmed10_mean": 0.4419923076923077, + "causal_surprisal_total": 0.5066769230769231, + "consistency_total": 0.4520923076923077, + "curvature_flow": 0.17482307692307691, + "curvature_packet": 0.9738076923076924, + "curvature_total": 0.9566384615384614, + "direction_drift_flow": 0.3878769230769231, + "direction_drift_packet_max": 0.8172153846153847, + "direction_drift_packet_mean": 0.9552615384615384, + "direction_drift_packet_median": 0.9591, + "direction_drift_packet_trimmed10_mean": 0.9414, + "direction_drift_total": 0.9054692307692308, + "flow_consistency": 0.6118923076923076, + "kappa2_speed2norm_packet_mean": 0.9910307692307693, + "kappa2_speed2norm_packet_median": 0.9919384615384617, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9940307692307692, + "kinetic_energy": 0.5973538461538461, + "kinetic_flow": 0.646723076923077, + "kinetic_packet": 0.5874384615384616, + "packet_consistency": 0.15934615384615386, + "pna_flow": 0.15569230769230769, + "pna_packet_max": 0.8618846153846154, + "pna_packet_mean": 0.9910307692307693, + "pna_packet_median": 0.9919384615384617, + "pna_packet_trimmed10_mean": 0.9940307692307692, + "terminal_flow": 0.9221076923076923, + "terminal_norm": 0.6636307692307692, + "terminal_packet": 0.6833230769230769, + "velocity_flow": 0.5710076923076923, + "velocity_packet": 0.4572, + "velocity_total": 0.4973307692307693 + }, + "Web Attack - XSS": { + "_n": 18.0, + "arc_length": 0.37396666666666667, + "causal_surprisal_flow": 0.002272222222222237, + "causal_surprisal_packet_max": 0.9044, + "causal_surprisal_packet_mean": 0.21874444444444444, + "causal_surprisal_packet_median": 0.03385555555555556, + "causal_surprisal_packet_trimmed10_mean": 0.04711111111111112, + "causal_surprisal_total": 0.0015166666666666662, + "consistency_total": 0.6896888888888889, + "curvature_flow": 0.013872222222222206, + "curvature_packet": 0.9676333333333332, + "curvature_total": 0.9790666666666666, + "direction_drift_flow": 0.014083333333333324, + "direction_drift_packet_max": 0.5460611111111111, + "direction_drift_packet_mean": 0.23574444444444442, + "direction_drift_packet_median": 0.27115555555555554, + "direction_drift_packet_trimmed10_mean": 0.26718333333333333, + "direction_drift_total": 0.29033333333333333, + "flow_consistency": 0.7086888888888888, + "kappa2_speed2norm_packet_mean": 0.9046222222222222, + "kappa2_speed2norm_packet_median": 0.8739611111111112, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9352555555555555, + "kinetic_energy": 0.3678444444444444, + "kinetic_flow": 0.9886944444444444, + "kinetic_packet": 0.49695, + "packet_consistency": 0.5033611111111111, + "pna_flow": 0.0059555555555555655, + "pna_packet_max": 0.8326277777777779, + "pna_packet_mean": 0.9046222222222222, + "pna_packet_median": 0.8739611111111112, + "pna_packet_trimmed10_mean": 0.9352555555555555, + "terminal_flow": 0.999561111111111, + "terminal_norm": 0.25550555555555554, + "terminal_packet": 0.24747777777777777, + "velocity_flow": 0.9776944444444444, + "velocity_packet": 0.7456277777777778, + "velocity_total": 0.7044555555555555 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/legacy_unified_baseline_ddos2019_to_cicids2017.log b/artifacts/route_comparison/cross/legacy_unified_baseline_ddos2019_to_cicids2017.log new file mode 100644 index 0000000..fef2b81 --- /dev/null +++ b/artifacts/route_comparison/cross/legacy_unified_baseline_ddos2019_to_cicids2017.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 2,025,564 target rows; label distribution top: + normal 1,521,748 + Portscan 159,040 + DoS Hulk 158,454 + DDoS 95,144 + Infiltration - Portscan 71,714 +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 19.7s +[eval] scoring attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done in 13.5s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/legacy_unified_baseline_ddos2019_to_cicids2017.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/legacy_unified_baseline_ddos2019_to_cicids2017.npz + +=== overall AUROC top-10 === + kappa2_speed2norm_packet_trimmed10_mean AUROC=0.8599 AUPRC=0.8251 + pna_packet_trimmed10_mean AUROC=0.8599 AUPRC=0.8251 + kappa2_speed2norm_packet_mean AUROC=0.8555 AUPRC=0.8191 + pna_packet_mean AUROC=0.8555 AUPRC=0.8191 + kappa2_speed2norm_packet_median AUROC=0.8524 AUPRC=0.8090 + pna_packet_median AUROC=0.8524 AUPRC=0.8090 + curvature_packet AUROC=0.7953 AUPRC=0.7201 + pna_packet_max AUROC=0.7766 AUPRC=0.6716 + curvature_total AUROC=0.7698 AUPRC=0.7047 + direction_drift_packet_mean AUROC=0.7436 AUPRC=0.6762 diff --git a/artifacts/route_comparison/cross/legacy_unified_baseline_ddos2019_to_cicids2017.npz b/artifacts/route_comparison/cross/legacy_unified_baseline_ddos2019_to_cicids2017.npz new file mode 100644 index 0000000..aff4584 Binary files /dev/null and b/artifacts/route_comparison/cross/legacy_unified_baseline_ddos2019_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/legacy_unified_consistency_cicids2017_to_cicddos2019.json b/artifacts/route_comparison/cross/legacy_unified_consistency_cicids2017_to_cicddos2019.json new file mode 100644 index 0000000..bf39017 --- /dev/null +++ b/artifacts/route_comparison/cross/legacy_unified_consistency_cicids2017_to_cicddos2019.json @@ -0,0 +1,818 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/runs/unified_cfm_cicids2017_consistency_2026_04_25", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.7875133455210239, + "auprc": 0.6701423825519375 + }, + "causal_surprisal_flow": { + "auroc": 0.11618585720089375, + "auprc": 0.320266981454492 + }, + "causal_surprisal_packet_max": { + "auroc": 0.1479054946171034, + "auprc": 0.3272639414578646 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.12272050578915297, + "auprc": 0.3229398208117375 + }, + "causal_surprisal_packet_median": { + "auroc": 0.13090399654682106, + "auprc": 0.3252944614602918 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.1288723491773309, + "auprc": 0.3240266522805968 + }, + "causal_surprisal_total": { + "auroc": 0.07967961100954703, + "auprc": 0.3136592825793692 + }, + "consistency_total": { + "auroc": 0.7432656256347755, + "auprc": 0.6798880701235358 + }, + "curvature_flow": { + "auroc": 0.261476010562665, + "auprc": 0.35719515192557927 + }, + "curvature_packet": { + "auroc": 0.7284363243956937, + "auprc": 0.6355519854131162 + }, + "curvature_total": { + "auroc": 0.640018530367662, + "auprc": 0.5468549470069062 + }, + "direction_drift_flow": { + "auroc": 0.4094033617712777, + "auprc": 0.40865843627085285 + }, + "direction_drift_packet_max": { + "auroc": 0.14034248933577087, + "auprc": 0.3298705395703294 + }, + "direction_drift_packet_mean": { + "auroc": 0.16323159658744668, + "auprc": 0.33489638821235396 + }, + "direction_drift_packet_median": { + "auroc": 0.19107440077188703, + "auprc": 0.341608336341777 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.1775641275644932, + "auprc": 0.3383169751135598 + }, + "direction_drift_total": { + "auroc": 0.12208144424131626, + "auprc": 0.3230933514939516 + }, + "flow_consistency": { + "auroc": 0.7921145287426365, + "auprc": 0.7556270406527789 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.6129066321348771, + "auprc": 0.5436118246580499 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.6310469683120048, + "auprc": 0.5547859601046564 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.6243822262847858, + "auprc": 0.5510115378320501 + }, + "kinetic_energy": { + "auroc": 0.7929457800121876, + "auprc": 0.6763168865511118 + }, + "kinetic_flow": { + "auroc": 0.4973405900873451, + "auprc": 0.44613503137002275 + }, + "kinetic_packet": { + "auroc": 0.8850796668697949, + "auprc": 0.8467910481813422 + }, + "packet_consistency": { + "auroc": 0.4177177991062361, + "auprc": 0.4370733450830451 + }, + "pna_flow": { + "auroc": 0.3797031840341255, + "auprc": 0.39993715805153834 + }, + "pna_packet_max": { + "auroc": 0.49869468819825313, + "auprc": 0.45075488827627364 + }, + "pna_packet_mean": { + "auroc": 0.6129066321348771, + "auprc": 0.5436118246580499 + }, + "pna_packet_median": { + "auroc": 0.6310469683120048, + "auprc": 0.5547859601046564 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.6243822262847858, + "auprc": 0.5510115378320501 + }, + "terminal_flow": { + "auroc": 0.9007913670526102, + "auprc": 0.8776764227413567 + }, + "terminal_norm": { + "auroc": 0.8988302153158643, + "auprc": 0.8859577705335483 + }, + "terminal_packet": { + "auroc": 0.8587995683526304, + "auprc": 0.8014100359743613 + }, + "velocity_flow": { + "auroc": 0.5200195917123704, + "auprc": 0.45815061320688677 + }, + "velocity_packet": { + "auroc": 0.576785466179159, + "auprc": 0.5276312073924048 + }, + "velocity_total": { + "auroc": 0.630691026812919, + "auprc": 0.5195695568643548 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "arc_length": 0.7125438775510204, + "causal_surprisal_flow": 0.009112244897959176, + "causal_surprisal_packet_max": 0.11164761904761905, + "causal_surprisal_packet_mean": 0.08911581632653062, + "causal_surprisal_packet_median": 0.13044047619047622, + "causal_surprisal_packet_trimmed10_mean": 0.0963795918367347, + "causal_surprisal_total": 0.002692857142857137, + "consistency_total": 0.6202667517006802, + "curvature_flow": 0.08551989795918366, + "curvature_packet": 0.5956292517006803, + "curvature_total": 0.44121173469387753, + "direction_drift_flow": 0.5545683673469387, + "direction_drift_packet_max": 0.04652227891156463, + "direction_drift_packet_mean": 0.04389914965986395, + "direction_drift_packet_median": 0.045981292517006805, + "direction_drift_packet_trimmed10_mean": 0.04547891156462585, + "direction_drift_total": 0.043661734693877546, + "flow_consistency": 0.6236965986394557, + "kappa2_speed2norm_packet_mean": 0.28535357142857143, + "kappa2_speed2norm_packet_median": 0.30817976190476193, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2930787414965986, + "kinetic_energy": 0.7241568027210885, + "kinetic_flow": 0.34750544217687074, + "kinetic_packet": 0.9748896258503402, + "packet_consistency": 0.733095918367347, + "pna_flow": 0.5904764455782313, + "pna_packet_max": 0.29868801020408164, + "pna_packet_mean": 0.28535357142857143, + "pna_packet_median": 0.30817976190476193, + "pna_packet_trimmed10_mean": 0.2930787414965986, + "terminal_flow": 0.9893079931972789, + "terminal_norm": 0.9955073129251701, + "terminal_packet": 0.9743357142857143, + "velocity_flow": 0.37260714285714286, + "velocity_packet": 0.8917527210884353, + "velocity_total": 0.5526474489795918 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "arc_length": 0.7001880952380952, + "causal_surprisal_flow": 0.007411734693877543, + "causal_surprisal_packet_max": 0.11557687074829931, + "causal_surprisal_packet_mean": 0.09175221088435374, + "causal_surprisal_packet_median": 0.13462602040816327, + "causal_surprisal_packet_trimmed10_mean": 0.09908911564625851, + "causal_surprisal_total": 0.001912414965986387, + "consistency_total": 0.6123914965986395, + "curvature_flow": 0.07081258503401361, + "curvature_packet": 0.5813258503401361, + "curvature_total": 0.4256377551020408, + "direction_drift_flow": 0.5680002551020408, + "direction_drift_packet_max": 0.04420085034013605, + "direction_drift_packet_mean": 0.04033622448979592, + "direction_drift_packet_median": 0.04142670068027211, + "direction_drift_packet_trimmed10_mean": 0.04093231292517007, + "direction_drift_total": 0.042892517006802716, + "flow_consistency": 0.608546768707483, + "kappa2_speed2norm_packet_mean": 0.257468537414966, + "kappa2_speed2norm_packet_median": 0.2803312074829932, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2640818027210885, + "kinetic_energy": 0.712164455782313, + "kinetic_flow": 0.3376030612244898, + "kinetic_packet": 0.9758146258503401, + "packet_consistency": 0.7613795918367348, + "pna_flow": 0.6089557823129251, + "pna_packet_max": 0.2824615646258503, + "pna_packet_mean": 0.257468537414966, + "pna_packet_median": 0.2803312074829932, + "pna_packet_trimmed10_mean": 0.2640818027210885, + "terminal_flow": 0.996284693877551, + "terminal_norm": 0.9999362244897959, + "terminal_packet": 0.9784122448979592, + "velocity_flow": 0.3627392857142857, + "velocity_packet": 0.9184833333333332, + "velocity_total": 0.5440338435374149 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "arc_length": 0.8656647108843538, + "causal_surprisal_flow": 0.034253741496598634, + "causal_surprisal_packet_max": 0.07695561224489796, + "causal_surprisal_packet_mean": 0.06116989795918368, + "causal_surprisal_packet_median": 0.07304591836734695, + "causal_surprisal_packet_trimmed10_mean": 0.061906632653061226, + "causal_surprisal_total": 0.011273469387755098, + "consistency_total": 0.6536554421768709, + "curvature_flow": 0.215187074829932, + "curvature_packet": 0.815450425170068, + "curvature_total": 0.669299149659864, + "direction_drift_flow": 0.432114880952381, + "direction_drift_packet_max": 0.07345119047619048, + "direction_drift_packet_mean": 0.07253061224489796, + "direction_drift_packet_median": 0.08837738095238096, + "direction_drift_packet_trimmed10_mean": 0.08489175170068028, + "direction_drift_total": 0.05171751700680272, + "flow_consistency": 0.7563183673469388, + "kappa2_speed2norm_packet_mean": 0.6277991496598639, + "kappa2_speed2norm_packet_median": 0.6554153911564625, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6535175170068027, + "kinetic_energy": 0.8743848639455782, + "kinetic_flow": 0.4256269557823129, + "kinetic_packet": 0.9750108843537415, + "packet_consistency": 0.38541530612244895, + "pna_flow": 0.45536267006802716, + "pna_packet_max": 0.5162617346938776, + "pna_packet_mean": 0.6277991496598639, + "pna_packet_median": 0.6554153911564625, + "pna_packet_trimmed10_mean": 0.6535175170068027, + "terminal_flow": 0.9478431972789115, + "terminal_norm": 0.9658866496598639, + "terminal_packet": 0.9527867346938776, + "velocity_flow": 0.45547619047619053, + "velocity_packet": 0.5561619047619047, + "velocity_total": 0.6183635204081633 + }, + "DrDoS_NTP": { + "_n": 588.0, + "arc_length": 0.6053409863945579, + "causal_surprisal_flow": 0.5153178571428572, + "causal_surprisal_packet_max": 0.34265578231292515, + "causal_surprisal_packet_mean": 0.16222772108843536, + "causal_surprisal_packet_median": 0.1250887755102041, + "causal_surprisal_packet_trimmed10_mean": 0.1224326530612245, + "causal_surprisal_total": 0.06873996598639456, + "consistency_total": 0.9084729591836735, + "curvature_flow": 0.2386030612244898, + "curvature_packet": 0.6933882653061225, + "curvature_total": 0.70065, + "direction_drift_flow": 0.3908824829931973, + "direction_drift_packet_max": 0.3944148809523809, + "direction_drift_packet_mean": 0.3418568877551021, + "direction_drift_packet_median": 0.3765835034013606, + "direction_drift_packet_trimmed10_mean": 0.36054396258503396, + "direction_drift_total": 0.416174574829932, + "flow_consistency": 0.9510847789115645, + "kappa2_speed2norm_packet_mean": 0.6712122448979592, + "kappa2_speed2norm_packet_median": 0.6953641156462586, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6874372448979591, + "kinetic_energy": 0.6110830782312926, + "kinetic_flow": 0.5004999149659863, + "kinetic_packet": 0.8221756802721089, + "packet_consistency": 0.0931172619047619, + "pna_flow": 0.3230257653061225, + "pna_packet_max": 0.6108805272108844, + "pna_packet_mean": 0.6712122448979592, + "pna_packet_median": 0.6953641156462586, + "pna_packet_trimmed10_mean": 0.6874372448979591, + "terminal_flow": 0.9556874149659864, + "terminal_norm": 0.6694413265306121, + "terminal_packet": 0.6537133503401361, + "velocity_flow": 0.6196418367346939, + "velocity_packet": 0.43955323129251694, + "velocity_total": 0.3985804421768707 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "arc_length": 0.8839437925170069, + "causal_surprisal_flow": 0.04735221088435373, + "causal_surprisal_packet_max": 0.05124795918367347, + "causal_surprisal_packet_mean": 0.04423299319727891, + "causal_surprisal_packet_median": 0.045081802721088436, + "causal_surprisal_packet_trimmed10_mean": 0.044233163265306116, + "causal_surprisal_total": 0.02545561224489796, + "consistency_total": 0.8663175170068027, + "curvature_flow": 0.45175603741496595, + "curvature_packet": 0.839021343537415, + "curvature_total": 0.7662210034013605, + "direction_drift_flow": 0.37498197278911566, + "direction_drift_packet_max": 0.11202916666666668, + "direction_drift_packet_mean": 0.18934413265306121, + "direction_drift_packet_median": 0.21859897959183675, + "direction_drift_packet_trimmed10_mean": 0.2204003401360544, + "direction_drift_total": 0.07788639455782312, + "flow_consistency": 0.9280260204081634, + "kappa2_speed2norm_packet_mean": 0.8082073129251702, + "kappa2_speed2norm_packet_median": 0.8179928571428571, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8196671768707483, + "kinetic_energy": 0.8824497448979591, + "kinetic_flow": 0.5646566326530612, + "kinetic_packet": 0.9366799319727891, + "packet_consistency": 0.14703537414965986, + "pna_flow": 0.35265714285714284, + "pna_packet_max": 0.5727617346938776, + "pna_packet_mean": 0.8082073129251702, + "pna_packet_median": 0.8179928571428571, + "pna_packet_trimmed10_mean": 0.8196671768707483, + "terminal_flow": 0.7975238095238096, + "terminal_norm": 0.8617197278911565, + "terminal_packet": 0.8054923469387755, + "velocity_flow": 0.5665472789115645, + "velocity_packet": 0.37510569727891163, + "velocity_total": 0.738555612244898 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "arc_length": 0.7068590986394557, + "causal_surprisal_flow": 0.009052040816326521, + "causal_surprisal_packet_max": 0.11167329931972791, + "causal_surprisal_packet_mean": 0.08938010204081633, + "causal_surprisal_packet_median": 0.13102738095238095, + "causal_surprisal_packet_trimmed10_mean": 0.0969170068027211, + "causal_surprisal_total": 0.0031112244897959105, + "consistency_total": 0.6220105442176871, + "curvature_flow": 0.09451462585034014, + "curvature_packet": 0.5916525510204081, + "curvature_total": 0.44299472789115646, + "direction_drift_flow": 0.5604738095238094, + "direction_drift_packet_max": 0.046413775510204085, + "direction_drift_packet_mean": 0.0464547619047619, + "direction_drift_packet_median": 0.04872091836734694, + "direction_drift_packet_trimmed10_mean": 0.04844013605442177, + "direction_drift_total": 0.044169557823129244, + "flow_consistency": 0.6214801020408163, + "kappa2_speed2norm_packet_mean": 0.2795442176870748, + "kappa2_speed2norm_packet_median": 0.3019874149659864, + "kappa2_speed2norm_packet_trimmed10_mean": 0.28611785714285715, + "kinetic_energy": 0.7183248299319727, + "kinetic_flow": 0.34956794217687076, + "kinetic_packet": 0.9738675170068027, + "packet_consistency": 0.7311132653061223, + "pna_flow": 0.6062270408163264, + "pna_packet_max": 0.29053469387755104, + "pna_packet_mean": 0.2795442176870748, + "pna_packet_median": 0.3019874149659864, + "pna_packet_trimmed10_mean": 0.28611785714285715, + "terminal_flow": 0.9866301020408162, + "terminal_norm": 0.9934636054421768, + "terminal_packet": 0.9701535714285715, + "velocity_flow": 0.3718794217687075, + "velocity_packet": 0.8923528911564627, + "velocity_total": 0.5528690476190475 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "arc_length": 0.8333572278911565, + "causal_surprisal_flow": 0.04737193877551021, + "causal_surprisal_packet_max": 0.19444353741496598, + "causal_surprisal_packet_mean": 0.1649937074829932, + "causal_surprisal_packet_median": 0.13926479591836735, + "causal_surprisal_packet_trimmed10_mean": 0.16977397959183674, + "causal_surprisal_total": 0.036165306122448976, + "consistency_total": 0.8282474489795919, + "curvature_flow": 0.2148358843537415, + "curvature_packet": 0.8377656462585034, + "curvature_total": 0.7605454931972789, + "direction_drift_flow": 0.39524583333333335, + "direction_drift_packet_max": 0.10615578231292518, + "direction_drift_packet_mean": 0.13314625850340137, + "direction_drift_packet_median": 0.19573843537414964, + "direction_drift_packet_trimmed10_mean": 0.14941496598639456, + "direction_drift_total": 0.10059540816326532, + "flow_consistency": 0.9275909863945578, + "kappa2_speed2norm_packet_mean": 0.7507076530612246, + "kappa2_speed2norm_packet_median": 0.7599601190476192, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7547423469387755, + "kinetic_energy": 0.839460119047619, + "kinetic_flow": 0.49221556122448973, + "kinetic_packet": 0.9566666666666667, + "packet_consistency": 0.18882270408163265, + "pna_flow": 0.25040017006802723, + "pna_packet_max": 0.5995378401360545, + "pna_packet_mean": 0.7507076530612246, + "pna_packet_median": 0.7599601190476192, + "pna_packet_trimmed10_mean": 0.7547423469387755, + "terminal_flow": 0.9320340986394557, + "terminal_norm": 0.9339100340136055, + "terminal_packet": 0.8928104591836734, + "velocity_flow": 0.5114141156462585, + "velocity_packet": 0.4696256802721089, + "velocity_total": 0.6029873299319728 + }, + "DrDoS_UDP": { + "_n": 588.0, + "arc_length": 0.8486637755102042, + "causal_surprisal_flow": 0.04539727891156463, + "causal_surprisal_packet_max": 0.18604744897959183, + "causal_surprisal_packet_mean": 0.15995731292517007, + "causal_surprisal_packet_median": 0.14210272108843536, + "causal_surprisal_packet_trimmed10_mean": 0.1752462585034014, + "causal_surprisal_total": 0.03563639455782314, + "consistency_total": 0.833081462585034, + "curvature_flow": 0.21878673469387752, + "curvature_packet": 0.8514504251700679, + "curvature_total": 0.7742967687074829, + "direction_drift_flow": 0.3904155612244898, + "direction_drift_packet_max": 0.1088845238095238, + "direction_drift_packet_mean": 0.13212687074829932, + "direction_drift_packet_median": 0.19246870748299316, + "direction_drift_packet_trimmed10_mean": 0.15196207482993196, + "direction_drift_total": 0.09457227891156461, + "flow_consistency": 0.9370449829931973, + "kappa2_speed2norm_packet_mean": 0.7695717687074831, + "kappa2_speed2norm_packet_median": 0.7776378401360543, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7761350340136055, + "kinetic_energy": 0.8545923469387756, + "kinetic_flow": 0.49817295918367344, + "kinetic_packet": 0.9575942176870749, + "packet_consistency": 0.17811624149659866, + "pna_flow": 0.2399469387755102, + "pna_packet_max": 0.6136826530612245, + "pna_packet_mean": 0.7695717687074831, + "pna_packet_median": 0.7776378401360543, + "pna_packet_trimmed10_mean": 0.7761350340136055, + "terminal_flow": 0.9288261904761904, + "terminal_norm": 0.9334035714285714, + "terminal_packet": 0.8982411564625851, + "velocity_flow": 0.5169658163265306, + "velocity_packet": 0.4585214285714286, + "velocity_total": 0.611328231292517 + }, + "LDAP": { + "_n": 588.0, + "arc_length": 0.6974285714285715, + "causal_surprisal_flow": 0.008462074829931963, + "causal_surprisal_packet_max": 0.1160534013605442, + "causal_surprisal_packet_mean": 0.09315204081632651, + "causal_surprisal_packet_median": 0.13741496598639458, + "causal_surprisal_packet_trimmed10_mean": 0.10108248299319729, + "causal_surprisal_total": 0.003730272108843531, + "consistency_total": 0.6115403061224489, + "curvature_flow": 0.06980731292517008, + "curvature_packet": 0.5677324829931972, + "curvature_total": 0.4211955782312925, + "direction_drift_flow": 0.569854081632653, + "direction_drift_packet_max": 0.04401105442176871, + "direction_drift_packet_mean": 0.04014183673469387, + "direction_drift_packet_median": 0.041127721088435376, + "direction_drift_packet_trimmed10_mean": 0.04079914965986395, + "direction_drift_total": 0.042816496598639446, + "flow_consistency": 0.6080399659863945, + "kappa2_speed2norm_packet_mean": 0.24463537414965986, + "kappa2_speed2norm_packet_median": 0.26737176870748297, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2504812925170068, + "kinetic_energy": 0.7090632653061225, + "kinetic_flow": 0.3367913265306122, + "kinetic_packet": 0.9752647959183673, + "packet_consistency": 0.7605418367346939, + "pna_flow": 0.6085289115646257, + "pna_packet_max": 0.2710874149659864, + "pna_packet_mean": 0.24463537414965986, + "pna_packet_median": 0.26737176870748297, + "pna_packet_trimmed10_mean": 0.2504812925170068, + "terminal_flow": 0.9958465986394558, + "terminal_norm": 0.9997190476190476, + "terminal_packet": 0.9781578231292518, + "velocity_flow": 0.3629062925170068, + "velocity_packet": 0.919926700680272, + "velocity_total": 0.5454714285714286 + }, + "MSSQL": { + "_n": 588.0, + "arc_length": 0.8723454081632652, + "causal_surprisal_flow": 0.033744387755102044, + "causal_surprisal_packet_max": 0.07414421768707483, + "causal_surprisal_packet_mean": 0.0589921768707483, + "causal_surprisal_packet_median": 0.06912568027210884, + "causal_surprisal_packet_trimmed10_mean": 0.059569727891156464, + "causal_surprisal_total": 0.010087074829931967, + "consistency_total": 0.6584183673469388, + "curvature_flow": 0.216984693877551, + "curvature_packet": 0.8273051020408164, + "curvature_total": 0.6863918367346938, + "direction_drift_flow": 0.42888928571428575, + "direction_drift_packet_max": 0.07329438775510204, + "direction_drift_packet_mean": 0.07249812925170068, + "direction_drift_packet_median": 0.08882244897959185, + "direction_drift_packet_trimmed10_mean": 0.08509489795918368, + "direction_drift_total": 0.05176309523809523, + "flow_consistency": 0.7696545918367346, + "kappa2_speed2norm_packet_mean": 0.6454847789115646, + "kappa2_speed2norm_packet_median": 0.6719365646258503, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6704792517006803, + "kinetic_energy": 0.8805103741496599, + "kinetic_flow": 0.4310522108843537, + "kinetic_packet": 0.9752938775510205, + "packet_consistency": 0.3643354591836735, + "pna_flow": 0.44194498299319723, + "pna_packet_max": 0.5285732993197279, + "pna_packet_mean": 0.6454847789115646, + "pna_packet_median": 0.6719365646258503, + "pna_packet_trimmed10_mean": 0.6704792517006803, + "terminal_flow": 0.9458345238095237, + "terminal_norm": 0.9649993197278912, + "terminal_packet": 0.9521206632653061, + "velocity_flow": 0.45944081632653067, + "velocity_packet": 0.5457641156462586, + "velocity_total": 0.6208049319727891 + }, + "NetBIOS": { + "_n": 588.0, + "arc_length": 0.8834951530612245, + "causal_surprisal_flow": 0.04593860544217686, + "causal_surprisal_packet_max": 0.05105867346938776, + "causal_surprisal_packet_mean": 0.04416802721088435, + "causal_surprisal_packet_median": 0.04498401360544217, + "causal_surprisal_packet_trimmed10_mean": 0.04416802721088435, + "causal_surprisal_total": 0.02346530612244898, + "consistency_total": 0.8715737244897959, + "curvature_flow": 0.4511436224489796, + "curvature_packet": 0.8450600340136053, + "curvature_total": 0.7727895408163267, + "direction_drift_flow": 0.37369481292517004, + "direction_drift_packet_max": 0.10794149659863946, + "direction_drift_packet_mean": 0.1892738095238095, + "direction_drift_packet_median": 0.21917261904761906, + "direction_drift_packet_trimmed10_mean": 0.2212464285714286, + "direction_drift_total": 0.07698078231292517, + "flow_consistency": 0.9304926870748299, + "kappa2_speed2norm_packet_mean": 0.8149395408163265, + "kappa2_speed2norm_packet_median": 0.8233996598639455, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8252522108843537, + "kinetic_energy": 0.8819215986394557, + "kinetic_flow": 0.5657197278911564, + "kinetic_packet": 0.9360147959183673, + "packet_consistency": 0.14788562925170068, + "pna_flow": 0.3553248299319728, + "pna_packet_max": 0.5722227040816328, + "pna_packet_mean": 0.8149395408163265, + "pna_packet_median": 0.8233996598639455, + "pna_packet_trimmed10_mean": 0.8252522108843537, + "terminal_flow": 0.8039215986394557, + "terminal_norm": 0.8653458333333334, + "terminal_packet": 0.8061350340136055, + "velocity_flow": 0.5675715986394557, + "velocity_packet": 0.37560374149659864, + "velocity_total": 0.7399457482993197 + }, + "Portmap": { + "_n": 588.0, + "arc_length": 0.8804545068027211, + "causal_surprisal_flow": 0.04862448979591836, + "causal_surprisal_packet_max": 0.05246819727891157, + "causal_surprisal_packet_mean": 0.04572619047619047, + "causal_surprisal_packet_median": 0.046742006802721094, + "causal_surprisal_packet_trimmed10_mean": 0.04578316326530612, + "causal_surprisal_total": 0.028428486394557827, + "consistency_total": 0.8684996598639457, + "curvature_flow": 0.4403251700680272, + "curvature_packet": 0.8373214285714285, + "curvature_total": 0.7616867346938776, + "direction_drift_flow": 0.3747114795918367, + "direction_drift_packet_max": 0.10826113945578231, + "direction_drift_packet_mean": 0.1927575680272109, + "direction_drift_packet_median": 0.22124370748299316, + "direction_drift_packet_trimmed10_mean": 0.22389574829931974, + "direction_drift_total": 0.0781063775510204, + "flow_consistency": 0.92925731292517, + "kappa2_speed2norm_packet_mean": 0.8078009353741497, + "kappa2_speed2norm_packet_median": 0.8175656462585035, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8192121598639457, + "kinetic_energy": 0.8789251700680272, + "kinetic_flow": 0.5658243197278913, + "kinetic_packet": 0.9334488945578232, + "packet_consistency": 0.14727525510204081, + "pna_flow": 0.34270688775510205, + "pna_packet_max": 0.5690552721088435, + "pna_packet_mean": 0.8078009353741497, + "pna_packet_median": 0.8175656462585035, + "pna_packet_trimmed10_mean": 0.8192121598639457, + "terminal_flow": 0.8022811224489796, + "terminal_norm": 0.8626707482993198, + "terminal_packet": 0.8028498299319728, + "velocity_flow": 0.5674651360544218, + "velocity_packet": 0.3764442176870748, + "velocity_total": 0.7394320578231293 + }, + "Syn": { + "_n": 588.0, + "arc_length": 0.7221841836734695, + "causal_surprisal_flow": 0.431306037414966, + "causal_surprisal_packet_max": 0.1792154761904762, + "causal_surprisal_packet_mean": 0.22413469387755103, + "causal_surprisal_packet_median": 0.2529321428571428, + "causal_surprisal_packet_trimmed10_mean": 0.2504855442176871, + "causal_surprisal_total": 0.46997840136054425, + "consistency_total": 0.6913013605442178, + "curvature_flow": 0.37502397959183675, + "curvature_packet": 0.5346722789115647, + "curvature_total": 0.49100918367346935, + "direction_drift_flow": 0.19787534013605443, + "direction_drift_packet_max": 0.15599515306122447, + "direction_drift_packet_mean": 0.2679068877551021, + "direction_drift_packet_median": 0.30299778911564623, + "direction_drift_packet_trimmed10_mean": 0.2857003401360544, + "direction_drift_total": 0.15182091836734693, + "flow_consistency": 0.6405359693877551, + "kappa2_speed2norm_packet_mean": 0.5816965986394557, + "kappa2_speed2norm_packet_median": 0.6101685374149659, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6027814625850341, + "kinetic_energy": 0.7210134353741496, + "kinetic_flow": 0.7318270408163265, + "kinetic_packet": 0.5330858843537415, + "packet_consistency": 0.8026341836734695, + "pna_flow": 0.16933001700680272, + "pna_packet_max": 0.4154153911564626, + "pna_packet_mean": 0.5816965986394557, + "pna_packet_median": 0.6101685374149659, + "pna_packet_trimmed10_mean": 0.6027814625850341, + "terminal_flow": 0.8331428571428572, + "terminal_norm": 0.8255082482993197, + "terminal_packet": 0.6877824829931971, + "velocity_flow": 0.7182962585034014, + "velocity_packet": 0.5324005102040816, + "velocity_total": 0.7931935374149659 + }, + "TFTP": { + "_n": 588.0, + "arc_length": 0.8720261904761906, + "causal_surprisal_flow": 0.030431632653061223, + "causal_surprisal_packet_max": 0.22577414965986398, + "causal_surprisal_packet_mean": 0.18461632653061225, + "causal_surprisal_packet_median": 0.1360124149659864, + "causal_surprisal_packet_trimmed10_mean": 0.2028610544217687, + "causal_surprisal_total": 0.03634200680272109, + "consistency_total": 0.8216503401360544, + "curvature_flow": 0.17096785714285714, + "curvature_packet": 0.8714520408163264, + "curvature_total": 0.7901273809523809, + "direction_drift_flow": 0.4153011054421769, + "direction_drift_packet_max": 0.10115527210884354, + "direction_drift_packet_mean": 0.0888858843537415, + "direction_drift_packet_median": 0.1306515306122449, + "direction_drift_packet_trimmed10_mean": 0.1025826530612245, + "direction_drift_total": 0.07257414965986395, + "flow_consistency": 0.8707724489795917, + "kappa2_speed2norm_packet_mean": 0.7249977040816326, + "kappa2_speed2norm_packet_median": 0.7559030612244898, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7381627551020409, + "kinetic_energy": 0.8826171768707483, + "kinetic_flow": 0.4147125850340136, + "kinetic_packet": 0.9723479591836734, + "packet_consistency": 0.4567290816326531, + "pna_flow": 0.3154313775510204, + "pna_packet_max": 0.6177317176870748, + "pna_packet_mean": 0.7249977040816326, + "pna_packet_median": 0.7559030612244898, + "pna_packet_trimmed10_mean": 0.7381627551020409, + "terminal_flow": 0.967065306122449, + "terminal_norm": 0.9580015306122449, + "terminal_packet": 0.9556477891156462, + "velocity_flow": 0.4549151360544218, + "velocity_packet": 0.5542738095238096, + "velocity_total": 0.5761538265306123 + }, + "UDP": { + "_n": 588.0, + "arc_length": 0.8459244897959183, + "causal_surprisal_flow": 0.044471768707483, + "causal_surprisal_packet_max": 0.19537619047619048, + "causal_surprisal_packet_mean": 0.16621921768707482, + "causal_surprisal_packet_median": 0.14453418367346937, + "causal_surprisal_packet_trimmed10_mean": 0.17993673469387753, + "causal_surprisal_total": 0.036163435374149656, + "consistency_total": 0.8466079081632651, + "curvature_flow": 0.21242346938775508, + "curvature_packet": 0.855211649659864, + "curvature_total": 0.7814430272108844, + "direction_drift_flow": 0.38842908163265305, + "direction_drift_packet_max": 0.11101700680272107, + "direction_drift_packet_mean": 0.1395110544217687, + "direction_drift_packet_median": 0.20495272108843537, + "direction_drift_packet_trimmed10_mean": 0.15911666666666668, + "direction_drift_total": 0.10275212585034015, + "flow_consistency": 0.9431843537414967, + "kappa2_speed2norm_packet_mean": 0.777915731292517, + "kappa2_speed2norm_packet_median": 0.7849320578231292, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7828264455782313, + "kinetic_energy": 0.8517234693877551, + "kinetic_flow": 0.49888775510204075, + "kinetic_packet": 0.9568741496598641, + "packet_consistency": 0.17985765306122448, + "pna_flow": 0.23046309523809522, + "pna_packet_max": 0.628111224489796, + "pna_packet_mean": 0.777915731292517, + "pna_packet_median": 0.7849320578231292, + "pna_packet_trimmed10_mean": 0.7828264455782313, + "terminal_flow": 0.9315395408163265, + "terminal_norm": 0.9331953231292517, + "terminal_packet": 0.8955022108843538, + "velocity_flow": 0.5185078231292518, + "velocity_packet": 0.4588252551020407, + "velocity_total": 0.6085304421768708 + }, + "UDPLag": { + "_n": 588.0, + "arc_length": 0.7401234693877551, + "causal_surprisal_flow": 0.34051564625850345, + "causal_surprisal_packet_max": 0.17087772108843538, + "causal_surprisal_packet_mean": 0.2154431972789116, + "causal_surprisal_packet_median": 0.2547954931972789, + "causal_surprisal_packet_trimmed10_mean": 0.23953333333333332, + "causal_surprisal_total": 0.36923724489795917, + "consistency_total": 0.7052502551020409, + "curvature_flow": 0.3745231292517007, + "curvature_packet": 0.5483934523809524, + "curvature_total": 0.508762925170068, + "direction_drift_flow": 0.19444455782312925, + "direction_drift_packet_max": 0.11256139455782313, + "direction_drift_packet_mean": 0.19895688775510204, + "direction_drift_packet_median": 0.23418724489795917, + "direction_drift_packet_trimmed10_mean": 0.21963333333333335, + "direction_drift_total": 0.10936198979591835, + "flow_consistency": 0.6655352040816328, + "kappa2_speed2norm_packet_mean": 0.5931186224489796, + "kappa2_speed2norm_packet_median": 0.619675850340136, + "kappa2_speed2norm_packet_trimmed10_mean": 0.613901530612245, + "kinetic_energy": 0.7397583333333333, + "kinetic_flow": 0.718375850340136, + "kinetic_packet": 0.5682345238095238, + "packet_consistency": 0.7538566326530612, + "pna_flow": 0.18425425170068027, + "pna_packet_max": 0.4194734693877551, + "pna_packet_mean": 0.5931186224489796, + "pna_packet_median": 0.619675850340136, + "pna_packet_trimmed10_mean": 0.613901530612245, + "terminal_flow": 0.854296768707483, + "terminal_norm": 0.8482511054421769, + "terminal_packet": 0.7060603741496598, + "velocity_flow": 0.7104128401360544, + "velocity_packet": 0.5474950680272109, + "velocity_total": 0.789672619047619 + }, + "WebDDoS": { + "_n": 438.0, + "arc_length": 0.6930977168949772, + "causal_surprisal_flow": 0.3312623287671233, + "causal_surprisal_packet_max": 0.2972840182648402, + "causal_surprisal_packet_mean": 0.21433904109589041, + "causal_surprisal_packet_median": 0.24802762557077623, + "causal_surprisal_packet_trimmed10_mean": 0.2262804794520548, + "causal_surprisal_total": 0.23064566210045662, + "consistency_total": 0.5727247716894978, + "curvature_flow": 0.6405897260273974, + "curvature_packet": 0.6776226027397261, + "curvature_total": 0.7018171232876712, + "direction_drift_flow": 0.329621803652968, + "direction_drift_packet_max": 0.8104617579908676, + "direction_drift_packet_mean": 0.7298576484018265, + "direction_drift_packet_median": 0.7363017123287671, + "direction_drift_packet_trimmed10_mean": 0.715748401826484, + "direction_drift_total": 0.6529691780821918, + "flow_consistency": 0.741867808219178, + "kappa2_speed2norm_packet_mean": 0.8358262557077625, + "kappa2_speed2norm_packet_median": 0.8309799086757992, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8287602739726028, + "kinetic_energy": 0.6922385844748858, + "kinetic_flow": 0.7368501141552511, + "kinetic_packet": 0.5333679223744292, + "packet_consistency": 0.21939988584474884, + "pna_flow": 0.37999132420091325, + "pna_packet_max": 0.7304522831050229, + "pna_packet_mean": 0.8358262557077625, + "pna_packet_median": 0.8309799086757992, + "pna_packet_trimmed10_mean": 0.8287602739726028, + "terminal_flow": 0.5579203196347032, + "terminal_norm": 0.5904978310502282, + "terminal_packet": 0.631374200913242, + "velocity_flow": 0.766397602739726, + "velocity_packet": 0.46439041095890404, + "velocity_total": 0.7092069634703196 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/legacy_unified_consistency_cicids2017_to_cicddos2019.log b/artifacts/route_comparison/cross/legacy_unified_consistency_cicids2017_to_cicddos2019.log new file mode 100644 index 0000000..c7c2d24 --- /dev/null +++ b/artifacts/route_comparison/cross/legacy_unified_consistency_cicids2017_to_cicddos2019.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 8,993,376 target rows; label distribution top: + Syn 1,495,248 + NetBIOS 702,760 + UDP 611,999 + MSSQL 523,845 + LDAP 509,665 +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 19.6s +[eval] scoring attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done in 18.2s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/legacy_unified_consistency_cicids2017_to_cicddos2019.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/legacy_unified_consistency_cicids2017_to_cicddos2019.npz + +=== overall AUROC top-10 === + terminal_flow AUROC=0.9008 AUPRC=0.8777 + terminal_norm AUROC=0.8988 AUPRC=0.8860 + kinetic_packet AUROC=0.8851 AUPRC=0.8468 + terminal_packet AUROC=0.8588 AUPRC=0.8014 + kinetic_energy AUROC=0.7929 AUPRC=0.6763 + flow_consistency AUROC=0.7921 AUPRC=0.7556 + arc_length AUROC=0.7875 AUPRC=0.6701 + consistency_total AUROC=0.7433 AUPRC=0.6799 + curvature_packet AUROC=0.7284 AUPRC=0.6356 + curvature_total AUROC=0.6400 AUPRC=0.5469 diff --git a/artifacts/route_comparison/cross/legacy_unified_consistency_cicids2017_to_cicddos2019.npz b/artifacts/route_comparison/cross/legacy_unified_consistency_cicids2017_to_cicddos2019.npz new file mode 100644 index 0000000..702735e Binary files /dev/null and b/artifacts/route_comparison/cross/legacy_unified_consistency_cicids2017_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/legacy_unified_consistency_ddos2019_to_cicids2017.json b/artifacts/route_comparison/cross/legacy_unified_consistency_ddos2019_to_cicids2017.json new file mode 100644 index 0000000..689886c --- /dev/null +++ b/artifacts/route_comparison/cross/legacy_unified_consistency_ddos2019_to_cicids2017.json @@ -0,0 +1,740 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/runs/unified_cfm_cicddos2019_within_consistency_2026_04_25", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.6262296293561724, + "auprc": 0.45093476857327097 + }, + "causal_surprisal_flow": { + "auroc": 0.37970494683992906, + "auprc": 0.37453032226022953 + }, + "causal_surprisal_packet_max": { + "auroc": 0.615011001181335, + "auprc": 0.5070648967828177 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.43405409775546366, + "auprc": 0.3505211208659767 + }, + "causal_surprisal_packet_median": { + "auroc": 0.2884232279976373, + "auprc": 0.2875608508829847 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.3416014619019492, + "auprc": 0.3071220688701325 + }, + "causal_surprisal_total": { + "auroc": 0.18659387182516246, + "auprc": 0.26435530913994054 + }, + "consistency_total": { + "auroc": 0.5729591184288245, + "auprc": 0.4034020496365678 + }, + "curvature_flow": { + "auroc": 0.41371317926757234, + "auprc": 0.34068302233975567 + }, + "curvature_packet": { + "auroc": 0.8768766095688126, + "auprc": 0.8264312805700226 + }, + "curvature_total": { + "auroc": 0.8338130389840519, + "auprc": 0.7754897158442375 + }, + "direction_drift_flow": { + "auroc": 0.2707136518015357, + "auprc": 0.284307380887124 + }, + "direction_drift_packet_max": { + "auroc": 0.7378418783225045, + "auprc": 0.5807290602363934 + }, + "direction_drift_packet_mean": { + "auroc": 0.7296827598936799, + "auprc": 0.5554995614101947 + }, + "direction_drift_packet_median": { + "auroc": 0.717055146190195, + "auprc": 0.5528788798710559 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.716505316007088, + "auprc": 0.5388476084461011 + }, + "direction_drift_total": { + "auroc": 0.6637249704666272, + "auprc": 0.4792921772812212 + }, + "flow_consistency": { + "auroc": 0.5567510558180744, + "auprc": 0.39363271374773956 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.8842326417601891, + "auprc": 0.81794999914567 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.8822311798582397, + "auprc": 0.8062697416201882 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.8828189013585351, + "auprc": 0.8141479614931079 + }, + "kinetic_energy": { + "auroc": 0.6262246898995865, + "auprc": 0.4526274969963216 + }, + "kinetic_flow": { + "auroc": 0.6545052643236857, + "auprc": 0.49551531379409597 + }, + "kinetic_packet": { + "auroc": 0.64621424246899, + "auprc": 0.5107505220206344 + }, + "packet_consistency": { + "auroc": 0.6023535956881276, + "auprc": 0.45616060205287967 + }, + "pna_flow": { + "auroc": 0.2370384672179563, + "auprc": 0.2741269213049544 + }, + "pna_packet_max": { + "auroc": 0.7932708210277615, + "auprc": 0.6375779278065257 + }, + "pna_packet_mean": { + "auroc": 0.8842326417601891, + "auprc": 0.81794999914567 + }, + "pna_packet_median": { + "auroc": 0.8822311798582397, + "auprc": 0.8062697416201882 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.8828189013585351, + "auprc": 0.8141479614931079 + }, + "terminal_flow": { + "auroc": 0.6226939973419965, + "auprc": 0.574276009019455 + }, + "terminal_norm": { + "auroc": 0.6259192188422917, + "auprc": 0.44500886096814085 + }, + "terminal_packet": { + "auroc": 0.6745493724158299, + "auprc": 0.5183458684502145 + }, + "velocity_flow": { + "auroc": 0.6437476668635558, + "auprc": 0.4719088750924078 + }, + "velocity_packet": { + "auroc": 0.6124975782634376, + "auprc": 0.4320407755591039 + }, + "velocity_total": { + "auroc": 0.5651532412876551, + "auprc": 0.39375642029630586 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "arc_length": 0.6496475975975977, + "causal_surprisal_flow": 0.324609009009009, + "causal_surprisal_packet_max": 0.5729827327327327, + "causal_surprisal_packet_mean": 0.5222792792792792, + "causal_surprisal_packet_median": 0.4021629129129129, + "causal_surprisal_packet_trimmed10_mean": 0.46400795795795796, + "causal_surprisal_total": 0.28384624624624627, + "consistency_total": 0.303907057057057, + "curvature_flow": 0.3612048798798799, + "curvature_packet": 0.8017774774774775, + "curvature_total": 0.7520151651651652, + "direction_drift_flow": 0.5047585585585586, + "direction_drift_packet_max": 0.7795807057057057, + "direction_drift_packet_mean": 0.8304749249249248, + "direction_drift_packet_median": 0.8162156906906907, + "direction_drift_packet_trimmed10_mean": 0.7942512012012012, + "direction_drift_total": 0.8000967717717717, + "flow_consistency": 0.33839767267267273, + "kappa2_speed2norm_packet_mean": 0.7905996246246245, + "kappa2_speed2norm_packet_median": 0.7819795795795796, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7377844594594596, + "kinetic_energy": 0.6538814564564566, + "kinetic_flow": 0.3120225225225225, + "kinetic_packet": 0.6965518018018018, + "packet_consistency": 0.3884957957957958, + "pna_flow": 0.48447027027027023, + "pna_packet_max": 0.7628072072072073, + "pna_packet_mean": 0.7905996246246245, + "pna_packet_median": 0.7819795795795796, + "pna_packet_trimmed10_mean": 0.7377844594594596, + "terminal_flow": 0.32777567567567567, + "terminal_norm": 0.6511225975975976, + "terminal_packet": 0.7024564564564565, + "velocity_flow": 0.28342147147147145, + "velocity_packet": 0.5875072072072072, + "velocity_total": 0.414868018018018 + }, + "DDoS": { + "_n": 666.0, + "arc_length": 0.7113022522522522, + "causal_surprisal_flow": 0.42329384384384383, + "causal_surprisal_packet_max": 0.723362162162162, + "causal_surprisal_packet_mean": 0.6886115615615616, + "causal_surprisal_packet_median": 0.245856006006006, + "causal_surprisal_packet_trimmed10_mean": 0.5409029279279279, + "causal_surprisal_total": 0.27340623123123126, + "consistency_total": 0.6835447447447447, + "curvature_flow": 0.15467822822822824, + "curvature_packet": 0.9265481981981981, + "curvature_total": 0.9043196696696697, + "direction_drift_flow": 0.31026884384384384, + "direction_drift_packet_max": 0.8489056306306306, + "direction_drift_packet_mean": 0.7569606606606606, + "direction_drift_packet_median": 0.6966981981981982, + "direction_drift_packet_trimmed10_mean": 0.7078474474474473, + "direction_drift_total": 0.7324762762762763, + "flow_consistency": 0.6696662162162162, + "kappa2_speed2norm_packet_mean": 0.9342721471471472, + "kappa2_speed2norm_packet_median": 0.9045081081081081, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9075081081081081, + "kinetic_energy": 0.7128460960960961, + "kinetic_flow": 0.7163382882882883, + "kinetic_packet": 0.7280018768768769, + "packet_consistency": 0.6279256756756757, + "pna_flow": 0.04944654654654654, + "pna_packet_max": 0.8739297297297296, + "pna_packet_mean": 0.9342721471471472, + "pna_packet_median": 0.9045081081081081, + "pna_packet_trimmed10_mean": 0.9075081081081081, + "terminal_flow": 0.9844593093093095, + "terminal_norm": 0.7807046546546547, + "terminal_packet": 0.7809477477477478, + "velocity_flow": 0.6646564564564563, + "velocity_packet": 0.6467599099099101, + "velocity_total": 0.5889875375375375 + }, + "DoS GoldenEye": { + "_n": 666.0, + "arc_length": 0.7066815315315315, + "causal_surprisal_flow": 0.42576749249249246, + "causal_surprisal_packet_max": 0.8156818318318317, + "causal_surprisal_packet_mean": 0.7253048048048046, + "causal_surprisal_packet_median": 0.34997582582582587, + "causal_surprisal_packet_trimmed10_mean": 0.5539375375375375, + "causal_surprisal_total": 0.24746141141141142, + "consistency_total": 0.7005432432432432, + "curvature_flow": 0.20701921921921923, + "curvature_packet": 0.9679051801801803, + "curvature_total": 0.9595397897897897, + "direction_drift_flow": 0.23795255255255254, + "direction_drift_packet_max": 0.7790599099099099, + "direction_drift_packet_mean": 0.7827398648648649, + "direction_drift_packet_median": 0.7877381381381382, + "direction_drift_packet_trimmed10_mean": 0.7745193693693695, + "direction_drift_total": 0.7595793543543543, + "flow_consistency": 0.6960246246246247, + "kappa2_speed2norm_packet_mean": 0.9419345345345345, + "kappa2_speed2norm_packet_median": 0.9239572072072071, + "kappa2_speed2norm_packet_trimmed10_mean": 0.934362087087087, + "kinetic_energy": 0.7070605105105106, + "kinetic_flow": 0.8467897897897898, + "kinetic_packet": 0.7060601351351352, + "packet_consistency": 0.5632442192192191, + "pna_flow": 0.03942312312312312, + "pna_packet_max": 0.852684084084084, + "pna_packet_mean": 0.9419345345345345, + "pna_packet_median": 0.9239572072072071, + "pna_packet_trimmed10_mean": 0.934362087087087, + "terminal_flow": 0.9672572822822824, + "terminal_norm": 0.7440016516516516, + "terminal_packet": 0.7414216216216216, + "velocity_flow": 0.7738816066066065, + "velocity_packet": 0.6013683933933934, + "velocity_total": 0.5799828078078078 + }, + "DoS Hulk": { + "_n": 666.0, + "arc_length": 0.7134075075075075, + "causal_surprisal_flow": 0.7475741741741742, + "causal_surprisal_packet_max": 0.9054840840840841, + "causal_surprisal_packet_mean": 0.816056006006006, + "causal_surprisal_packet_median": 0.5161770270270271, + "causal_surprisal_packet_trimmed10_mean": 0.6390831831831831, + "causal_surprisal_total": 0.4252158408408408, + "consistency_total": 0.4327382882882883, + "curvature_flow": 0.3585123123123123, + "curvature_packet": 0.9653846846846846, + "curvature_total": 0.9583678678678678, + "direction_drift_flow": 0.2574599099099099, + "direction_drift_packet_max": 0.7526418168168169, + "direction_drift_packet_mean": 0.6586955705705706, + "direction_drift_packet_median": 0.656851051051051, + "direction_drift_packet_trimmed10_mean": 0.624063063063063, + "direction_drift_total": 0.646635960960961, + "flow_consistency": 0.3597714714714715, + "kappa2_speed2norm_packet_mean": 0.9061945195195196, + "kappa2_speed2norm_packet_median": 0.9027223723723723, + "kappa2_speed2norm_packet_trimmed10_mean": 0.895759009009009, + "kinetic_energy": 0.7142184684684686, + "kinetic_flow": 0.7544863363363364, + "kinetic_packet": 0.7343600600600602, + "packet_consistency": 0.6931864864864865, + "pna_flow": 0.117206006006006, + "pna_packet_max": 0.817527177177177, + "pna_packet_mean": 0.9061945195195196, + "pna_packet_median": 0.9027223723723723, + "pna_packet_trimmed10_mean": 0.895759009009009, + "terminal_flow": 0.7336353603603603, + "terminal_norm": 0.69824984984985, + "terminal_packet": 0.7119426426426426, + "velocity_flow": 0.6793666666666667, + "velocity_packet": 0.6933975225225226, + "velocity_total": 0.6190420420420419 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "arc_length": 0.6807626876876878, + "causal_surprisal_flow": 0.06541531531531532, + "causal_surprisal_packet_max": 0.5406318318318318, + "causal_surprisal_packet_mean": 0.37259714714714715, + "causal_surprisal_packet_median": 0.35610990990990987, + "causal_surprisal_packet_trimmed10_mean": 0.3221945945945946, + "causal_surprisal_total": 0.06643348348348348, + "consistency_total": 0.594983033033033, + "curvature_flow": 0.6843139639639638, + "curvature_packet": 0.9558012012012013, + "curvature_total": 0.9578906906906908, + "direction_drift_flow": 0.29199744744744743, + "direction_drift_packet_max": 0.7859307807807808, + "direction_drift_packet_mean": 0.7344983483483484, + "direction_drift_packet_median": 0.6866006756756756, + "direction_drift_packet_trimmed10_mean": 0.6946798048048046, + "direction_drift_total": 0.6947096846846846, + "flow_consistency": 0.553628078078078, + "kappa2_speed2norm_packet_mean": 0.9083713213213213, + "kappa2_speed2norm_packet_median": 0.900617192192192, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9047303303303305, + "kinetic_energy": 0.6814304054054053, + "kinetic_flow": 0.6607307807807807, + "kinetic_packet": 0.6872869369369369, + "packet_consistency": 0.6921205705705706, + "pna_flow": 0.4466752252252253, + "pna_packet_max": 0.8079189189189189, + "pna_packet_mean": 0.9083713213213213, + "pna_packet_median": 0.900617192192192, + "pna_packet_trimmed10_mean": 0.9047303303303305, + "terminal_flow": 0.7508048048048049, + "terminal_norm": 0.7059644144144145, + "terminal_packet": 0.7100441441441442, + "velocity_flow": 0.7220728228228228, + "velocity_packet": 0.624645945945946, + "velocity_total": 0.5989982732732733 + }, + "DoS Slowloris": { + "_n": 666.0, + "arc_length": 0.7099654654654654, + "causal_surprisal_flow": 0.03993618618618619, + "causal_surprisal_packet_max": 0.41281433933933936, + "causal_surprisal_packet_mean": 0.19220675675675675, + "causal_surprisal_packet_median": 0.1572671171171171, + "causal_surprisal_packet_trimmed10_mean": 0.18981726726726728, + "causal_surprisal_total": 0.02571771771771772, + "consistency_total": 0.5869806306306307, + "curvature_flow": 0.5800133633633633, + "curvature_packet": 0.8703858858858858, + "curvature_total": 0.841446996996997, + "direction_drift_flow": 0.18533115615615614, + "direction_drift_packet_max": 0.6768645645645647, + "direction_drift_packet_mean": 0.6017873873873874, + "direction_drift_packet_median": 0.5591769519519519, + "direction_drift_packet_trimmed10_mean": 0.5608473723723724, + "direction_drift_total": 0.5489630630630631, + "flow_consistency": 0.5613913663663663, + "kappa2_speed2norm_packet_mean": 0.7371363363363364, + "kappa2_speed2norm_packet_median": 0.7470385135135136, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7332474474474475, + "kinetic_energy": 0.7092598348348349, + "kinetic_flow": 0.6787507507507509, + "kinetic_packet": 0.7107720720720722, + "packet_consistency": 0.6464211711711711, + "pna_flow": 0.31613063063063057, + "pna_packet_max": 0.7122014264264264, + "pna_packet_mean": 0.7371363363363364, + "pna_packet_median": 0.7470385135135136, + "pna_packet_trimmed10_mean": 0.7332474474474475, + "terminal_flow": 0.7617537537537538, + "terminal_norm": 0.671887987987988, + "terminal_packet": 0.6815673423423424, + "velocity_flow": 0.7839666666666667, + "velocity_packet": 0.7159442942942943, + "velocity_total": 0.70466493993994 + }, + "FTP-Patator": { + "_n": 666.0, + "arc_length": 0.30070367867867864, + "causal_surprisal_flow": 0.7686397147147148, + "causal_surprisal_packet_max": 0.8292686936936936, + "causal_surprisal_packet_mean": 0.3495765015015015, + "causal_surprisal_packet_median": 0.06117717717717718, + "causal_surprisal_packet_trimmed10_mean": 0.08499864864864864, + "causal_surprisal_total": 0.17112357357357358, + "consistency_total": 0.7786504504504503, + "curvature_flow": 0.7494906906906906, + "curvature_packet": 0.7937273273273273, + "curvature_total": 0.8194032282282283, + "direction_drift_flow": 0.1737168918918919, + "direction_drift_packet_max": 0.8954747747747749, + "direction_drift_packet_mean": 0.8816295795795795, + "direction_drift_packet_median": 0.8859483483483483, + "direction_drift_packet_trimmed10_mean": 0.8749962462462463, + "direction_drift_total": 0.8512591591591592, + "flow_consistency": 0.7761603603603603, + "kappa2_speed2norm_packet_mean": 0.9725005255255255, + "kappa2_speed2norm_packet_median": 0.9559292042042041, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9740752252252252, + "kinetic_energy": 0.2953764264264264, + "kinetic_flow": 0.8086416666666667, + "kinetic_packet": 0.3522114864864865, + "packet_consistency": 0.6600346846846847, + "pna_flow": 0.4258394894894895, + "pna_packet_max": 0.8799377627627628, + "pna_packet_mean": 0.9725005255255255, + "pna_packet_median": 0.9559292042042041, + "pna_packet_trimmed10_mean": 0.9740752252252252, + "terminal_flow": 0.6643701951951951, + "terminal_norm": 0.3336397897897898, + "terminal_packet": 0.46486891891891896, + "velocity_flow": 0.6897334084084084, + "velocity_packet": 0.5241551051051051, + "velocity_total": 0.42108813813813806 + }, + "Heartbleed": { + "_n": 1.0, + "arc_length": 0.5331, + "causal_surprisal_flow": 0.011199999999999988, + "causal_surprisal_packet_max": 0.9956, + "causal_surprisal_packet_mean": 0.6356999999999999, + "causal_surprisal_packet_median": 0.029000000000000026, + "causal_surprisal_packet_trimmed10_mean": 0.23099999999999998, + "causal_surprisal_total": 0.01539999999999997, + "consistency_total": 0.10729999999999995, + "curvature_flow": 0.5051, + "curvature_packet": 0.9896, + "curvature_total": 0.9949, + "direction_drift_flow": 0.011399999999999966, + "direction_drift_packet_max": 0.6846, + "direction_drift_packet_mean": 0.5166, + "direction_drift_packet_median": 0.61, + "direction_drift_packet_trimmed10_mean": 0.5523, + "direction_drift_total": 0.5496, + "flow_consistency": 0.0042999999999999705, + "kappa2_speed2norm_packet_mean": 0.9821, + "kappa2_speed2norm_packet_median": 0.9928, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9909, + "kinetic_energy": 0.5297000000000001, + "kinetic_flow": 0.9917999999999999, + "kinetic_packet": 0.48560000000000003, + "packet_consistency": 0.7444, + "pna_flow": 0.00649999999999995, + "pna_packet_max": 0.8573999999999999, + "pna_packet_mean": 0.9821, + "pna_packet_median": 0.9928, + "pna_packet_trimmed10_mean": 0.9909, + "terminal_flow": 0.9808, + "terminal_norm": 0.20220000000000005, + "terminal_packet": 0.252, + "velocity_flow": 0.9866, + "velocity_packet": 0.6732, + "velocity_total": 0.6329 + }, + "Infiltration": { + "_n": 7.0, + "arc_length": 0.42287142857142856, + "causal_surprisal_flow": 0.21074285714285712, + "causal_surprisal_packet_max": 0.8079285714285714, + "causal_surprisal_packet_mean": 0.32881428571428567, + "causal_surprisal_packet_median": 0.19834285714285715, + "causal_surprisal_packet_trimmed10_mean": 0.18274285714285715, + "causal_surprisal_total": 0.058471428571428556, + "consistency_total": 0.6380428571428571, + "curvature_flow": 0.5329999999999999, + "curvature_packet": 0.7820857142857143, + "curvature_total": 0.7861428571428573, + "direction_drift_flow": 0.0642142857142857, + "direction_drift_packet_max": 0.7433714285714286, + "direction_drift_packet_mean": 0.6477428571428571, + "direction_drift_packet_median": 0.6285428571428571, + "direction_drift_packet_trimmed10_mean": 0.6487999999999999, + "direction_drift_total": 0.6405714285714286, + "flow_consistency": 0.5978571428571429, + "kappa2_speed2norm_packet_mean": 0.8085285714285715, + "kappa2_speed2norm_packet_median": 0.8126714285714285, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8068285714285713, + "kinetic_energy": 0.4181285714285714, + "kinetic_flow": 0.9398857142857143, + "kinetic_packet": 0.4137142857142857, + "packet_consistency": 0.544142857142857, + "pna_flow": 0.048428571428571425, + "pna_packet_max": 0.8198428571428571, + "pna_packet_mean": 0.8085285714285715, + "pna_packet_median": 0.8126714285714285, + "pna_packet_trimmed10_mean": 0.8068285714285713, + "terminal_flow": 0.9163714285714286, + "terminal_norm": 0.3693714285714286, + "terminal_packet": 0.41869999999999996, + "velocity_flow": 0.9208, + "velocity_packet": 0.6606285714285715, + "velocity_total": 0.586 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "arc_length": 0.7690935435435436, + "causal_surprisal_flow": 0.04550390390390392, + "causal_surprisal_packet_max": 0.11391861861861863, + "causal_surprisal_packet_mean": 0.13423843843843844, + "causal_surprisal_packet_median": 0.2471096096096096, + "causal_surprisal_packet_trimmed10_mean": 0.17568243243243242, + "causal_surprisal_total": 0.12370015015015015, + "consistency_total": 0.5521958708708709, + "curvature_flow": 0.19953288288288287, + "curvature_packet": 0.7329387387387387, + "curvature_total": 0.5705203453453453, + "direction_drift_flow": 0.21918363363363363, + "direction_drift_packet_max": 0.5145576576576576, + "direction_drift_packet_mean": 0.7066446696696697, + "direction_drift_packet_median": 0.7199420420420422, + "direction_drift_packet_trimmed10_mean": 0.7374268768768769, + "direction_drift_total": 0.4940142642642643, + "flow_consistency": 0.5546695195195196, + "kappa2_speed2norm_packet_mean": 0.8385057057057057, + "kappa2_speed2norm_packet_median": 0.8657983483483483, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8750750750750751, + "kinetic_energy": 0.7717124624624625, + "kinetic_flow": 0.47094864864864866, + "kinetic_packet": 0.6815385135135135, + "packet_consistency": 0.5144855105105105, + "pna_flow": 0.1813346846846847, + "pna_packet_max": 0.6146834834834835, + "pna_packet_mean": 0.8385057057057057, + "pna_packet_median": 0.8657983483483483, + "pna_packet_trimmed10_mean": 0.8750750750750751, + "terminal_flow": 0.3830585585585586, + "terminal_norm": 0.7459358858858858, + "terminal_packet": 0.7877138888888888, + "velocity_flow": 0.414943993993994, + "velocity_packet": 0.5258097597597597, + "velocity_total": 0.5795393393393393 + }, + "Portscan": { + "_n": 666.0, + "arc_length": 0.8480951951951952, + "causal_surprisal_flow": 0.024566366366366374, + "causal_surprisal_packet_max": 0.26566726726726725, + "causal_surprisal_packet_mean": 0.30550668168168166, + "causal_surprisal_packet_median": 0.4846456456456456, + "causal_surprisal_packet_trimmed10_mean": 0.43130412912912913, + "causal_surprisal_total": 0.09413603603603604, + "consistency_total": 0.650896921921922, + "curvature_flow": 0.07037942942942943, + "curvature_packet": 0.9521512012012011, + "curvature_total": 0.7317549549549549, + "direction_drift_flow": 0.17504609609609606, + "direction_drift_packet_max": 0.4688741741741742, + "direction_drift_packet_mean": 0.5968522522522524, + "direction_drift_packet_median": 0.6326927177177177, + "direction_drift_packet_trimmed10_mean": 0.6380397897897898, + "direction_drift_total": 0.33691996996997, + "flow_consistency": 0.598449024024024, + "kappa2_speed2norm_packet_mean": 0.8248736486486488, + "kappa2_speed2norm_packet_median": 0.8717093093093093, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8745363363363364, + "kinetic_energy": 0.8512990990990991, + "kinetic_flow": 0.29974984984984987, + "kinetic_packet": 0.9382075075075074, + "packet_consistency": 0.8261569069069069, + "pna_flow": 0.1752228228228228, + "pna_packet_max": 0.6574013513513515, + "pna_packet_mean": 0.8248736486486488, + "pna_packet_median": 0.8717093093093093, + "pna_packet_trimmed10_mean": 0.8745363363363364, + "terminal_flow": 0.28911471471471467, + "terminal_norm": 0.7987204204204204, + "terminal_packet": 0.9384806306306306, + "velocity_flow": 0.461868018018018, + "velocity_packet": 0.6753462462462463, + "velocity_total": 0.7284136636636637 + }, + "SSH-Patator": { + "_n": 666.0, + "arc_length": 0.21319917417417417, + "causal_surprisal_flow": 0.9821162162162163, + "causal_surprisal_packet_max": 0.9122807807807808, + "causal_surprisal_packet_mean": 0.22540472972972975, + "causal_surprisal_packet_median": 0.06845795795795795, + "causal_surprisal_packet_trimmed10_mean": 0.031572822822822824, + "causal_surprisal_total": 0.17802567567567568, + "consistency_total": 0.41459136636636645, + "curvature_flow": 0.7463953453453452, + "curvature_packet": 0.7975829579579581, + "curvature_total": 0.8278551051051051, + "direction_drift_flow": 0.38616516516516514, + "direction_drift_packet_max": 0.8809433183183184, + "direction_drift_packet_mean": 0.7716047297297297, + "direction_drift_packet_median": 0.7532078828828829, + "direction_drift_packet_trimmed10_mean": 0.7796301801801803, + "direction_drift_total": 0.7837394894894895, + "flow_consistency": 0.42629639639639644, + "kappa2_speed2norm_packet_mean": 0.9812478978978979, + "kappa2_speed2norm_packet_median": 0.9612602102102102, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9808993243243243, + "kinetic_energy": 0.20705352852852854, + "kinetic_flow": 0.9466611111111112, + "kinetic_packet": 0.2739843093093093, + "packet_consistency": 0.4310925675675676, + "pna_flow": 0.16950090090090086, + "pna_packet_max": 0.9513268768768769, + "pna_packet_mean": 0.9812478978978979, + "pna_packet_median": 0.9612602102102102, + "pna_packet_trimmed10_mean": 0.9808993243243243, + "terminal_flow": 0.30656156156156156, + "terminal_norm": 0.17921786786786786, + "terminal_packet": 0.2734314564564565, + "velocity_flow": 0.915181081081081, + "velocity_packet": 0.5168430930930931, + "velocity_total": 0.4051551051051051 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "arc_length": 0.29931232876712327, + "causal_surprisal_flow": 0.03138767123287672, + "causal_surprisal_packet_max": 0.9970369863013699, + "causal_surprisal_packet_mean": 0.45004794520547947, + "causal_surprisal_packet_median": 0.23628493150684932, + "causal_surprisal_packet_trimmed10_mean": 0.19091232876712327, + "causal_surprisal_total": 0.009434246575342465, + "consistency_total": 0.7864972602739726, + "curvature_flow": 0.627695890410959, + "curvature_packet": 0.8834438356164384, + "curvature_total": 0.9097438356164382, + "direction_drift_flow": 0.013471232876712352, + "direction_drift_packet_max": 0.7121013698630138, + "direction_drift_packet_mean": 0.5680157534246576, + "direction_drift_packet_median": 0.567513698630137, + "direction_drift_packet_trimmed10_mean": 0.5933342465753424, + "direction_drift_total": 0.6037506849315069, + "flow_consistency": 0.7905191780821919, + "kappa2_speed2norm_packet_mean": 0.9394835616438356, + "kappa2_speed2norm_packet_median": 0.950790410958904, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9645568493150685, + "kinetic_energy": 0.2885054794520548, + "kinetic_flow": 0.9877123287671233, + "kinetic_packet": 0.2817602739726027, + "packet_consistency": 0.41955205479452057, + "pna_flow": 0.019257534246575347, + "pna_packet_max": 0.7955301369863013, + "pna_packet_mean": 0.9394835616438356, + "pna_packet_median": 0.950790410958904, + "pna_packet_trimmed10_mean": 0.9645568493150685, + "terminal_flow": 0.9845452054794521, + "terminal_norm": 0.2552945205479452, + "terminal_packet": 0.3249643835616438, + "velocity_flow": 0.9844369863013699, + "velocity_packet": 0.6735273972602741, + "velocity_total": 0.6262095890410959 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "arc_length": 0.6993230769230769, + "causal_surprisal_flow": 0.39844615384615384, + "causal_surprisal_packet_max": 0.7791769230769231, + "causal_surprisal_packet_mean": 0.7585461538461538, + "causal_surprisal_packet_median": 0.5506538461538462, + "causal_surprisal_packet_trimmed10_mean": 0.5953384615384616, + "causal_surprisal_total": 0.3269384615384615, + "consistency_total": 0.6586769230769232, + "curvature_flow": 0.17162307692307693, + "curvature_packet": 0.9923538461538461, + "curvature_total": 0.9872000000000001, + "direction_drift_flow": 0.42524615384615383, + "direction_drift_packet_max": 0.7955923076923077, + "direction_drift_packet_mean": 0.8990230769230769, + "direction_drift_packet_median": 0.9004, + "direction_drift_packet_trimmed10_mean": 0.8839384615384616, + "direction_drift_total": 0.8511692307692308, + "flow_consistency": 0.6623, + "kappa2_speed2norm_packet_mean": 0.9750846153846153, + "kappa2_speed2norm_packet_median": 0.939576923076923, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9565076923076924, + "kinetic_energy": 0.7035846153846154, + "kinetic_flow": 0.6980153846153847, + "kinetic_packet": 0.7037461538461539, + "packet_consistency": 0.42562307692307694, + "pna_flow": 0.1053923076923077, + "pna_packet_max": 0.8521615384615384, + "pna_packet_mean": 0.9750846153846153, + "pna_packet_median": 0.939576923076923, + "pna_packet_trimmed10_mean": 0.9565076923076924, + "terminal_flow": 0.8656076923076923, + "terminal_norm": 0.7407538461538461, + "terminal_packet": 0.7363307692307693, + "velocity_flow": 0.5599076923076923, + "velocity_packet": 0.531, + "velocity_total": 0.4892384615384616 + }, + "Web Attack - XSS": { + "_n": 18.0, + "arc_length": 0.48272222222222216, + "causal_surprisal_flow": 0.0011777777777777652, + "causal_surprisal_packet_max": 0.9976055555555555, + "causal_surprisal_packet_mean": 0.48864444444444444, + "causal_surprisal_packet_median": 0.18577222222222223, + "causal_surprisal_packet_trimmed10_mean": 0.19038333333333335, + "causal_surprisal_total": 0.007327777777777797, + "consistency_total": 0.7763, + "curvature_flow": 0.6161555555555556, + "curvature_packet": 0.9662833333333333, + "curvature_total": 0.9802944444444445, + "direction_drift_flow": 0.011561111111111133, + "direction_drift_packet_max": 0.6379944444444444, + "direction_drift_packet_mean": 0.3795, + "direction_drift_packet_median": 0.3242333333333333, + "direction_drift_packet_trimmed10_mean": 0.3443777777777778, + "direction_drift_total": 0.3745833333333333, + "flow_consistency": 0.7702333333333333, + "kappa2_speed2norm_packet_mean": 0.8660833333333333, + "kappa2_speed2norm_packet_median": 0.8349722222222222, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8994833333333333, + "kinetic_energy": 0.4763, + "kinetic_flow": 0.9895388888888889, + "kinetic_packet": 0.4492722222222222, + "packet_consistency": 0.7598777777777778, + "pna_flow": 0.011488888888888875, + "pna_packet_max": 0.8124166666666667, + "pna_packet_mean": 0.8660833333333333, + "pna_packet_median": 0.8349722222222222, + "pna_packet_trimmed10_mean": 0.8994833333333333, + "terminal_flow": 0.99715, + "terminal_norm": 0.3100222222222222, + "terminal_packet": 0.41756111111111105, + "velocity_flow": 0.98605, + "velocity_packet": 0.8900944444444443, + "velocity_total": 0.7598166666666666 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/legacy_unified_consistency_ddos2019_to_cicids2017.log b/artifacts/route_comparison/cross/legacy_unified_consistency_ddos2019_to_cicids2017.log new file mode 100644 index 0000000..4a9eae8 --- /dev/null +++ b/artifacts/route_comparison/cross/legacy_unified_consistency_ddos2019_to_cicids2017.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 2,025,564 target rows; label distribution top: + normal 1,521,748 + Portscan 159,040 + DoS Hulk 158,454 + DDoS 95,144 + Infiltration - Portscan 71,714 +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 19.9s +[eval] scoring attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done in 13.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/legacy_unified_consistency_ddos2019_to_cicids2017.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/legacy_unified_consistency_ddos2019_to_cicids2017.npz + +=== overall AUROC top-10 === + kappa2_speed2norm_packet_mean AUROC=0.8842 AUPRC=0.8179 + pna_packet_mean AUROC=0.8842 AUPRC=0.8179 + kappa2_speed2norm_packet_trimmed10_mean AUROC=0.8828 AUPRC=0.8141 + pna_packet_trimmed10_mean AUROC=0.8828 AUPRC=0.8141 + kappa2_speed2norm_packet_median AUROC=0.8822 AUPRC=0.8063 + pna_packet_median AUROC=0.8822 AUPRC=0.8063 + curvature_packet AUROC=0.8769 AUPRC=0.8264 + curvature_total AUROC=0.8338 AUPRC=0.7755 + pna_packet_max AUROC=0.7933 AUPRC=0.6376 + direction_drift_packet_max AUROC=0.7378 AUPRC=0.5807 diff --git a/artifacts/route_comparison/cross/legacy_unified_consistency_ddos2019_to_cicids2017.npz b/artifacts/route_comparison/cross/legacy_unified_consistency_ddos2019_to_cicids2017.npz new file mode 100644 index 0000000..1f3f3ad Binary files /dev/null and b/artifacts/route_comparison/cross/legacy_unified_consistency_ddos2019_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicddos2019.json b/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicddos2019.json new file mode 100644 index 0000000..bf518f6 --- /dev/null +++ b/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicddos2019.json @@ -0,0 +1,818 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.889500716026813, + "auprc": 0.8962302923413374 + }, + "causal_surprisal_flow": { + "auroc": 0.3203947085110705, + "auprc": 0.37760204308667844 + }, + "causal_surprisal_packet_max": { + "auroc": 0.14309983241925653, + "auprc": 0.3286413842691793 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.1823356134470851, + "auprc": 0.341114242490315 + }, + "causal_surprisal_packet_median": { + "auroc": 0.21347065813528338, + "auprc": 0.3498324973752782 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.1971543520211253, + "auprc": 0.3453694067636989 + }, + "causal_surprisal_total": { + "auroc": 0.31957720394068656, + "auprc": 0.3764184756020496 + }, + "consistency_total": { + "auroc": 0.7960312969733901, + "auprc": 0.7125138058256044 + }, + "curvature_flow": { + "auroc": 0.520259440381881, + "auprc": 0.5136984939639826 + }, + "curvature_packet": { + "auroc": 0.805566275644932, + "auprc": 0.7338510852080206 + }, + "curvature_total": { + "auroc": 0.7928623400365631, + "auprc": 0.6902635718864123 + }, + "direction_drift_flow": { + "auroc": 0.36329030062969736, + "auprc": 0.39213822298246237 + }, + "direction_drift_packet_max": { + "auroc": 0.17277147064797888, + "auprc": 0.3324749252784288 + }, + "direction_drift_packet_mean": { + "auroc": 0.23622609181393459, + "auprc": 0.3511954122653728 + }, + "direction_drift_packet_median": { + "auroc": 0.24103584196628072, + "auprc": 0.3532757114011133 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.24773840138127157, + "auprc": 0.3546888105165522 + }, + "direction_drift_total": { + "auroc": 0.16770903412553323, + "auprc": 0.33212618472080535 + }, + "flow_consistency": { + "auroc": 0.7837246242128784, + "auprc": 0.7117796369285185 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.6321859384521633, + "auprc": 0.6231986957179867 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.6180035598212472, + "auprc": 0.6102964146868521 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.6339534785699777, + "auprc": 0.6293043619101059 + }, + "kinetic_energy": { + "auroc": 0.8894927229331707, + "auprc": 0.8965203262626704 + }, + "kinetic_flow": { + "auroc": 0.7881075106642291, + "auprc": 0.6750153625626959 + }, + "kinetic_packet": { + "auroc": 0.8088577087141987, + "auprc": 0.7719120399842921 + }, + "packet_consistency": { + "auroc": 0.7880273105829778, + "auprc": 0.7044792580992678 + }, + "pna_flow": { + "auroc": 0.3042806774324599, + "auprc": 0.3727354077041822 + }, + "pna_packet_max": { + "auroc": 0.45796482327848875, + "auprc": 0.4691897530267229 + }, + "pna_packet_mean": { + "auroc": 0.6321859384521633, + "auprc": 0.6231986957179867 + }, + "pna_packet_median": { + "auroc": 0.6180035598212472, + "auprc": 0.6102964146868521 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.6339534785699777, + "auprc": 0.6293043619101059 + }, + "terminal_flow": { + "auroc": 0.7124658338411537, + "auprc": 0.6369379334941929 + }, + "terminal_norm": { + "auroc": 0.7973233698964047, + "auprc": 0.7347980764469524 + }, + "terminal_packet": { + "auroc": 0.7825195003046923, + "auprc": 0.7506130701887469 + }, + "velocity_flow": { + "auroc": 0.7859230956733698, + "auprc": 0.6601020368525216 + }, + "velocity_packet": { + "auroc": 0.8011879595774933, + "auprc": 0.7262891567236167 + }, + "velocity_total": { + "auroc": 0.9065068098720291, + "auprc": 0.9157044566981516 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "arc_length": 0.9949028911564626, + "causal_surprisal_flow": 0.28191054421768713, + "causal_surprisal_packet_max": 0.05207942176870747, + "causal_surprisal_packet_mean": 0.07811275510204081, + "causal_surprisal_packet_median": 0.11364506802721089, + "causal_surprisal_packet_trimmed10_mean": 0.09299166666666668, + "causal_surprisal_total": 0.31230586734693877, + "consistency_total": 0.8003477891156462, + "curvature_flow": 0.15247125850340135, + "curvature_packet": 0.9282603741496599, + "curvature_total": 0.7373813775510204, + "direction_drift_flow": 0.3972331632653061, + "direction_drift_packet_max": 0.04122525510204081, + "direction_drift_packet_mean": 0.07310493197278911, + "direction_drift_packet_median": 0.08705918367346939, + "direction_drift_packet_trimmed10_mean": 0.08868707482993197, + "direction_drift_total": 0.04752908163265307, + "flow_consistency": 0.7749263605442177, + "kappa2_speed2norm_packet_mean": 0.6510686224489796, + "kappa2_speed2norm_packet_median": 0.6670914965986394, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6657519557823129, + "kinetic_energy": 0.9950993197278911, + "kinetic_flow": 0.8783683673469388, + "kinetic_packet": 0.9621447278911565, + "packet_consistency": 0.948525, + "pna_flow": 0.10510748299319728, + "pna_packet_max": 0.37068180272108847, + "pna_packet_mean": 0.6510686224489796, + "pna_packet_median": 0.6670914965986394, + "pna_packet_trimmed10_mean": 0.6657519557823129, + "terminal_flow": 0.8825945578231292, + "terminal_norm": 0.9461489795918367, + "terminal_packet": 0.9610392857142858, + "velocity_flow": 0.8262701530612245, + "velocity_packet": 0.945116156462585, + "velocity_total": 0.9927578231292518 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "arc_length": 0.9965841836734693, + "causal_surprisal_flow": 0.2825287414965986, + "causal_surprisal_packet_max": 0.05208996598639455, + "causal_surprisal_packet_mean": 0.07710765306122448, + "causal_surprisal_packet_median": 0.1125360544217687, + "causal_surprisal_packet_trimmed10_mean": 0.09133979591836734, + "causal_surprisal_total": 0.3125421768707483, + "consistency_total": 0.7967159013605443, + "curvature_flow": 0.12303197278911565, + "curvature_packet": 0.93751768707483, + "curvature_total": 0.7400391156462583, + "direction_drift_flow": 0.4050177721088436, + "direction_drift_packet_max": 0.03608392857142857, + "direction_drift_packet_mean": 0.059602721088435374, + "direction_drift_packet_median": 0.07339608843537415, + "direction_drift_packet_trimmed10_mean": 0.07457380952380951, + "direction_drift_total": 0.041405952380952384, + "flow_consistency": 0.7717377551020408, + "kappa2_speed2norm_packet_mean": 0.6333238945578232, + "kappa2_speed2norm_packet_median": 0.6506447278911563, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6485613095238095, + "kinetic_energy": 0.996762925170068, + "kinetic_flow": 0.8824721088435373, + "kinetic_packet": 0.9720125850340137, + "packet_consistency": 0.9600598639455781, + "pna_flow": 0.09334906462585034, + "pna_packet_max": 0.35995586734693874, + "pna_packet_mean": 0.6333238945578232, + "pna_packet_median": 0.6506447278911563, + "pna_packet_trimmed10_mean": 0.6485613095238095, + "terminal_flow": 0.8934107142857143, + "terminal_norm": 0.9517073129251701, + "terminal_packet": 0.9696520408163266, + "velocity_flow": 0.8293091836734693, + "velocity_packet": 0.960445663265306, + "velocity_total": 0.9948925170068027 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "arc_length": 0.9805736394557824, + "causal_surprisal_flow": 0.29016071428571427, + "causal_surprisal_packet_max": 0.05475731292517006, + "causal_surprisal_packet_mean": 0.09658401360544219, + "causal_surprisal_packet_median": 0.13706275510204083, + "causal_surprisal_packet_trimmed10_mean": 0.11923860544217688, + "causal_surprisal_total": 0.33180952380952383, + "consistency_total": 0.8761858843537416, + "curvature_flow": 0.3806308673469388, + "curvature_packet": 0.9051094387755102, + "curvature_total": 0.787883418367347, + "direction_drift_flow": 0.3510477040816326, + "direction_drift_packet_max": 0.0649328231292517, + "direction_drift_packet_mean": 0.13983996598639453, + "direction_drift_packet_median": 0.15355790816326528, + "direction_drift_packet_trimmed10_mean": 0.15967942176870747, + "direction_drift_total": 0.07646284013605442, + "flow_consistency": 0.8759710884353742, + "kappa2_speed2norm_packet_mean": 0.8017098639455782, + "kappa2_speed2norm_packet_median": 0.8105892006802721, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8113762755102041, + "kinetic_energy": 0.9806028911564626, + "kinetic_flow": 0.8807928571428573, + "kinetic_packet": 0.8853681972789116, + "packet_consistency": 0.8337295918367347, + "pna_flow": 0.16555612244897958, + "pna_packet_max": 0.4815015306122449, + "pna_packet_mean": 0.8017098639455782, + "pna_packet_median": 0.8105892006802721, + "pna_packet_trimmed10_mean": 0.8113762755102041, + "terminal_flow": 0.795981462585034, + "terminal_norm": 0.903412074829932, + "terminal_packet": 0.8771688775510204, + "velocity_flow": 0.8635573129251701, + "velocity_packet": 0.8187964285714285, + "velocity_total": 0.9904454081632653 + }, + "DrDoS_NTP": { + "_n": 588.0, + "arc_length": 0.6942488095238094, + "causal_surprisal_flow": 0.7553294217687075, + "causal_surprisal_packet_max": 0.06570867346938776, + "causal_surprisal_packet_mean": 0.11920391156462586, + "causal_surprisal_packet_median": 0.15078571428571427, + "causal_surprisal_packet_trimmed10_mean": 0.13721462585034014, + "causal_surprisal_total": 0.3102948129251701, + "consistency_total": 0.8395295918367347, + "curvature_flow": 0.6551391156462585, + "curvature_packet": 0.9163423469387755, + "curvature_total": 0.9136675170068027, + "direction_drift_flow": 0.29792670068027216, + "direction_drift_packet_max": 0.30443664965986394, + "direction_drift_packet_mean": 0.09869489795918367, + "direction_drift_packet_median": 0.10018503401360543, + "direction_drift_packet_trimmed10_mean": 0.10065263605442176, + "direction_drift_total": 0.23603299319727888, + "flow_consistency": 0.8427936224489795, + "kappa2_speed2norm_packet_mean": 0.5650938775510204, + "kappa2_speed2norm_packet_median": 0.5395772108843537, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5289943027210884, + "kinetic_energy": 0.6943612244897959, + "kinetic_flow": 0.9024659863945578, + "kinetic_packet": 0.8743464285714284, + "packet_consistency": 0.6860906462585035, + "pna_flow": 0.1730576530612245, + "pna_packet_max": 0.7553231292517006, + "pna_packet_mean": 0.5650938775510204, + "pna_packet_median": 0.5395772108843537, + "pna_packet_trimmed10_mean": 0.5289943027210884, + "terminal_flow": 0.8404131802721088, + "terminal_norm": 0.6747417517006804, + "terminal_packet": 0.7139798469387754, + "velocity_flow": 0.9008969387755101, + "velocity_packet": 0.8927160714285715, + "velocity_total": 0.617451700680272 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "arc_length": 0.9357838435374148, + "causal_surprisal_flow": 0.2628384353741497, + "causal_surprisal_packet_max": 0.051203061224489796, + "causal_surprisal_packet_mean": 0.08039574829931974, + "causal_surprisal_packet_median": 0.11351428571428572, + "causal_surprisal_packet_trimmed10_mean": 0.09373928571428572, + "causal_surprisal_total": 0.2934028911564626, + "consistency_total": 0.954784268707483, + "curvature_flow": 0.8544142857142857, + "curvature_packet": 0.6615905612244897, + "curvature_total": 0.8718747448979592, + "direction_drift_flow": 0.31487772108843537, + "direction_drift_packet_max": 0.3324448979591837, + "direction_drift_packet_mean": 0.6324107142857142, + "direction_drift_packet_median": 0.6516853741496598, + "direction_drift_packet_trimmed10_mean": 0.6419512755102041, + "direction_drift_total": 0.36189226190476187, + "flow_consistency": 0.9610181972789116, + "kappa2_speed2norm_packet_mean": 0.849584268707483, + "kappa2_speed2norm_packet_median": 0.8557877551020409, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8575090986394558, + "kinetic_energy": 0.935716156462585, + "kinetic_flow": 0.8516222789115646, + "kinetic_packet": 0.5825190476190476, + "packet_consistency": 0.6945884353741497, + "pna_flow": 0.49246054421768715, + "pna_packet_max": 0.5647211734693878, + "pna_packet_mean": 0.849584268707483, + "pna_packet_median": 0.8557877551020409, + "pna_packet_trimmed10_mean": 0.8575090986394558, + "terminal_flow": 0.6282945578231294, + "terminal_norm": 0.8268591836734694, + "terminal_packet": 0.7285234693877551, + "velocity_flow": 0.8644239795918367, + "velocity_packet": 0.6189706632653061, + "velocity_total": 0.990056462585034 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "arc_length": 0.9965200680272109, + "causal_surprisal_flow": 0.281696768707483, + "causal_surprisal_packet_max": 0.05212636054421768, + "causal_surprisal_packet_mean": 0.07751751700680272, + "causal_surprisal_packet_median": 0.11306615646258503, + "causal_surprisal_packet_trimmed10_mean": 0.09199081632653063, + "causal_surprisal_total": 0.3124416666666666, + "consistency_total": 0.8071324829931973, + "curvature_flow": 0.1567500850340136, + "curvature_packet": 0.9255896258503401, + "curvature_total": 0.7511610544217686, + "direction_drift_flow": 0.3894153911564626, + "direction_drift_packet_max": 0.04552363945578232, + "direction_drift_packet_mean": 0.08008656462585034, + "direction_drift_packet_median": 0.09414812925170069, + "direction_drift_packet_trimmed10_mean": 0.09490561224489795, + "direction_drift_total": 0.05235850340136056, + "flow_consistency": 0.7853969387755102, + "kappa2_speed2norm_packet_mean": 0.6450431972789116, + "kappa2_speed2norm_packet_median": 0.6615166666666665, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6597802721088436, + "kinetic_energy": 0.9966323129251702, + "kinetic_flow": 0.8864571428571429, + "kinetic_packet": 0.9556461734693878, + "packet_consistency": 0.9482034013605442, + "pna_flow": 0.1127090136054422, + "pna_packet_max": 0.36496981292517006, + "pna_packet_mean": 0.6450431972789116, + "pna_packet_median": 0.6615166666666665, + "pna_packet_trimmed10_mean": 0.6597802721088436, + "terminal_flow": 0.8796329931972791, + "terminal_norm": 0.9455477891156464, + "terminal_packet": 0.9582239795918368, + "velocity_flow": 0.8555114795918368, + "velocity_packet": 0.946433163265306, + "velocity_total": 0.9990569727891156 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "arc_length": 0.7589054421768707, + "causal_surprisal_flow": 0.3118295918367347, + "causal_surprisal_packet_max": 0.056958843537414955, + "causal_surprisal_packet_mean": 0.10751224489795919, + "causal_surprisal_packet_median": 0.14665068027210884, + "causal_surprisal_packet_trimmed10_mean": 0.12893826530612246, + "causal_surprisal_total": 0.3194876700680272, + "consistency_total": 0.6509750850340136, + "curvature_flow": 0.7116438775510204, + "curvature_packet": 0.7384877551020408, + "curvature_total": 0.7673501700680272, + "direction_drift_flow": 0.3656801870748299, + "direction_drift_packet_max": 0.12957414965986394, + "direction_drift_packet_mean": 0.16801615646258505, + "direction_drift_packet_median": 0.16823945578231295, + "direction_drift_packet_trimmed10_mean": 0.17607610544217686, + "direction_drift_total": 0.14384209183673471, + "flow_consistency": 0.6136044217687076, + "kappa2_speed2norm_packet_mean": 0.5492897959183674, + "kappa2_speed2norm_packet_median": 0.5464637755102041, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5362049319727891, + "kinetic_energy": 0.7575057823129251, + "kinetic_flow": 0.6842528911564625, + "kinetic_packet": 0.7084207482993198, + "packet_consistency": 0.7471843537414965, + "pna_flow": 0.46973367346938777, + "pna_packet_max": 0.4384152210884354, + "pna_packet_mean": 0.5492897959183674, + "pna_packet_median": 0.5464637755102041, + "pna_packet_trimmed10_mean": 0.5362049319727891, + "terminal_flow": 0.4312231292517006, + "terminal_norm": 0.5238045918367347, + "terminal_packet": 0.5487181972789116, + "velocity_flow": 0.7290031462585034, + "velocity_packet": 0.7764537414965987, + "velocity_total": 0.8339510204081633 + }, + "DrDoS_UDP": { + "_n": 588.0, + "arc_length": 0.7630741496598639, + "causal_surprisal_flow": 0.3117406462585034, + "causal_surprisal_packet_max": 0.057224149659863936, + "causal_surprisal_packet_mean": 0.1092170918367347, + "causal_surprisal_packet_median": 0.14827738095238094, + "causal_surprisal_packet_trimmed10_mean": 0.13107772108843538, + "causal_surprisal_total": 0.3220668367346939, + "consistency_total": 0.6536107142857144, + "curvature_flow": 0.7293859693877552, + "curvature_packet": 0.7185884353741496, + "curvature_total": 0.7641912414965988, + "direction_drift_flow": 0.3636803571428572, + "direction_drift_packet_max": 0.12125399659863945, + "direction_drift_packet_mean": 0.17171292517006803, + "direction_drift_packet_median": 0.17383588435374148, + "direction_drift_packet_trimmed10_mean": 0.1830827380952381, + "direction_drift_total": 0.14061292517006804, + "flow_consistency": 0.6158076530612244, + "kappa2_speed2norm_packet_mean": 0.544072619047619, + "kappa2_speed2norm_packet_median": 0.5377755102040815, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5378098639455782, + "kinetic_energy": 0.7615839285714286, + "kinetic_flow": 0.6812479591836735, + "kinetic_packet": 0.7134630952380953, + "packet_consistency": 0.7450831632653062, + "pna_flow": 0.47480153061224484, + "pna_packet_max": 0.44101377551020404, + "pna_packet_mean": 0.544072619047619, + "pna_packet_median": 0.5377755102040815, + "pna_packet_trimmed10_mean": 0.5378098639455782, + "terminal_flow": 0.42304676870748303, + "terminal_norm": 0.5224993197278911, + "terminal_packet": 0.5497072278911564, + "velocity_flow": 0.7262798469387755, + "velocity_packet": 0.7702896258503401, + "velocity_total": 0.8339687074829932 + }, + "LDAP": { + "_n": 588.0, + "arc_length": 0.997833843537415, + "causal_surprisal_flow": 0.2821329931972789, + "causal_surprisal_packet_max": 0.05329931972789115, + "causal_surprisal_packet_mean": 0.07809489795918367, + "causal_surprisal_packet_median": 0.11310272108843537, + "causal_surprisal_packet_trimmed10_mean": 0.09174795918367347, + "causal_surprisal_total": 0.31172789115646254, + "consistency_total": 0.8026052721088435, + "curvature_flow": 0.12113928571428571, + "curvature_packet": 0.9397833333333334, + "curvature_total": 0.7466181972789117, + "direction_drift_flow": 0.4262515306122449, + "direction_drift_packet_max": 0.035423639455782314, + "direction_drift_packet_mean": 0.058133163265306126, + "direction_drift_packet_median": 0.07191972789115647, + "direction_drift_packet_trimmed10_mean": 0.07391275510204082, + "direction_drift_total": 0.0401702380952381, + "flow_consistency": 0.7811562925170067, + "kappa2_speed2norm_packet_mean": 0.6289354591836736, + "kappa2_speed2norm_packet_median": 0.6449401360544217, + "kappa2_speed2norm_packet_trimmed10_mean": 0.644508418367347, + "kinetic_energy": 0.9980022108843537, + "kinetic_flow": 0.8819102040816327, + "kinetic_packet": 0.974837074829932, + "packet_consistency": 0.9621559523809524, + "pna_flow": 0.09367227891156463, + "pna_packet_max": 0.3555253401360544, + "pna_packet_mean": 0.6289354591836736, + "pna_packet_median": 0.6449401360544217, + "pna_packet_trimmed10_mean": 0.644508418367347, + "terminal_flow": 0.8955666666666667, + "terminal_norm": 0.9541675170068027, + "terminal_packet": 0.9709908163265306, + "velocity_flow": 0.8202136904761905, + "velocity_packet": 0.9622369047619048, + "velocity_total": 0.9954442176870748 + }, + "MSSQL": { + "_n": 588.0, + "arc_length": 0.9774022959183672, + "causal_surprisal_flow": 0.2912763605442177, + "causal_surprisal_packet_max": 0.054917006802721074, + "causal_surprisal_packet_mean": 0.09809489795918366, + "causal_surprisal_packet_median": 0.13842976190476192, + "causal_surprisal_packet_trimmed10_mean": 0.12083078231292517, + "causal_surprisal_total": 0.3348632653061225, + "consistency_total": 0.8781649659863946, + "curvature_flow": 0.41616054421768706, + "curvature_packet": 0.8937539965986396, + "curvature_total": 0.7851171768707482, + "direction_drift_flow": 0.3401206632653061, + "direction_drift_packet_max": 0.06692125850340136, + "direction_drift_packet_mean": 0.14567312925170067, + "direction_drift_packet_median": 0.15930867346938776, + "direction_drift_packet_trimmed10_mean": 0.1654329931972789, + "direction_drift_total": 0.07900272108843537, + "flow_consistency": 0.8787273809523808, + "kappa2_speed2norm_packet_mean": 0.8052469387755101, + "kappa2_speed2norm_packet_median": 0.8138470238095239, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8148051020408162, + "kinetic_energy": 0.9773767006802722, + "kinetic_flow": 0.8791937074829933, + "kinetic_packet": 0.8717178571428572, + "packet_consistency": 0.8265957482993198, + "pna_flow": 0.18121037414965988, + "pna_packet_max": 0.4935284013605442, + "pna_packet_mean": 0.8052469387755101, + "pna_packet_median": 0.8138470238095239, + "pna_packet_trimmed10_mean": 0.8148051020408162, + "terminal_flow": 0.7866369047619048, + "terminal_norm": 0.9014163265306123, + "terminal_packet": 0.8702843537414966, + "velocity_flow": 0.8630488095238095, + "velocity_packet": 0.8059772108843537, + "velocity_total": 0.9892465986394557 + }, + "NetBIOS": { + "_n": 588.0, + "arc_length": 0.9158372448979593, + "causal_surprisal_flow": 0.267609693877551, + "causal_surprisal_packet_max": 0.05205034013605442, + "causal_surprisal_packet_mean": 0.08515238095238095, + "causal_surprisal_packet_median": 0.11829795918367347, + "causal_surprisal_packet_trimmed10_mean": 0.09906275510204081, + "causal_surprisal_total": 0.3072857142857143, + "consistency_total": 0.9526227891156461, + "curvature_flow": 0.8322931972789116, + "curvature_packet": 0.6313646258503403, + "curvature_total": 0.845651700680272, + "direction_drift_flow": 0.307716156462585, + "direction_drift_packet_max": 0.3319899659863946, + "direction_drift_packet_mean": 0.6370333333333333, + "direction_drift_packet_median": 0.6570306122448979, + "direction_drift_packet_trimmed10_mean": 0.646266156462585, + "direction_drift_total": 0.36500578231292513, + "flow_consistency": 0.9598328231292517, + "kappa2_speed2norm_packet_mean": 0.826069387755102, + "kappa2_speed2norm_packet_median": 0.8337892857142858, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8349431972789114, + "kinetic_energy": 0.9157541666666666, + "kinetic_flow": 0.8294404761904762, + "kinetic_packet": 0.5664719387755103, + "packet_consistency": 0.6890996598639455, + "pna_flow": 0.48677602040816326, + "pna_packet_max": 0.5421200680272109, + "pna_packet_mean": 0.826069387755102, + "pna_packet_median": 0.8337892857142858, + "pna_packet_trimmed10_mean": 0.8349431972789114, + "terminal_flow": 0.6267586734693877, + "terminal_norm": 0.8146982993197279, + "terminal_packet": 0.709582993197279, + "velocity_flow": 0.8548773809523811, + "velocity_packet": 0.5899702380952381, + "velocity_total": 0.9825374149659863 + }, + "Portmap": { + "_n": 588.0, + "arc_length": 0.9307849489795917, + "causal_surprisal_flow": 0.26453656462585035, + "causal_surprisal_packet_max": 0.054120068027210894, + "causal_surprisal_packet_mean": 0.08484897959183674, + "causal_surprisal_packet_median": 0.11737619047619048, + "causal_surprisal_packet_trimmed10_mean": 0.09800561224489795, + "causal_surprisal_total": 0.3030295918367347, + "consistency_total": 0.952154081632653, + "curvature_flow": 0.8270544217687075, + "curvature_packet": 0.6605005102040815, + "curvature_total": 0.8505831632653063, + "direction_drift_flow": 0.3279086734693878, + "direction_drift_packet_max": 0.3352316326530612, + "direction_drift_packet_mean": 0.635951275510204, + "direction_drift_packet_median": 0.6544194727891156, + "direction_drift_packet_trimmed10_mean": 0.6452972789115646, + "direction_drift_total": 0.3659335884353741, + "flow_consistency": 0.9589846938775509, + "kappa2_speed2norm_packet_mean": 0.8457761054421769, + "kappa2_speed2norm_packet_median": 0.8490400510204082, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8538080782312925, + "kinetic_energy": 0.9306630952380953, + "kinetic_flow": 0.8442706632653061, + "kinetic_packet": 0.583778231292517, + "packet_consistency": 0.6918433673469387, + "pna_flow": 0.47282823129251705, + "pna_packet_max": 0.5549687074829932, + "pna_packet_mean": 0.8457761054421769, + "pna_packet_median": 0.8490400510204082, + "pna_packet_trimmed10_mean": 0.8538080782312925, + "terminal_flow": 0.6410553571428572, + "terminal_norm": 0.8323937074829932, + "terminal_packet": 0.7295397959183674, + "velocity_flow": 0.8532569727891157, + "velocity_packet": 0.6075343537414967, + "velocity_total": 0.9812727891156463 + }, + "Syn": { + "_n": 588.0, + "arc_length": 0.911989200680272, + "causal_surprisal_flow": 0.2865093537414966, + "causal_surprisal_packet_max": 0.7377591836734695, + "causal_surprisal_packet_mean": 0.794872619047619, + "causal_surprisal_packet_median": 0.8018925170068028, + "causal_surprisal_packet_trimmed10_mean": 0.7953193877551019, + "causal_surprisal_total": 0.3347491496598639, + "consistency_total": 0.8264416666666666, + "curvature_flow": 0.6593556122448979, + "curvature_packet": 0.8172251700680272, + "curvature_total": 0.8335576530612244, + "direction_drift_flow": 0.409543962585034, + "direction_drift_packet_max": 0.28213214285714283, + "direction_drift_packet_mean": 0.2225340986394558, + "direction_drift_packet_median": 0.1697345238095238, + "direction_drift_packet_trimmed10_mean": 0.23553095238095237, + "direction_drift_total": 0.1622312925170068, + "flow_consistency": 0.8222124149659864, + "kappa2_speed2norm_packet_mean": 0.3814607993197279, + "kappa2_speed2norm_packet_median": 0.16788579931972789, + "kappa2_speed2norm_packet_trimmed10_mean": 0.373097619047619, + "kinetic_energy": 0.9144990646258503, + "kinetic_flow": 0.58824268707483, + "kinetic_packet": 0.9706051020408164, + "packet_consistency": 0.8302795918367347, + "pna_flow": 0.42566998299319725, + "pna_packet_max": 0.40221743197278914, + "pna_packet_mean": 0.3814607993197279, + "pna_packet_median": 0.16788579931972789, + "pna_packet_trimmed10_mean": 0.373097619047619, + "terminal_flow": 0.8840056122448979, + "terminal_norm": 0.9344421768707483, + "terminal_packet": 0.9687244897959184, + "velocity_flow": 0.5923721938775509, + "velocity_packet": 0.8584503401360545, + "velocity_total": 0.8485947278911564 + }, + "TFTP": { + "_n": 588.0, + "arc_length": 0.836175, + "causal_surprisal_flow": 0.2940358843537415, + "causal_surprisal_packet_max": 0.06459098639455782, + "causal_surprisal_packet_mean": 0.11746360544217688, + "causal_surprisal_packet_median": 0.1519706632653061, + "causal_surprisal_packet_trimmed10_mean": 0.14004761904761903, + "causal_surprisal_total": 0.2988438775510204, + "consistency_total": 0.7030860544217687, + "curvature_flow": 0.29172636054421763, + "curvature_packet": 0.8762093537414966, + "curvature_total": 0.7447964285714285, + "direction_drift_flow": 0.40979362244897954, + "direction_drift_packet_max": 0.1495908163265306, + "direction_drift_packet_mean": 0.20760425170068028, + "direction_drift_packet_median": 0.2078796768707483, + "direction_drift_packet_trimmed10_mean": 0.22121819727891157, + "direction_drift_total": 0.20232074829931973, + "flow_consistency": 0.679283843537415, + "kappa2_speed2norm_packet_mean": 0.6560138605442177, + "kappa2_speed2norm_packet_median": 0.6638859693877551, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6613388605442178, + "kinetic_energy": 0.8353168367346939, + "kinetic_flow": 0.7335821428571427, + "kinetic_packet": 0.8546167517006803, + "packet_consistency": 0.7960818027210884, + "pna_flow": 0.1493042517006803, + "pna_packet_max": 0.46455977891156464, + "pna_packet_mean": 0.6560138605442177, + "pna_packet_median": 0.6638859693877551, + "pna_packet_trimmed10_mean": 0.6613388605442178, + "terminal_flow": 0.7800585034013607, + "terminal_norm": 0.8550891156462586, + "terminal_packet": 0.7482443027210884, + "velocity_flow": 0.7081811224489797, + "velocity_packet": 0.8134381802721089, + "velocity_total": 0.8363027210884353 + }, + "UDP": { + "_n": 588.0, + "arc_length": 0.7445013605442178, + "causal_surprisal_flow": 0.3124857142857143, + "causal_surprisal_packet_max": 0.0572375850340136, + "causal_surprisal_packet_mean": 0.1101044217687075, + "causal_surprisal_packet_median": 0.1492641156462585, + "causal_surprisal_packet_trimmed10_mean": 0.13203647959183676, + "causal_surprisal_total": 0.32401768707483, + "consistency_total": 0.631056462585034, + "curvature_flow": 0.735297619047619, + "curvature_packet": 0.7198810374149659, + "curvature_total": 0.7615590136054422, + "direction_drift_flow": 0.36320093537414966, + "direction_drift_packet_max": 0.12573826530612245, + "direction_drift_packet_mean": 0.17873979591836736, + "direction_drift_packet_median": 0.18082712585034014, + "direction_drift_packet_trimmed10_mean": 0.1896192176870748, + "direction_drift_total": 0.15054540816326528, + "flow_consistency": 0.5905132653061225, + "kappa2_speed2norm_packet_mean": 0.549910544217687, + "kappa2_speed2norm_packet_median": 0.5447741496598639, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5417287414965986, + "kinetic_energy": 0.7429491496598639, + "kinetic_flow": 0.6625559523809523, + "kinetic_packet": 0.6951744897959183, + "packet_consistency": 0.7423417517006803, + "pna_flow": 0.49780323129251697, + "pna_packet_max": 0.4500128401360544, + "pna_packet_mean": 0.549910544217687, + "pna_packet_median": 0.5447741496598639, + "pna_packet_trimmed10_mean": 0.5417287414965986, + "terminal_flow": 0.40018435374149663, + "terminal_norm": 0.4983974489795918, + "terminal_packet": 0.5276819727891157, + "velocity_flow": 0.7118941326530612, + "velocity_packet": 0.7646110544217687, + "velocity_total": 0.8206835034013606 + }, + "UDPLag": { + "_n": 588.0, + "arc_length": 0.899960544217687, + "causal_surprisal_flow": 0.314281462585034, + "causal_surprisal_packet_max": 0.673551700680272, + "causal_surprisal_packet_mean": 0.728062329931973, + "causal_surprisal_packet_median": 0.7336056972789116, + "causal_surprisal_packet_trimmed10_mean": 0.7266291666666667, + "causal_surprisal_total": 0.3659751700680272, + "consistency_total": 0.8095054421768707, + "curvature_flow": 0.6144809523809523, + "curvature_packet": 0.7744559523809523, + "curvature_total": 0.7845346938775508, + "direction_drift_flow": 0.4057637755102041, + "direction_drift_packet_max": 0.15781726190476192, + "direction_drift_packet_mean": 0.160775, + "direction_drift_packet_median": 0.14925391156462586, + "direction_drift_packet_trimmed10_mean": 0.1751297619047619, + "direction_drift_total": 0.11170518707482993, + "flow_consistency": 0.8039452380952381, + "kappa2_speed2norm_packet_mean": 0.27367312925170073, + "kappa2_speed2norm_packet_median": 0.18209999999999998, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2751795918367347, + "kinetic_energy": 0.9018219387755102, + "kinetic_flow": 0.5873159863945578, + "kinetic_packet": 0.9436008503401361, + "packet_consistency": 0.8039970238095239, + "pna_flow": 0.4061944727891156, + "pna_packet_max": 0.2859752551020408, + "pna_packet_mean": 0.27367312925170073, + "pna_packet_median": 0.18209999999999998, + "pna_packet_trimmed10_mean": 0.2751795918367347, + "terminal_flow": 0.8413288265306124, + "terminal_norm": 0.8922013605442176, + "terminal_packet": 0.9232195578231291, + "velocity_flow": 0.5965736394557823, + "velocity_packet": 0.8562608843537414, + "velocity_total": 0.8564996598639456 + }, + "WebDDoS": { + "_n": 438.0, + "arc_length": 0.7511381278538812, + "causal_surprisal_flow": 0.3679347031963471, + "causal_surprisal_packet_max": 0.2772434931506849, + "causal_surprisal_packet_mean": 0.28305376712328767, + "causal_surprisal_packet_median": 0.28871963470319634, + "causal_surprisal_packet_trimmed10_mean": 0.28341997716894973, + "causal_surprisal_total": 0.34426712328767123, + "consistency_total": 0.5296623287671234, + "curvature_flow": 0.6050705479452055, + "curvature_packet": 0.5966788812785387, + "curvature_total": 0.7926351598173516, + "direction_drift_flow": 0.2793412100456621, + "direction_drift_packet_max": 0.4466656392694064, + "direction_drift_packet_mean": 0.3835006849315069, + "direction_drift_packet_median": 0.3807767123287671, + "direction_drift_packet_trimmed10_mean": 0.3709746575342466, + "direction_drift_total": 0.3104036529680365, + "flow_consistency": 0.5470237442922374, + "kappa2_speed2norm_packet_mean": 0.5096223744292238, + "kappa2_speed2norm_packet_median": 0.5083888127853882, + "kappa2_speed2norm_packet_trimmed10_mean": 0.49683139269406396, + "kinetic_energy": 0.7515353881278538, + "kinetic_flow": 0.7284063926940639, + "kinetic_packet": 0.5766111872146118, + "packet_consistency": 0.38874794520547945, + "pna_flow": 0.3959132420091324, + "pna_packet_max": 0.4605786529680366, + "pna_packet_mean": 0.5096223744292238, + "pna_packet_median": 0.5083888127853882, + "pna_packet_trimmed10_mean": 0.49683139269406396, + "terminal_flow": 0.4027067351598173, + "terminal_norm": 0.5015069634703196, + "terminal_packet": 0.4670813926940639, + "velocity_flow": 0.7578649543378996, + "velocity_packet": 0.5747229452054794, + "velocity_total": 0.8272297945205479 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicddos2019.log b/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicddos2019.log new file mode 100644 index 0000000..742f90c --- /dev/null +++ b/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicddos2019.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 8,993,376 target rows; label distribution top: + Syn 1,495,248 + NetBIOS 702,760 + UDP 611,999 + MSSQL 523,845 + LDAP 509,665 +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 20.7s +[eval] scoring attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done in 19.4s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicddos2019.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicddos2019.npz + +=== overall AUROC top-10 === + velocity_total AUROC=0.9065 AUPRC=0.9157 + arc_length AUROC=0.8895 AUPRC=0.8962 + kinetic_energy AUROC=0.8895 AUPRC=0.8965 + kinetic_packet AUROC=0.8089 AUPRC=0.7719 + curvature_packet AUROC=0.8056 AUPRC=0.7339 + velocity_packet AUROC=0.8012 AUPRC=0.7263 + terminal_norm AUROC=0.7973 AUPRC=0.7348 + consistency_total AUROC=0.7960 AUPRC=0.7125 + curvature_total AUROC=0.7929 AUPRC=0.6903 + kinetic_flow AUROC=0.7881 AUPRC=0.6750 diff --git a/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicddos2019.npz new file mode 100644 index 0000000..a51fca9 Binary files /dev/null and b/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicids2017.json b/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicids2017.json new file mode 100644 index 0000000..c0c9701 --- /dev/null +++ b/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicids2017.json @@ -0,0 +1,740 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.7549558476077968, + "auprc": 0.672447252307651 + }, + "causal_surprisal_flow": { + "auroc": 0.6017674837566449, + "auprc": 0.48765701886640167 + }, + "causal_surprisal_packet_max": { + "auroc": 0.582458845245127, + "auprc": 0.49624509665697897 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.49341134081512106, + "auprc": 0.4585607216039632 + }, + "causal_surprisal_packet_median": { + "auroc": 0.49654057147076197, + "auprc": 0.4639369972377263 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.471811835499114, + "auprc": 0.45218103116239816 + }, + "causal_surprisal_total": { + "auroc": 0.5760183623744831, + "auprc": 0.45552623057073627 + }, + "consistency_total": { + "auroc": 0.6217091996455996, + "auprc": 0.4234460400639763 + }, + "curvature_flow": { + "auroc": 0.4701868650324867, + "auprc": 0.4373130999566287 + }, + "curvature_packet": { + "auroc": 0.8637299468399291, + "auprc": 0.7165340204750023 + }, + "curvature_total": { + "auroc": 0.8493555375073832, + "auprc": 0.7093582841341288 + }, + "direction_drift_flow": { + "auroc": 0.27892362669816895, + "auprc": 0.28600698287301257 + }, + "direction_drift_packet_max": { + "auroc": 0.5508469432959244, + "auprc": 0.46220295635987596 + }, + "direction_drift_packet_mean": { + "auroc": 0.33398003544004723, + "auprc": 0.300940564770979 + }, + "direction_drift_packet_median": { + "auroc": 0.35694831659775544, + "auprc": 0.31035714696905015 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.31170622415829885, + "auprc": 0.2936648850500239 + }, + "direction_drift_total": { + "auroc": 0.39535015505020676, + "auprc": 0.33535442004908556 + }, + "flow_consistency": { + "auroc": 0.6128310248080332, + "auprc": 0.4183779986252697 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.6441740327820437, + "auprc": 0.49715971678411397 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.5714207102776137, + "auprc": 0.4345166922886243 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.5960151284701712, + "auprc": 0.4757731994605184 + }, + "kinetic_energy": { + "auroc": 0.7573916863555819, + "auprc": 0.6749766293897559 + }, + "kinetic_flow": { + "auroc": 0.7674265726520967, + "auprc": 0.5819455362444225 + }, + "kinetic_packet": { + "auroc": 0.8371767277023037, + "auprc": 0.7424101206698931 + }, + "packet_consistency": { + "auroc": 0.7658099970466627, + "auprc": 0.6059496415957056 + }, + "pna_flow": { + "auroc": 0.25874491287655055, + "auprc": 0.2816177475181266 + }, + "pna_packet_max": { + "auroc": 0.7265569403425871, + "auprc": 0.592775230841011 + }, + "pna_packet_mean": { + "auroc": 0.6441740327820437, + "auprc": 0.49715971678411397 + }, + "pna_packet_median": { + "auroc": 0.5714207102776137, + "auprc": 0.4345166922886243 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.5960151284701712, + "auprc": 0.4757731994605184 + }, + "terminal_flow": { + "auroc": 0.8947803307737744, + "auprc": 0.7912996611488823 + }, + "terminal_norm": { + "auroc": 0.8272214855286475, + "auprc": 0.7464446323193901 + }, + "terminal_packet": { + "auroc": 0.8535592882457176, + "auprc": 0.7582782361709718 + }, + "velocity_flow": { + "auroc": 0.7653728366804489, + "auprc": 0.5697818749815611 + }, + "velocity_packet": { + "auroc": 0.8210957767277023, + "auprc": 0.6515755815462403 + }, + "velocity_total": { + "auroc": 0.6909204444772593, + "auprc": 0.6075569558399235 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "arc_length": 0.7057277777777777, + "causal_surprisal_flow": 0.6615969969969969, + "causal_surprisal_packet_max": 0.9434057057057055, + "causal_surprisal_packet_mean": 0.9433588588588588, + "causal_surprisal_packet_median": 0.9429469969969969, + "causal_surprisal_packet_trimmed10_mean": 0.9429363363363363, + "causal_surprisal_total": 0.8743587087087088, + "consistency_total": 0.6962103603603604, + "curvature_flow": 0.08636313813813815, + "curvature_packet": 0.6251945945945946, + "curvature_total": 0.5099237237237237, + "direction_drift_flow": 0.5577512012012013, + "direction_drift_packet_max": 0.20915525525525525, + "direction_drift_packet_mean": 0.20355660660660663, + "direction_drift_packet_median": 0.24344579579579578, + "direction_drift_packet_trimmed10_mean": 0.1864448948948949, + "direction_drift_total": 0.2458457957957958, + "flow_consistency": 0.6837046546546546, + "kappa2_speed2norm_packet_mean": 0.29764361861861865, + "kappa2_speed2norm_packet_median": 0.3210003753753754, + "kappa2_speed2norm_packet_trimmed10_mean": 0.26305968468468466, + "kinetic_energy": 0.7230465465465465, + "kinetic_flow": 0.4121006006006006, + "kinetic_packet": 0.9197791291291291, + "packet_consistency": 0.8995407657657657, + "pna_flow": 0.1497198198198198, + "pna_packet_max": 0.35719609609609604, + "pna_packet_mean": 0.29764361861861865, + "pna_packet_median": 0.3210003753753754, + "pna_packet_trimmed10_mean": 0.26305968468468466, + "terminal_flow": 0.8648788288288287, + "terminal_norm": 0.9206797297297297, + "terminal_packet": 0.9328406156156156, + "velocity_flow": 0.40654159159159164, + "velocity_packet": 0.8772252252252253, + "velocity_total": 0.4883770270270271 + }, + "DDoS": { + "_n": 666.0, + "arc_length": 0.7869374624624623, + "causal_surprisal_flow": 0.7318732732732732, + "causal_surprisal_packet_max": 0.4656866366366366, + "causal_surprisal_packet_mean": 0.12120630630630631, + "causal_surprisal_packet_median": 0.0848602102102102, + "causal_surprisal_packet_trimmed10_mean": 0.0712246996996997, + "causal_surprisal_total": 0.7906850600600601, + "consistency_total": 0.6485463963963966, + "curvature_flow": 0.2367057057057057, + "curvature_packet": 0.8306066066066066, + "curvature_total": 0.7789828828828829, + "direction_drift_flow": 0.31502297297297294, + "direction_drift_packet_max": 0.7062795045045044, + "direction_drift_packet_mean": 0.425350975975976, + "direction_drift_packet_median": 0.49233393393393393, + "direction_drift_packet_trimmed10_mean": 0.3563234234234234, + "direction_drift_total": 0.574631006006006, + "flow_consistency": 0.6374205705705704, + "kappa2_speed2norm_packet_mean": 0.6685756756756757, + "kappa2_speed2norm_packet_median": 0.5026334834834835, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5365716966966967, + "kinetic_energy": 0.7933572072072073, + "kinetic_flow": 0.813996996996997, + "kinetic_packet": 0.8526282282282283, + "packet_consistency": 0.8921219219219219, + "pna_flow": 0.05833498498498499, + "pna_packet_max": 0.8187559309309309, + "pna_packet_mean": 0.6685756756756757, + "pna_packet_median": 0.5026334834834835, + "pna_packet_trimmed10_mean": 0.5365716966966967, + "terminal_flow": 0.9825195195195194, + "terminal_norm": 0.9517138888888889, + "terminal_packet": 0.9273506006006006, + "velocity_flow": 0.7575843093093093, + "velocity_packet": 0.8821744744744745, + "velocity_total": 0.7025714714714716 + }, + "DoS GoldenEye": { + "_n": 666.0, + "arc_length": 0.7453118618618618, + "causal_surprisal_flow": 0.7525827327327329, + "causal_surprisal_packet_max": 0.4899905405405405, + "causal_surprisal_packet_mean": 0.153862012012012, + "causal_surprisal_packet_median": 0.09084144144144143, + "causal_surprisal_packet_trimmed10_mean": 0.0794457957957958, + "causal_surprisal_total": 0.7666819819819819, + "consistency_total": 0.6509146396396397, + "curvature_flow": 0.21007267267267266, + "curvature_packet": 0.8522615615615615, + "curvature_total": 0.8108663663663664, + "direction_drift_flow": 0.2303627627627628, + "direction_drift_packet_max": 0.7936957957957957, + "direction_drift_packet_mean": 0.41455367867867865, + "direction_drift_packet_median": 0.38477364864864866, + "direction_drift_packet_trimmed10_mean": 0.3483092342342342, + "direction_drift_total": 0.5786526276276276, + "flow_consistency": 0.6458863363363363, + "kappa2_speed2norm_packet_mean": 0.6220098348348347, + "kappa2_speed2norm_packet_median": 0.4979937687687688, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5263942942942944, + "kinetic_energy": 0.7493698198198199, + "kinetic_flow": 0.863495045045045, + "kinetic_packet": 0.7914978978978978, + "packet_consistency": 0.8669815315315315, + "pna_flow": 0.03902342342342342, + "pna_packet_max": 0.8266626876876878, + "pna_packet_mean": 0.6220098348348347, + "pna_packet_median": 0.4979937687687688, + "pna_packet_trimmed10_mean": 0.5263942942942944, + "terminal_flow": 0.9779454954954955, + "terminal_norm": 0.9066294294294294, + "terminal_packet": 0.8702860360360362, + "velocity_flow": 0.8310225975975976, + "velocity_packet": 0.8607785285285287, + "velocity_total": 0.6839693693693694 + }, + "DoS Hulk": { + "_n": 666.0, + "arc_length": 0.7089099099099099, + "causal_surprisal_flow": 0.715167117117117, + "causal_surprisal_packet_max": 0.3504383633633633, + "causal_surprisal_packet_mean": 0.12591936936936937, + "causal_surprisal_packet_median": 0.18404309309309308, + "causal_surprisal_packet_trimmed10_mean": 0.09595322822822822, + "causal_surprisal_total": 0.6646144894894894, + "consistency_total": 0.5362263513513513, + "curvature_flow": 0.5123301801801801, + "curvature_packet": 0.8585789039039039, + "curvature_total": 0.8372124624624624, + "direction_drift_flow": 0.42632289789789785, + "direction_drift_packet_max": 0.5864293543543544, + "direction_drift_packet_mean": 0.1654942192192192, + "direction_drift_packet_median": 0.20383423423423422, + "direction_drift_packet_trimmed10_mean": 0.13013513513513514, + "direction_drift_total": 0.22616801801801803, + "flow_consistency": 0.4608931681681681, + "kappa2_speed2norm_packet_mean": 0.5765138138138137, + "kappa2_speed2norm_packet_median": 0.42888423423423416, + "kappa2_speed2norm_packet_trimmed10_mean": 0.43614677177177175, + "kinetic_energy": 0.7064942942942943, + "kinetic_flow": 0.7823594594594595, + "kinetic_packet": 0.8244426426426426, + "packet_consistency": 0.9497453453453453, + "pna_flow": 0.20873490990990995, + "pna_packet_max": 0.83451006006006, + "pna_packet_mean": 0.5765138138138137, + "pna_packet_median": 0.42888423423423416, + "pna_packet_trimmed10_mean": 0.43614677177177175, + "terminal_flow": 0.9212603603603602, + "terminal_norm": 0.8528864864864866, + "terminal_packet": 0.8593715465465466, + "velocity_flow": 0.8067696696696697, + "velocity_packet": 0.941450075075075, + "velocity_total": 0.7710322072072073 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "arc_length": 0.8563565315315315, + "causal_surprisal_flow": 0.7633909909909912, + "causal_surprisal_packet_max": 0.8323396396396398, + "causal_surprisal_packet_mean": 0.7321615615615616, + "causal_surprisal_packet_median": 0.6950160660660661, + "causal_surprisal_packet_trimmed10_mean": 0.6931653153153153, + "causal_surprisal_total": 0.8658478978978978, + "consistency_total": 0.5956949699699698, + "curvature_flow": 0.4779644894894895, + "curvature_packet": 0.942726051051051, + "curvature_total": 0.9361902402402404, + "direction_drift_flow": 0.23156801801801802, + "direction_drift_packet_max": 0.6400009759759758, + "direction_drift_packet_mean": 0.4348491741741742, + "direction_drift_packet_median": 0.4877222972972973, + "direction_drift_packet_trimmed10_mean": 0.38782372372372376, + "direction_drift_total": 0.5601425675675675, + "flow_consistency": 0.5944905405405404, + "kappa2_speed2norm_packet_mean": 0.6259966966966967, + "kappa2_speed2norm_packet_median": 0.5759630630630631, + "kappa2_speed2norm_packet_trimmed10_mean": 0.559356006006006, + "kinetic_energy": 0.855984084084084, + "kinetic_flow": 0.7802963213213213, + "kinetic_packet": 0.8956957957957957, + "packet_consistency": 0.7699960960960962, + "pna_flow": 0.1827006006006006, + "pna_packet_max": 0.6824348348348348, + "pna_packet_mean": 0.6259966966966967, + "pna_packet_median": 0.5759630630630631, + "pna_packet_trimmed10_mean": 0.559356006006006, + "terminal_flow": 0.8966417417417418, + "terminal_norm": 0.8837346846846846, + "terminal_packet": 0.8936280780780781, + "velocity_flow": 0.7767570570570571, + "velocity_packet": 0.8696042792792793, + "velocity_total": 0.7021432432432432 + }, + "DoS Slowloris": { + "_n": 666.0, + "arc_length": 0.8289655405405405, + "causal_surprisal_flow": 0.6240866366366367, + "causal_surprisal_packet_max": 0.708265015015015, + "causal_surprisal_packet_mean": 0.7191193693693694, + "causal_surprisal_packet_median": 0.7488246246246246, + "causal_surprisal_packet_trimmed10_mean": 0.7172533033033033, + "causal_surprisal_total": 0.6117300300300302, + "consistency_total": 0.5741374624624624, + "curvature_flow": 0.5436432432432432, + "curvature_packet": 0.9423650150150149, + "curvature_total": 0.9515954954954955, + "direction_drift_flow": 0.16071606606606606, + "direction_drift_packet_max": 0.4209162162162162, + "direction_drift_packet_mean": 0.22211756756756756, + "direction_drift_packet_median": 0.25989902402402404, + "direction_drift_packet_trimmed10_mean": 0.20002282282282283, + "direction_drift_total": 0.22139887387387386, + "flow_consistency": 0.5953953453453454, + "kappa2_speed2norm_packet_mean": 0.5980936936936937, + "kappa2_speed2norm_packet_median": 0.5510957957957957, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5527189189189189, + "kinetic_energy": 0.8265193693693692, + "kinetic_flow": 0.7507025525525525, + "kinetic_packet": 0.9112447447447448, + "packet_consistency": 0.5550828828828829, + "pna_flow": 0.27555060060060066, + "pna_packet_max": 0.6224501501501503, + "pna_packet_mean": 0.5980936936936937, + "pna_packet_median": 0.5510957957957957, + "pna_packet_trimmed10_mean": 0.5527189189189189, + "terminal_flow": 0.8489770270270269, + "terminal_norm": 0.8718879129129129, + "terminal_packet": 0.8839932432432432, + "velocity_flow": 0.7855768768768768, + "velocity_packet": 0.8619652402402402, + "velocity_total": 0.7588614114114114 + }, + "FTP-Patator": { + "_n": 666.0, + "arc_length": 0.5160975975975977, + "causal_surprisal_flow": 0.7546762762762763, + "causal_surprisal_packet_max": 0.7972048798798799, + "causal_surprisal_packet_mean": 0.7868738738738739, + "causal_surprisal_packet_median": 0.774072822822823, + "causal_surprisal_packet_trimmed10_mean": 0.7813891891891893, + "causal_surprisal_total": 0.5473597597597598, + "consistency_total": 0.6357559309309309, + "curvature_flow": 0.0376762012012012, + "curvature_packet": 0.9336064564564563, + "curvature_total": 0.9229171171171171, + "direction_drift_flow": 0.47040262762762763, + "direction_drift_packet_max": 0.6703792792792792, + "direction_drift_packet_mean": 0.5480524024024024, + "direction_drift_packet_median": 0.5627737237237237, + "direction_drift_packet_trimmed10_mean": 0.5152091591591592, + "direction_drift_total": 0.8107463963963963, + "flow_consistency": 0.6500055555555556, + "kappa2_speed2norm_packet_mean": 0.8756484234234234, + "kappa2_speed2norm_packet_median": 0.8284476726726726, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8648469969969971, + "kinetic_energy": 0.5184121621621621, + "kinetic_flow": 0.806498048048048, + "kinetic_packet": 0.7876268768768768, + "packet_consistency": 0.48176906906906913, + "pna_flow": 0.017134534534534538, + "pna_packet_max": 0.8427259009009009, + "pna_packet_mean": 0.8756484234234234, + "pna_packet_median": 0.8284476726726726, + "pna_packet_trimmed10_mean": 0.8648469969969971, + "terminal_flow": 0.9678276276276276, + "terminal_norm": 0.7020536036036036, + "terminal_packet": 0.8016626126126125, + "velocity_flow": 0.7626205705705706, + "velocity_packet": 0.6758006006006007, + "velocity_total": 0.3726004504504504 + }, + "Heartbleed": { + "_n": 1.0, + "arc_length": 0.9698, + "causal_surprisal_flow": 0.38360000000000005, + "causal_surprisal_packet_max": 0.010700000000000043, + "causal_surprisal_packet_mean": 0.0040000000000000036, + "causal_surprisal_packet_median": 0.0014999999999999458, + "causal_surprisal_packet_trimmed10_mean": 0.0027000000000000357, + "causal_surprisal_total": 0.00019999999999997797, + "consistency_total": 0.6908, + "curvature_flow": 0.8542000000000001, + "curvature_packet": 0.7926, + "curvature_total": 0.7913, + "direction_drift_flow": 0.007600000000000051, + "direction_drift_packet_max": 0.24, + "direction_drift_packet_mean": 0.02180000000000004, + "direction_drift_packet_median": 0.03500000000000003, + "direction_drift_packet_trimmed10_mean": 0.026499999999999968, + "direction_drift_total": 0.029000000000000026, + "flow_consistency": 0.6551, + "kappa2_speed2norm_packet_mean": 0.10599999999999998, + "kappa2_speed2norm_packet_median": 0.15649999999999997, + "kappa2_speed2norm_packet_trimmed10_mean": 0.10929999999999995, + "kinetic_energy": 0.9669, + "kinetic_flow": 0.9999, + "kinetic_packet": 0.9045, + "packet_consistency": 0.9933, + "pna_flow": 0.006000000000000005, + "pna_packet_max": 0.5006999999999999, + "pna_packet_mean": 0.10599999999999998, + "pna_packet_median": 0.15649999999999997, + "pna_packet_trimmed10_mean": 0.10929999999999995, + "terminal_flow": 0.9814, + "terminal_norm": 0.33409999999999995, + "terminal_packet": 0.4413, + "velocity_flow": 0.9948, + "velocity_packet": 0.9844, + "velocity_total": 0.9822 + }, + "Infiltration": { + "_n": 7.0, + "arc_length": 0.9254428571428571, + "causal_surprisal_flow": 0.5132142857142857, + "causal_surprisal_packet_max": 0.25734285714285715, + "causal_surprisal_packet_mean": 0.15302857142857143, + "causal_surprisal_packet_median": 0.14368571428571425, + "causal_surprisal_packet_trimmed10_mean": 0.13807142857142854, + "causal_surprisal_total": 0.18748571428571428, + "consistency_total": 0.6736714285714286, + "curvature_flow": 0.6025285714285714, + "curvature_packet": 0.9278000000000001, + "curvature_total": 0.9268285714285714, + "direction_drift_flow": 0.09582142857142859, + "direction_drift_packet_max": 0.7519571428571429, + "direction_drift_packet_mean": 0.4206714285714286, + "direction_drift_packet_median": 0.49293571428571425, + "direction_drift_packet_trimmed10_mean": 0.41435714285714287, + "direction_drift_total": 0.6153714285714286, + "flow_consistency": 0.6775571428571429, + "kappa2_speed2norm_packet_mean": 0.666142857142857, + "kappa2_speed2norm_packet_median": 0.6221857142857143, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6497142857142857, + "kinetic_energy": 0.9296428571428572, + "kinetic_flow": 0.9232, + "kinetic_packet": 0.9223571428571429, + "packet_consistency": 0.8216, + "pna_flow": 0.062414285714285735, + "pna_packet_max": 0.8477999999999999, + "pna_packet_mean": 0.666142857142857, + "pna_packet_median": 0.6221857142857143, + "pna_packet_trimmed10_mean": 0.6497142857142857, + "terminal_flow": 0.9534714285714286, + "terminal_norm": 0.7426999999999999, + "terminal_packet": 0.8550857142857142, + "velocity_flow": 0.8875857142857142, + "velocity_packet": 0.7754142857142857, + "velocity_total": 0.7288857142857144 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "arc_length": 0.9943954954954954, + "causal_surprisal_flow": 0.03647762762762763, + "causal_surprisal_packet_max": 0.5141917417417416, + "causal_surprisal_packet_mean": 0.6705291291291291, + "causal_surprisal_packet_median": 0.711491966966967, + "causal_surprisal_packet_trimmed10_mean": 0.6917481231231231, + "causal_surprisal_total": 0.1629437687687688, + "consistency_total": 0.6933156156156156, + "curvature_flow": 0.7190144144144144, + "curvature_packet": 0.932031081081081, + "curvature_total": 0.935231006006006, + "direction_drift_flow": 0.16675615615615616, + "direction_drift_packet_max": 0.3026746246246246, + "direction_drift_packet_mean": 0.2883784534534535, + "direction_drift_packet_median": 0.2546698948948949, + "direction_drift_packet_trimmed10_mean": 0.3172527027027027, + "direction_drift_total": 0.11004204204204204, + "flow_consistency": 0.6802696696696696, + "kappa2_speed2norm_packet_mean": 0.7539358108108108, + "kappa2_speed2norm_packet_median": 0.6232520270270271, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7786832582582583, + "kinetic_energy": 0.9944893393393394, + "kinetic_flow": 0.7483746246246246, + "kinetic_packet": 0.9911211711711712, + "packet_consistency": 0.7742034534534533, + "pna_flow": 0.40380405405405406, + "pna_packet_max": 0.6130761261261262, + "pna_packet_mean": 0.7539358108108108, + "pna_packet_median": 0.6232520270270271, + "pna_packet_trimmed10_mean": 0.7786832582582583, + "terminal_flow": 0.9312800300300301, + "terminal_norm": 0.9908747747747748, + "terminal_packet": 0.9867642642642642, + "velocity_flow": 0.77517515015015, + "velocity_packet": 0.7802984984984984, + "velocity_total": 0.9855935435435436 + }, + "Portscan": { + "_n": 666.0, + "arc_length": 0.9935234234234234, + "causal_surprisal_flow": 0.015482882882882878, + "causal_surprisal_packet_max": 0.2462162912912913, + "causal_surprisal_packet_mean": 0.37485735735735737, + "causal_surprisal_packet_median": 0.44844279279279275, + "causal_surprisal_packet_trimmed10_mean": 0.40407762762762767, + "causal_surprisal_total": 0.04364534534534535, + "consistency_total": 0.7383162912912913, + "curvature_flow": 0.8849587087087089, + "curvature_packet": 0.9155436936936936, + "curvature_total": 0.939628978978979, + "direction_drift_flow": 0.14399196696696698, + "direction_drift_packet_max": 0.36372364864864865, + "direction_drift_packet_mean": 0.3912732732732732, + "direction_drift_packet_median": 0.4325258258258258, + "direction_drift_packet_trimmed10_mean": 0.419534009009009, + "direction_drift_total": 0.11745690690690691, + "flow_consistency": 0.7060921171171171, + "kappa2_speed2norm_packet_mean": 0.8577265015015014, + "kappa2_speed2norm_packet_median": 0.8563243243243243, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8773949699699699, + "kinetic_energy": 0.9934471471471472, + "kinetic_flow": 0.7352654654654653, + "kinetic_packet": 0.9803527027027028, + "packet_consistency": 0.8663174924924926, + "pna_flow": 0.591245945945946, + "pna_packet_max": 0.8550236486486487, + "pna_packet_mean": 0.8577265015015014, + "pna_packet_median": 0.8563243243243243, + "pna_packet_trimmed10_mean": 0.8773949699699699, + "terminal_flow": 0.8247918168168167, + "terminal_norm": 0.9879117117117118, + "terminal_packet": 0.9916978978978979, + "velocity_flow": 0.7805102102102102, + "velocity_packet": 0.7270965465465465, + "velocity_total": 0.9940372372372374 + }, + "SSH-Patator": { + "_n": 666.0, + "arc_length": 0.388697072072072, + "causal_surprisal_flow": 0.9855905405405406, + "causal_surprisal_packet_max": 0.5598891141141141, + "causal_surprisal_packet_mean": 0.3788566066066066, + "causal_surprisal_packet_median": 0.35899204204204205, + "causal_surprisal_packet_trimmed10_mean": 0.31173108108108105, + "causal_surprisal_total": 0.5080009009009009, + "consistency_total": 0.44907237237237235, + "curvature_flow": 0.9785719219219221, + "curvature_packet": 0.8075178678678677, + "curvature_total": 0.8729921171171171, + "direction_drift_flow": 0.12141876876876877, + "direction_drift_packet_max": 0.818083033033033, + "direction_drift_packet_mean": 0.2866828078078078, + "direction_drift_packet_median": 0.2876108858858859, + "direction_drift_packet_trimmed10_mean": 0.29458851351351356, + "direction_drift_total": 0.5534757507507507, + "flow_consistency": 0.4783192192192192, + "kappa2_speed2norm_packet_mean": 0.6230142642642643, + "kappa2_speed2norm_packet_median": 0.5789916666666667, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6178372372372373, + "kinetic_energy": 0.38880330330330326, + "kinetic_flow": 0.949297897897898, + "kinetic_packet": 0.43494834834834833, + "packet_consistency": 0.572813063063063, + "pna_flow": 0.701954054054054, + "pna_packet_max": 0.8122213213213212, + "pna_packet_mean": 0.6230142642642643, + "pna_packet_median": 0.5789916666666667, + "pna_packet_trimmed10_mean": 0.6178372372372373, + "terminal_flow": 0.7229222972972972, + "terminal_norm": 0.2813716966966967, + "terminal_packet": 0.4562653153153153, + "velocity_flow": 0.9426573573573573, + "velocity_packet": 0.7133712462462463, + "velocity_total": 0.4119415915915916 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "arc_length": 0.9172958904109589, + "causal_surprisal_flow": 0.422072602739726, + "causal_surprisal_packet_max": 0.017986301369863004, + "causal_surprisal_packet_mean": 0.0132945205479452, + "causal_surprisal_packet_median": 0.011169863013698638, + "causal_surprisal_packet_trimmed10_mean": 0.011894520547945216, + "causal_surprisal_total": 0.012150684931506839, + "consistency_total": 0.6048986301369862, + "curvature_flow": 0.6170479452054795, + "curvature_packet": 0.8397150684931507, + "curvature_total": 0.8384164383561644, + "direction_drift_flow": 0.010578082191780797, + "direction_drift_packet_max": 0.500786301369863, + "direction_drift_packet_mean": 0.02075616438356165, + "direction_drift_packet_median": 0.021719178082191787, + "direction_drift_packet_trimmed10_mean": 0.021960273972602744, + "direction_drift_total": 0.02849315068493151, + "flow_consistency": 0.5755301369863014, + "kappa2_speed2norm_packet_mean": 0.24482465753424656, + "kappa2_speed2norm_packet_median": 0.24001780821917806, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2432835616438356, + "kinetic_energy": 0.9138424657534246, + "kinetic_flow": 0.9988315068493151, + "kinetic_packet": 0.6650054794520548, + "packet_consistency": 0.9642671232876713, + "pna_flow": 0.008127397260274017, + "pna_packet_max": 0.7173123287671234, + "pna_packet_mean": 0.24482465753424656, + "pna_packet_median": 0.24001780821917806, + "pna_packet_trimmed10_mean": 0.2432835616438356, + "terminal_flow": 0.9440082191780822, + "terminal_norm": 0.25424041095890415, + "terminal_packet": 0.34884109589041096, + "velocity_flow": 0.9961630136986301, + "velocity_packet": 0.9703671232876712, + "velocity_total": 0.967490410958904 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "arc_length": 0.7165692307692307, + "causal_surprisal_flow": 0.7559230769230769, + "causal_surprisal_packet_max": 0.5066538461538461, + "causal_surprisal_packet_mean": 0.3586769230769231, + "causal_surprisal_packet_median": 0.32934615384615384, + "causal_surprisal_packet_trimmed10_mean": 0.2836384615384615, + "causal_surprisal_total": 0.9117000000000001, + "consistency_total": 0.6491846153846155, + "curvature_flow": 0.09080769230769231, + "curvature_packet": 0.9008692307692306, + "curvature_total": 0.8499076923076923, + "direction_drift_flow": 0.48223846153846156, + "direction_drift_packet_max": 0.7581923076923077, + "direction_drift_packet_mean": 0.4501384615384615, + "direction_drift_packet_median": 0.6128, + "direction_drift_packet_trimmed10_mean": 0.3535692307692308, + "direction_drift_total": 0.5923615384615385, + "flow_consistency": 0.6484692307692308, + "kappa2_speed2norm_packet_mean": 0.6940615384615385, + "kappa2_speed2norm_packet_median": 0.555923076923077, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5584153846153846, + "kinetic_energy": 0.7251923076923077, + "kinetic_flow": 0.6775, + "kinetic_packet": 0.8507230769230769, + "packet_consistency": 0.8142538461538462, + "pna_flow": 0.05377692307692308, + "pna_packet_max": 0.8231846153846154, + "pna_packet_mean": 0.6940615384615385, + "pna_packet_median": 0.555923076923077, + "pna_packet_trimmed10_mean": 0.5584153846153846, + "terminal_flow": 0.9407538461538463, + "terminal_norm": 0.9212, + "terminal_packet": 0.8748692307692307, + "velocity_flow": 0.5267692307692308, + "velocity_packet": 0.8424153846153846, + "velocity_total": 0.6340923076923076 + }, + "Web Attack - XSS": { + "_n": 18.0, + "arc_length": 0.9575888888888888, + "causal_surprisal_flow": 0.40549444444444444, + "causal_surprisal_packet_max": 0.01219444444444445, + "causal_surprisal_packet_mean": 0.010072222222222224, + "causal_surprisal_packet_median": 0.007788888888888901, + "causal_surprisal_packet_trimmed10_mean": 0.008949999999999994, + "causal_surprisal_total": 0.003144444444444437, + "consistency_total": 0.6053555555555555, + "curvature_flow": 0.6147944444444444, + "curvature_packet": 0.7974388888888888, + "curvature_total": 0.7929722222222222, + "direction_drift_flow": 0.008800000000000006, + "direction_drift_packet_max": 0.43705555555555553, + "direction_drift_packet_mean": 0.005188888888888878, + "direction_drift_packet_median": 0.012783333333333325, + "direction_drift_packet_trimmed10_mean": 0.004966666666666669, + "direction_drift_total": 0.008499999999999988, + "flow_consistency": 0.5566722222222222, + "kappa2_speed2norm_packet_mean": 0.12461666666666667, + "kappa2_speed2norm_packet_median": 0.0659111111111111, + "kappa2_speed2norm_packet_trimmed10_mean": 0.10408333333333333, + "kinetic_energy": 0.955288888888889, + "kinetic_flow": 0.9999166666666667, + "kinetic_packet": 0.8386777777777779, + "packet_consistency": 0.9841833333333333, + "pna_flow": 0.005672222222222257, + "pna_packet_max": 0.6786277777777778, + "pna_packet_mean": 0.12461666666666667, + "pna_packet_median": 0.0659111111111111, + "pna_packet_trimmed10_mean": 0.10408333333333333, + "terminal_flow": 0.9583611111111111, + "terminal_norm": 0.2747944444444444, + "terminal_packet": 0.3815, + "velocity_flow": 0.9964222222222222, + "velocity_packet": 0.9931555555555556, + "velocity_total": 0.9882166666666667 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicids2017.log b/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicids2017.log new file mode 100644 index 0000000..37cf41c --- /dev/null +++ b/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicids2017.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 2,025,564 target rows; label distribution top: + normal 1,521,748 + Portscan 159,040 + DoS Hulk 158,454 + DDoS 95,144 + Infiltration - Portscan 71,714 +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 20.8s +[eval] scoring attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done in 14.4s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicids2017.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicids2017.npz + +=== overall AUROC top-10 === + terminal_flow AUROC=0.8948 AUPRC=0.7913 + curvature_packet AUROC=0.8637 AUPRC=0.7165 + terminal_packet AUROC=0.8536 AUPRC=0.7583 + curvature_total AUROC=0.8494 AUPRC=0.7094 + kinetic_packet AUROC=0.8372 AUPRC=0.7424 + terminal_norm AUROC=0.8272 AUPRC=0.7464 + velocity_packet AUROC=0.8211 AUPRC=0.6516 + kinetic_flow AUROC=0.7674 AUPRC=0.5819 + packet_consistency AUROC=0.7658 AUPRC=0.6059 + velocity_flow AUROC=0.7654 AUPRC=0.5698 diff --git a/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicids2017.npz b/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicids2017.npz new file mode 100644 index 0000000..c32ab93 Binary files /dev/null and b/artifacts/route_comparison/cross/route_a_causal_seed42_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicddos2019.json b/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicddos2019.json new file mode 100644 index 0000000..e70927f --- /dev/null +++ b/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicddos2019.json @@ -0,0 +1,818 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.8933724659760307, + "auprc": 0.8492129940551466 + }, + "causal_surprisal_flow": { + "auroc": 0.28770195003046917, + "auprc": 0.36729816200369464 + }, + "causal_surprisal_packet_max": { + "auroc": 0.11620867357302458, + "auprc": 0.32118930393737916 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.1456877767621369, + "auprc": 0.3335398236558731 + }, + "causal_surprisal_packet_median": { + "auroc": 0.16357000304692262, + "auprc": 0.33907528983778346 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.1573043063172862, + "auprc": 0.3367805237429838 + }, + "causal_surprisal_total": { + "auroc": 0.27302002335973996, + "auprc": 0.36246284651804317 + }, + "consistency_total": { + "auroc": 0.7647348314036158, + "auprc": 0.6961802292212041 + }, + "curvature_flow": { + "auroc": 0.5328532906764168, + "auprc": 0.4750397546989749 + }, + "curvature_packet": { + "auroc": 0.6844791996749949, + "auprc": 0.6276607915971921 + }, + "curvature_total": { + "auroc": 0.6687840392037375, + "auprc": 0.6238339971892709 + }, + "direction_drift_flow": { + "auroc": 0.42920262543164733, + "auprc": 0.41725678909808583 + }, + "direction_drift_packet_max": { + "auroc": 0.20683577087141988, + "auprc": 0.3420166860934276 + }, + "direction_drift_packet_mean": { + "auroc": 0.23031779402803168, + "auprc": 0.3489731049385056 + }, + "direction_drift_packet_median": { + "auroc": 0.2271514168190128, + "auprc": 0.3477753391627223 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.2342469632338005, + "auprc": 0.3501909146569538 + }, + "direction_drift_total": { + "auroc": 0.17651048649197645, + "auprc": 0.3339524073260468 + }, + "flow_consistency": { + "auroc": 0.7672121165955718, + "auprc": 0.7121088220723187 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.5903475015234613, + "auprc": 0.6495152714864487 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.5944545602275035, + "auprc": 0.6427304931655125 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.5911792352224253, + "auprc": 0.6477583581576244 + }, + "kinetic_energy": { + "auroc": 0.8934731718464352, + "auprc": 0.8492620885972861 + }, + "kinetic_flow": { + "auroc": 0.7886000812512696, + "auprc": 0.6669175044609544 + }, + "kinetic_packet": { + "auroc": 0.7421793012390818, + "auprc": 0.6681621400526956 + }, + "packet_consistency": { + "auroc": 0.5129316981515337, + "auprc": 0.520676053856241 + }, + "pna_flow": { + "auroc": 0.28088926467601055, + "auprc": 0.3623577753354492 + }, + "pna_packet_max": { + "auroc": 0.4052637670119846, + "auprc": 0.47396009911322445 + }, + "pna_packet_mean": { + "auroc": 0.5903475015234613, + "auprc": 0.6495152714864487 + }, + "pna_packet_median": { + "auroc": 0.5944545602275035, + "auprc": 0.6427304931655125 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.5911792352224253, + "auprc": 0.6477583581576244 + }, + "terminal_flow": { + "auroc": 0.7309454499289051, + "auprc": 0.664749018376392 + }, + "terminal_norm": { + "auroc": 0.7826428041844404, + "auprc": 0.7327986263037913 + }, + "terminal_packet": { + "auroc": 0.716714914686167, + "auprc": 0.673876879995208 + }, + "velocity_flow": { + "auroc": 0.7230749695307739, + "auprc": 0.6158744538017936 + }, + "velocity_packet": { + "auroc": 0.6556229027016047, + "auprc": 0.6668445888893633 + }, + "velocity_total": { + "auroc": 0.897299355068048, + "auprc": 0.9115458344784506 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "arc_length": 0.9702091836734694, + "causal_surprisal_flow": 0.2824073129251701, + "causal_surprisal_packet_max": 0.020039455782312924, + "causal_surprisal_packet_mean": 0.04124404761904761, + "causal_surprisal_packet_median": 0.07085085034013605, + "causal_surprisal_packet_trimmed10_mean": 0.062452210884353744, + "causal_surprisal_total": 0.31244098639455775, + "consistency_total": 0.8334234693877551, + "curvature_flow": 0.3645517006802721, + "curvature_packet": 0.8141694727891157, + "curvature_total": 0.6482999149659863, + "direction_drift_flow": 0.5090902210884354, + "direction_drift_packet_max": 0.014819387755102036, + "direction_drift_packet_mean": 0.01998945578231293, + "direction_drift_packet_median": 0.02459591836734694, + "direction_drift_packet_trimmed10_mean": 0.022553231292516997, + "direction_drift_total": 0.015343877551020412, + "flow_consistency": 0.8244162414965986, + "kappa2_speed2norm_packet_mean": 0.13078197278911563, + "kappa2_speed2norm_packet_median": 0.15757576530612244, + "kappa2_speed2norm_packet_trimmed10_mean": 0.14836292517006805, + "kinetic_energy": 0.970505357142857, + "kinetic_flow": 0.8285213435374149, + "kinetic_packet": 0.891140306122449, + "packet_consistency": 0.8648568027210883, + "pna_flow": 0.20762448979591838, + "pna_packet_max": 0.06026666666666667, + "pna_packet_mean": 0.13078197278911563, + "pna_packet_median": 0.15757576530612244, + "pna_packet_trimmed10_mean": 0.14836292517006805, + "terminal_flow": 0.9020801020408162, + "terminal_norm": 0.9482520408163266, + "terminal_packet": 0.9220998299319729, + "velocity_flow": 0.6230017006802722, + "velocity_packet": 0.9530628401360545, + "velocity_total": 0.9927062925170067 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "arc_length": 0.9714325680272108, + "causal_surprisal_flow": 0.2860382653061225, + "causal_surprisal_packet_max": 0.020514625850340133, + "causal_surprisal_packet_mean": 0.042118707482993185, + "causal_surprisal_packet_median": 0.07235, + "causal_surprisal_packet_trimmed10_mean": 0.06369183673469389, + "causal_surprisal_total": 0.31722653061224493, + "consistency_total": 0.8314612244897959, + "curvature_flow": 0.35075629251700685, + "curvature_packet": 0.8243590136054422, + "curvature_total": 0.6443002551020409, + "direction_drift_flow": 0.5169846088435374, + "direction_drift_packet_max": 0.004545748299319726, + "direction_drift_packet_mean": 0.004497278911564628, + "direction_drift_packet_median": 0.008785034013605447, + "direction_drift_packet_trimmed10_mean": 0.006004421768707478, + "direction_drift_total": 0.007461054421768711, + "flow_consistency": 0.8222845238095239, + "kappa2_speed2norm_packet_mean": 0.06994472789115647, + "kappa2_speed2norm_packet_median": 0.09753112244897959, + "kappa2_speed2norm_packet_trimmed10_mean": 0.08729506802721088, + "kinetic_energy": 0.9718068027210882, + "kinetic_flow": 0.8297326530612246, + "kinetic_packet": 0.9096071428571428, + "packet_consistency": 0.901883843537415, + "pna_flow": 0.20408945578231297, + "pna_packet_max": 0.02490748299319728, + "pna_packet_mean": 0.06994472789115647, + "pna_packet_median": 0.09753112244897959, + "pna_packet_trimmed10_mean": 0.08729506802721088, + "terminal_flow": 0.9109314625850341, + "terminal_norm": 0.9535523809523809, + "terminal_packet": 0.9368357142857142, + "velocity_flow": 0.5960295918367347, + "velocity_packet": 0.9821828231292516, + "velocity_total": 0.9955954931972789 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "arc_length": 0.9612610544217688, + "causal_surprisal_flow": 0.2730380952380953, + "causal_surprisal_packet_max": 0.010030272108843538, + "causal_surprisal_packet_mean": 0.025748469387755102, + "causal_surprisal_packet_median": 0.04224710884353742, + "causal_surprisal_packet_trimmed10_mean": 0.03707840136054422, + "causal_surprisal_total": 0.3027017857142857, + "consistency_total": 0.8799685374149658, + "curvature_flow": 0.4971088435374149, + "curvature_packet": 0.6702555272108844, + "curvature_total": 0.5589604591836734, + "direction_drift_flow": 0.4819599489795918, + "direction_drift_packet_max": 0.11602287414965985, + "direction_drift_packet_mean": 0.1614230442176871, + "direction_drift_packet_median": 0.17164022108843538, + "direction_drift_packet_trimmed10_mean": 0.17760552721088435, + "direction_drift_total": 0.091171768707483, + "flow_consistency": 0.8836625850340136, + "kappa2_speed2norm_packet_mean": 0.8459847789115646, + "kappa2_speed2norm_packet_median": 0.8481690476190477, + "kappa2_speed2norm_packet_trimmed10_mean": 0.852402806122449, + "kinetic_energy": 0.9610158163265305, + "kinetic_flow": 0.8692806122448979, + "kinetic_packet": 0.671757142857143, + "packet_consistency": 0.46958979591836736, + "pna_flow": 0.2180442176870748, + "pna_packet_max": 0.5874944727891156, + "pna_packet_mean": 0.8459847789115646, + "pna_packet_median": 0.8481690476190477, + "pna_packet_trimmed10_mean": 0.852402806122449, + "terminal_flow": 0.8459433673469389, + "terminal_norm": 0.9091396258503401, + "terminal_packet": 0.7934591836734693, + "velocity_flow": 0.8478239795918366, + "velocity_packet": 0.694844387755102, + "velocity_total": 0.9899913265306122 + }, + "DrDoS_NTP": { + "_n": 588.0, + "arc_length": 0.72154268707483, + "causal_surprisal_flow": 0.7552594387755102, + "causal_surprisal_packet_max": 0.053098299319727885, + "causal_surprisal_packet_mean": 0.05165136054421769, + "causal_surprisal_packet_median": 0.07760986394557823, + "causal_surprisal_packet_trimmed10_mean": 0.07142772108843537, + "causal_surprisal_total": 0.27995255102040817, + "consistency_total": 0.8649027210884355, + "curvature_flow": 0.543600850340136, + "curvature_packet": 0.9174581632653063, + "curvature_total": 0.9335107142857143, + "direction_drift_flow": 0.17580382653061222, + "direction_drift_packet_max": 0.5673457482993197, + "direction_drift_packet_mean": 0.1797811224489796, + "direction_drift_packet_median": 0.14610102040816325, + "direction_drift_packet_trimmed10_mean": 0.1577959183673469, + "direction_drift_total": 0.3548836734693877, + "flow_consistency": 0.8689028911564626, + "kappa2_speed2norm_packet_mean": 0.9013912414965988, + "kappa2_speed2norm_packet_median": 0.8649369897959185, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8731430272108844, + "kinetic_energy": 0.725712925170068, + "kinetic_flow": 0.8968108843537415, + "kinetic_packet": 0.8839920918367346, + "packet_consistency": 0.614103231292517, + "pna_flow": 0.19272670068027212, + "pna_packet_max": 0.8984403061224491, + "pna_packet_mean": 0.9013912414965988, + "pna_packet_median": 0.8649369897959185, + "pna_packet_trimmed10_mean": 0.8731430272108844, + "terminal_flow": 0.8407639455782313, + "terminal_norm": 0.6415097789115646, + "terminal_packet": 0.6755633503401361, + "velocity_flow": 0.9025156462585034, + "velocity_packet": 0.804244387755102, + "velocity_total": 0.5416850340136055 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "arc_length": 0.9531493197278912, + "causal_surprisal_flow": 0.1230045918367347, + "causal_surprisal_packet_max": 0.00018010204081631557, + "causal_surprisal_packet_mean": 0.011287244897959185, + "causal_surprisal_packet_median": 0.018684183673469388, + "causal_surprisal_packet_trimmed10_mean": 0.016648469387755105, + "causal_surprisal_total": 0.11960255102040816, + "consistency_total": 0.9292782312925171, + "curvature_flow": 0.6892877551020408, + "curvature_packet": 0.4170440476190476, + "curvature_total": 0.5566132653061224, + "direction_drift_flow": 0.40206360544217684, + "direction_drift_packet_max": 0.31239710884353744, + "direction_drift_packet_mean": 0.484887074829932, + "direction_drift_packet_median": 0.48770969387755103, + "direction_drift_packet_trimmed10_mean": 0.4966537414965986, + "direction_drift_total": 0.2949486394557823, + "flow_consistency": 0.9471872448979594, + "kappa2_speed2norm_packet_mean": 0.8864749149659864, + "kappa2_speed2norm_packet_median": 0.8859957482993198, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8922133503401362, + "kinetic_energy": 0.9526624149659864, + "kinetic_flow": 0.8687685374149661, + "kinetic_packet": 0.5823727891156463, + "packet_consistency": 0.09395017006802721, + "pna_flow": 0.32372712585034014, + "pna_packet_max": 0.4873107142857142, + "pna_packet_mean": 0.8864749149659864, + "pna_packet_median": 0.8859957482993198, + "pna_packet_trimmed10_mean": 0.8922133503401362, + "terminal_flow": 0.6636574829931974, + "terminal_norm": 0.8103133503401361, + "terminal_packet": 0.6046749149659864, + "velocity_flow": 0.8737471088435373, + "velocity_packet": 0.11038401360544217, + "velocity_total": 0.9897622448979593 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "arc_length": 0.9739909013605442, + "causal_surprisal_flow": 0.279437925170068, + "causal_surprisal_packet_max": 0.019697619047619047, + "causal_surprisal_packet_mean": 0.04059744897959183, + "causal_surprisal_packet_median": 0.06960935374149661, + "causal_surprisal_packet_trimmed10_mean": 0.06123724489795919, + "causal_surprisal_total": 0.30837738095238093, + "consistency_total": 0.8383562925170067, + "curvature_flow": 0.3886638605442177, + "curvature_packet": 0.8045119897959184, + "curvature_total": 0.6500932823129251, + "direction_drift_flow": 0.5130876700680272, + "direction_drift_packet_max": 0.018284183673469387, + "direction_drift_packet_mean": 0.025237500000000003, + "direction_drift_packet_median": 0.02952142857142858, + "direction_drift_packet_trimmed10_mean": 0.02725255102040816, + "direction_drift_total": 0.019734013605442184, + "flow_consistency": 0.8316836734693878, + "kappa2_speed2norm_packet_mean": 0.10712797619047618, + "kappa2_speed2norm_packet_median": 0.13530731292517006, + "kappa2_speed2norm_packet_trimmed10_mean": 0.12534838435374152, + "kinetic_energy": 0.9742164965986394, + "kinetic_flow": 0.8493639455782314, + "kinetic_packet": 0.8896804421768708, + "packet_consistency": 0.8630474489795918, + "pna_flow": 0.2130938775510204, + "pna_packet_max": 0.04670688775510204, + "pna_packet_mean": 0.10712797619047618, + "pna_packet_median": 0.13530731292517006, + "pna_packet_trimmed10_mean": 0.12534838435374152, + "terminal_flow": 0.8983042517006803, + "terminal_norm": 0.9475100340136055, + "terminal_packet": 0.9203566326530611, + "velocity_flow": 0.6026068027210885, + "velocity_packet": 0.9413906462585033, + "velocity_total": 0.9989775510204082 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "arc_length": 0.791158843537415, + "causal_surprisal_flow": 0.29647176870748293, + "causal_surprisal_packet_max": 0.019216836734693876, + "causal_surprisal_packet_mean": 0.03678418367346939, + "causal_surprisal_packet_median": 0.06576615646258503, + "causal_surprisal_packet_trimmed10_mean": 0.05640391156462585, + "causal_surprisal_total": 0.2658875850340136, + "consistency_total": 0.5006306122448979, + "curvature_flow": 0.6067415816326531, + "curvature_packet": 0.6873781462585035, + "curvature_total": 0.6684735544217688, + "direction_drift_flow": 0.4272974489795919, + "direction_drift_packet_max": 0.23959897959183674, + "direction_drift_packet_mean": 0.2519419217687075, + "direction_drift_packet_median": 0.2377577380952381, + "direction_drift_packet_trimmed10_mean": 0.24313061224489796, + "direction_drift_total": 0.21254438775510204, + "flow_consistency": 0.506719217687075, + "kappa2_speed2norm_packet_mean": 0.7119819727891157, + "kappa2_speed2norm_packet_median": 0.6923765306122448, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6802641156462585, + "kinetic_energy": 0.7899953231292517, + "kinetic_flow": 0.6998573129251702, + "kinetic_packet": 0.6610420918367348, + "packet_consistency": 0.28972210884353744, + "pna_flow": 0.3523760204081633, + "pna_packet_max": 0.5452734693877551, + "pna_packet_mean": 0.7119819727891157, + "pna_packet_median": 0.6923765306122448, + "pna_packet_trimmed10_mean": 0.6802641156462585, + "terminal_flow": 0.43750119047619046, + "terminal_norm": 0.47702244897959184, + "terminal_packet": 0.4480372448979592, + "velocity_flow": 0.7209515306122449, + "velocity_packet": 0.6463667517006803, + "velocity_total": 0.8215571428571429 + }, + "DrDoS_UDP": { + "_n": 588.0, + "arc_length": 0.7899417517006802, + "causal_surprisal_flow": 0.2953896258503401, + "causal_surprisal_packet_max": 0.01812925170068027, + "causal_surprisal_packet_mean": 0.03558588435374149, + "causal_surprisal_packet_median": 0.06319353741496599, + "causal_surprisal_packet_trimmed10_mean": 0.05465391156462585, + "causal_surprisal_total": 0.26598647959183674, + "consistency_total": 0.49700255102040813, + "curvature_flow": 0.6085239795918368, + "curvature_packet": 0.672364880952381, + "curvature_total": 0.6544772959183673, + "direction_drift_flow": 0.42505561224489796, + "direction_drift_packet_max": 0.2256154761904762, + "direction_drift_packet_mean": 0.25218231292517007, + "direction_drift_packet_median": 0.2445105442176871, + "direction_drift_packet_trimmed10_mean": 0.2523222789115646, + "direction_drift_total": 0.20844498299319728, + "flow_consistency": 0.5043027210884354, + "kappa2_speed2norm_packet_mean": 0.7136942176870749, + "kappa2_speed2norm_packet_median": 0.698890306122449, + "kappa2_speed2norm_packet_trimmed10_mean": 0.697679931972789, + "kinetic_energy": 0.7887139455782313, + "kinetic_flow": 0.6919546768707483, + "kinetic_packet": 0.660175850340136, + "packet_consistency": 0.2709297619047619, + "pna_flow": 0.35363869047619045, + "pna_packet_max": 0.5302494897959185, + "pna_packet_mean": 0.7136942176870749, + "pna_packet_median": 0.698890306122449, + "pna_packet_trimmed10_mean": 0.697679931972789, + "terminal_flow": 0.42806377551020414, + "terminal_norm": 0.4675156462585035, + "terminal_packet": 0.4414443877551021, + "velocity_flow": 0.7240518707482992, + "velocity_packet": 0.6392268707482993, + "velocity_total": 0.8212772108843538 + }, + "LDAP": { + "_n": 588.0, + "arc_length": 0.9703034863945579, + "causal_surprisal_flow": 0.2851671768707483, + "causal_surprisal_packet_max": 0.021316326530612245, + "causal_surprisal_packet_mean": 0.042713775510204076, + "causal_surprisal_packet_median": 0.07194829931972789, + "causal_surprisal_packet_trimmed10_mean": 0.06342091836734694, + "causal_surprisal_total": 0.3168622448979592, + "consistency_total": 0.8357375850340136, + "curvature_flow": 0.33087176870748297, + "curvature_packet": 0.8145569727891157, + "curvature_total": 0.6172287414965987, + "direction_drift_flow": 0.524256462585034, + "direction_drift_packet_max": 0.005115986394557819, + "direction_drift_packet_mean": 0.0045561224489795915, + "direction_drift_packet_median": 0.008662755102040821, + "direction_drift_packet_trimmed10_mean": 0.005997108843537411, + "direction_drift_total": 0.007540646258503409, + "flow_consistency": 0.8282632653061226, + "kappa2_speed2norm_packet_mean": 0.06491853741496599, + "kappa2_speed2norm_packet_median": 0.09170221088435375, + "kappa2_speed2norm_packet_trimmed10_mean": 0.08218299319727891, + "kinetic_energy": 0.970759693877551, + "kinetic_flow": 0.8241773809523811, + "kinetic_packet": 0.9109546768707483, + "packet_consistency": 0.9020489795918367, + "pna_flow": 0.20102023809523806, + "pna_packet_max": 0.024448809523809525, + "pna_packet_mean": 0.06491853741496599, + "pna_packet_median": 0.09170221088435375, + "pna_packet_trimmed10_mean": 0.08218299319727891, + "terminal_flow": 0.9128348639455782, + "terminal_norm": 0.9549018707482994, + "terminal_packet": 0.9400442176870749, + "velocity_flow": 0.5757986394557822, + "velocity_packet": 0.981481462585034, + "velocity_total": 0.995702551020408 + }, + "MSSQL": { + "_n": 588.0, + "arc_length": 0.9596087585034013, + "causal_surprisal_flow": 0.2736486394557823, + "causal_surprisal_packet_max": 0.009867602040816326, + "causal_surprisal_packet_mean": 0.025516496598639454, + "causal_surprisal_packet_median": 0.041990986394557825, + "causal_surprisal_packet_trimmed10_mean": 0.036928571428571436, + "causal_surprisal_total": 0.30413775510204083, + "consistency_total": 0.8806514455782314, + "curvature_flow": 0.5102326530612245, + "curvature_packet": 0.6647753401360544, + "curvature_total": 0.569153231292517, + "direction_drift_flow": 0.47590442176870745, + "direction_drift_packet_max": 0.11498979591836735, + "direction_drift_packet_mean": 0.1622861394557823, + "direction_drift_packet_median": 0.1726248299319728, + "direction_drift_packet_trimmed10_mean": 0.17876513605442176, + "direction_drift_total": 0.0906200680272109, + "flow_consistency": 0.8845977891156462, + "kappa2_speed2norm_packet_mean": 0.8510954081632652, + "kappa2_speed2norm_packet_median": 0.8534301870748299, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8573639455782314, + "kinetic_energy": 0.9593261904761904, + "kinetic_flow": 0.8684338435374148, + "kinetic_packet": 0.6635721088435375, + "packet_consistency": 0.44373886054421774, + "pna_flow": 0.22359625850340134, + "pna_packet_max": 0.5976817176870749, + "pna_packet_mean": 0.8510954081632652, + "pna_packet_median": 0.8534301870748299, + "pna_packet_trimmed10_mean": 0.8573639455782314, + "terminal_flow": 0.8376755952380953, + "terminal_norm": 0.9048836734693878, + "terminal_packet": 0.7801504251700679, + "velocity_flow": 0.8488993197278911, + "velocity_packet": 0.6861678571428571, + "velocity_total": 0.9887738095238096 + }, + "NetBIOS": { + "_n": 588.0, + "arc_length": 0.9429328231292518, + "causal_surprisal_flow": 0.13934464285714288, + "causal_surprisal_packet_max": 0.000122959183673457, + "causal_surprisal_packet_mean": 0.011308503401360546, + "causal_surprisal_packet_median": 0.01867006802721088, + "causal_surprisal_packet_trimmed10_mean": 0.016657993197278915, + "causal_surprisal_total": 0.14215884353741498, + "consistency_total": 0.9273698979591837, + "curvature_flow": 0.681854081632653, + "curvature_packet": 0.4290615646258503, + "curvature_total": 0.5672414115646258, + "direction_drift_flow": 0.3904227891156462, + "direction_drift_packet_max": 0.30108052721088435, + "direction_drift_packet_mean": 0.47335612244897957, + "direction_drift_packet_median": 0.47658945578231293, + "direction_drift_packet_trimmed10_mean": 0.4859352040816327, + "direction_drift_total": 0.28597108843537417, + "flow_consistency": 0.9459260204081633, + "kappa2_speed2norm_packet_mean": 0.8800087585034015, + "kappa2_speed2norm_packet_median": 0.8799444727891158, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8859701530612244, + "kinetic_energy": 0.9425185374149659, + "kinetic_flow": 0.8554461734693878, + "kinetic_packet": 0.5845110544217688, + "packet_consistency": 0.09435884353741497, + "pna_flow": 0.33493996598639453, + "pna_packet_max": 0.48257789115646255, + "pna_packet_mean": 0.8800087585034015, + "pna_packet_median": 0.8799444727891158, + "pna_packet_trimmed10_mean": 0.8859701530612244, + "terminal_flow": 0.6618025510204082, + "terminal_norm": 0.8043628401360544, + "terminal_packet": 0.5755430272108844, + "velocity_flow": 0.8643991496598639, + "velocity_packet": 0.11073520408163265, + "velocity_total": 0.9815600340136055 + }, + "Portmap": { + "_n": 588.0, + "arc_length": 0.9466636904761904, + "causal_surprisal_flow": 0.12650697278911566, + "causal_surprisal_packet_max": 0.0025482993197278796, + "causal_surprisal_packet_mean": 0.01400119047619048, + "causal_surprisal_packet_median": 0.02127857142857143, + "causal_surprisal_packet_trimmed10_mean": 0.019331122448979596, + "causal_surprisal_total": 0.12563690476190478, + "consistency_total": 0.9270966836734693, + "curvature_flow": 0.6665666666666668, + "curvature_packet": 0.4176447278911565, + "curvature_total": 0.5360823129251702, + "direction_drift_flow": 0.4065401360544218, + "direction_drift_packet_max": 0.30970969387755104, + "direction_drift_packet_mean": 0.48999166666666677, + "direction_drift_packet_median": 0.49247704081632654, + "direction_drift_packet_trimmed10_mean": 0.5015413265306122, + "direction_drift_total": 0.29884829931972795, + "flow_consistency": 0.9450930272108844, + "kappa2_speed2norm_packet_mean": 0.8837931972789117, + "kappa2_speed2norm_packet_median": 0.8823244897959184, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8895850340136053, + "kinetic_energy": 0.9461663265306122, + "kinetic_flow": 0.857783843537415, + "kinetic_packet": 0.5703250850340136, + "packet_consistency": 0.09672670068027212, + "pna_flow": 0.3152693877551021, + "pna_packet_max": 0.48522976190476197, + "pna_packet_mean": 0.8837931972789117, + "pna_packet_median": 0.8823244897959184, + "pna_packet_trimmed10_mean": 0.8895850340136053, + "terminal_flow": 0.6779289115646259, + "terminal_norm": 0.8166469387755102, + "terminal_packet": 0.6038170068027211, + "velocity_flow": 0.8615909863945578, + "velocity_packet": 0.11497423469387755, + "velocity_total": 0.9803515306122449 + }, + "Syn": { + "_n": 588.0, + "arc_length": 0.9274006802721089, + "causal_surprisal_flow": 0.2700811224489796, + "causal_surprisal_packet_max": 0.6510525510204083, + "causal_surprisal_packet_mean": 0.7925562925170067, + "causal_surprisal_packet_median": 0.8111042517006803, + "causal_surprisal_packet_trimmed10_mean": 0.8025610544217687, + "causal_surprisal_total": 0.3275988095238095, + "consistency_total": 0.8420281462585032, + "curvature_flow": 0.6581367346938776, + "curvature_packet": 0.7505301020408163, + "curvature_total": 0.8266438775510203, + "direction_drift_flow": 0.41934472789115645, + "direction_drift_packet_max": 0.25661819727891155, + "direction_drift_packet_mean": 0.2741289115646258, + "direction_drift_packet_median": 0.25622636054421766, + "direction_drift_packet_trimmed10_mean": 0.2882180272108844, + "direction_drift_total": 0.18651777210884354, + "flow_consistency": 0.840729336734694, + "kappa2_speed2norm_packet_mean": 0.3634482993197279, + "kappa2_speed2norm_packet_median": 0.40961054421768706, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3778477040816326, + "kinetic_energy": 0.9284607142857143, + "kinetic_flow": 0.6632653911564627, + "kinetic_packet": 0.9238139455782314, + "packet_consistency": 0.8048812925170067, + "pna_flow": 0.34954030612244896, + "pna_packet_max": 0.22348375850340138, + "pna_packet_mean": 0.3634482993197279, + "pna_packet_median": 0.40961054421768706, + "pna_packet_trimmed10_mean": 0.3778477040816326, + "terminal_flow": 0.8896850340136054, + "terminal_norm": 0.9449906462585034, + "terminal_packet": 0.9591103741496598, + "velocity_flow": 0.5575558673469386, + "velocity_packet": 0.8231206632653061, + "velocity_total": 0.855692857142857 + }, + "TFTP": { + "_n": 588.0, + "arc_length": 0.8427358843537415, + "causal_surprisal_flow": 0.29325595238095237, + "causal_surprisal_packet_max": 0.011811224489795916, + "causal_surprisal_packet_mean": 0.02627687074829932, + "causal_surprisal_packet_median": 0.03947772108843538, + "causal_surprisal_packet_trimmed10_mean": 0.03545901360544218, + "causal_surprisal_total": 0.30157482993197277, + "consistency_total": 0.6690828231292517, + "curvature_flow": 0.34915986394557824, + "curvature_packet": 0.8237925170068027, + "curvature_total": 0.7714704081632653, + "direction_drift_flow": 0.4391114795918368, + "direction_drift_packet_max": 0.27020688775510204, + "direction_drift_packet_mean": 0.3403630952380952, + "direction_drift_packet_median": 0.3328405612244898, + "direction_drift_packet_trimmed10_mean": 0.3479865646258503, + "direction_drift_total": 0.301306462585034, + "flow_consistency": 0.6298826530612244, + "kappa2_speed2norm_packet_mean": 0.9053680272108843, + "kappa2_speed2norm_packet_median": 0.8828122448979592, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9055161564625851, + "kinetic_energy": 0.8434677721088436, + "kinetic_flow": 0.7160263605442176, + "kinetic_packet": 0.7761219387755103, + "packet_consistency": 0.6030086734693877, + "pna_flow": 0.208643537414966, + "pna_packet_max": 0.6929752551020406, + "pna_packet_mean": 0.9053680272108843, + "pna_packet_median": 0.8828122448979592, + "pna_packet_trimmed10_mean": 0.9055161564625851, + "terminal_flow": 0.8250324829931973, + "terminal_norm": 0.8729100340136053, + "terminal_packet": 0.7594962585034015, + "velocity_flow": 0.6905814625850341, + "velocity_packet": 0.7167712585034013, + "velocity_total": 0.7991911564625851 + }, + "UDP": { + "_n": 588.0, + "arc_length": 0.7758359693877551, + "causal_surprisal_flow": 0.29848112244897956, + "causal_surprisal_packet_max": 0.01895153061224489, + "causal_surprisal_packet_mean": 0.036702040816326525, + "causal_surprisal_packet_median": 0.06591267006802722, + "causal_surprisal_packet_trimmed10_mean": 0.056626700680272105, + "causal_surprisal_total": 0.272441156462585, + "consistency_total": 0.4670316326530612, + "curvature_flow": 0.6125392857142856, + "curvature_packet": 0.6704763605442176, + "curvature_total": 0.6607705782312925, + "direction_drift_flow": 0.4211881802721088, + "direction_drift_packet_max": 0.23016955782312926, + "direction_drift_packet_mean": 0.24738843537414967, + "direction_drift_packet_median": 0.23466122448979593, + "direction_drift_packet_trimmed10_mean": 0.24297049319727893, + "direction_drift_total": 0.21131785714285714, + "flow_consistency": 0.47335068027210886, + "kappa2_speed2norm_packet_mean": 0.7031461734693878, + "kappa2_speed2norm_packet_median": 0.6844692176870748, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6794525510204081, + "kinetic_energy": 0.774554081632653, + "kinetic_flow": 0.677323724489796, + "kinetic_packet": 0.6545127551020409, + "packet_consistency": 0.2732500850340136, + "pna_flow": 0.3640045918367347, + "pna_packet_max": 0.5224697278911565, + "pna_packet_mean": 0.7031461734693878, + "pna_packet_median": 0.6844692176870748, + "pna_packet_trimmed10_mean": 0.6794525510204081, + "terminal_flow": 0.4023795918367347, + "terminal_norm": 0.4404625850340136, + "terminal_packet": 0.4142622448979592, + "velocity_flow": 0.7096691326530612, + "velocity_packet": 0.6478885204081632, + "velocity_total": 0.8072729591836735 + }, + "UDPLag": { + "_n": 588.0, + "arc_length": 0.903468112244898, + "causal_surprisal_flow": 0.2895107142857143, + "causal_surprisal_packet_max": 0.603223044217687, + "causal_surprisal_packet_mean": 0.7292305272108844, + "causal_surprisal_packet_median": 0.7504438775510205, + "causal_surprisal_packet_trimmed10_mean": 0.7409131802721088, + "causal_surprisal_total": 0.35459965986394554, + "consistency_total": 0.8078061224489798, + "curvature_flow": 0.625237925170068, + "curvature_packet": 0.6870951530612245, + "curvature_total": 0.74821462585034, + "direction_drift_flow": 0.4321505102040816, + "direction_drift_packet_max": 0.17955807823129255, + "direction_drift_packet_mean": 0.21175255102040816, + "direction_drift_packet_median": 0.21128639455782314, + "direction_drift_packet_trimmed10_mean": 0.22493503401360546, + "direction_drift_total": 0.1379845238095238, + "flow_consistency": 0.808454931972789, + "kappa2_speed2norm_packet_mean": 0.3166664965986395, + "kappa2_speed2norm_packet_median": 0.3453017006802721, + "kappa2_speed2norm_packet_trimmed10_mean": 0.33063418367346936, + "kinetic_energy": 0.9040075680272108, + "kinetic_flow": 0.6701341836734692, + "kinetic_packet": 0.8902622448979589, + "packet_consistency": 0.7326168367346938, + "pna_flow": 0.34021003401360544, + "pna_packet_max": 0.20074761904761906, + "pna_packet_mean": 0.3166664965986395, + "pna_packet_median": 0.3453017006802721, + "pna_packet_trimmed10_mean": 0.33063418367346936, + "terminal_flow": 0.8421272959183672, + "terminal_norm": 0.8951369047619047, + "terminal_packet": 0.9024083333333333, + "velocity_flow": 0.5704022959183673, + "velocity_packet": 0.8149115646258503, + "velocity_total": 0.8585639455782313 + }, + "WebDDoS": { + "_n": 438.0, + "arc_length": 0.7488207762557078, + "causal_surprisal_flow": 0.3362828767123287, + "causal_surprisal_packet_max": 0.6257264840182648, + "causal_surprisal_packet_mean": 0.6392874429223744, + "causal_surprisal_packet_median": 0.5877657534246575, + "causal_surprisal_packet_trimmed10_mean": 0.5887414383561644, + "causal_surprisal_total": 0.34166609589041097, + "consistency_total": 0.36727009132420096, + "curvature_flow": 0.5889936073059361, + "curvature_packet": 0.5316974885844749, + "curvature_total": 0.7882778538812786, + "direction_drift_flow": 0.3043269406392694, + "direction_drift_packet_max": 0.399203196347032, + "direction_drift_packet_mean": 0.3663390410958904, + "direction_drift_packet_median": 0.359293607305936, + "direction_drift_packet_trimmed10_mean": 0.35276552511415527, + "direction_drift_total": 0.3101243150684932, + "flow_consistency": 0.4046618721461187, + "kappa2_speed2norm_packet_mean": 0.7376607305936074, + "kappa2_speed2norm_packet_median": 0.7299027397260274, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7168413242009133, + "kinetic_energy": 0.7480583333333334, + "kinetic_flow": 0.7224439497716895, + "kinetic_packet": 0.4079417808219178, + "packet_consistency": 0.36283561643835616, + "pna_flow": 0.40397100456621005, + "pna_packet_max": 0.5045474885844748, + "pna_packet_mean": 0.7376607305936074, + "pna_packet_median": 0.7299027397260274, + "pna_packet_trimmed10_mean": 0.7168413242009133, + "terminal_flow": 0.3529276255707763, + "terminal_norm": 0.42443812785388135, + "terminal_packet": 0.43497899543379, + "velocity_flow": 0.7225036529680364, + "velocity_packet": 0.41694988584474885, + "velocity_total": 0.8142390410958905 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicddos2019.log b/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicddos2019.log new file mode 100644 index 0000000..9c7f49b --- /dev/null +++ b/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicddos2019.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 8,993,376 target rows; label distribution top: + Syn 1,495,248 + NetBIOS 702,760 + UDP 611,999 + MSSQL 523,845 + LDAP 509,665 +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 19.9s +[eval] scoring attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done in 18.8s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicddos2019.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicddos2019.npz + +=== overall AUROC top-10 === + velocity_total AUROC=0.8973 AUPRC=0.9115 + kinetic_energy AUROC=0.8935 AUPRC=0.8493 + arc_length AUROC=0.8934 AUPRC=0.8492 + kinetic_flow AUROC=0.7886 AUPRC=0.6669 + terminal_norm AUROC=0.7826 AUPRC=0.7328 + flow_consistency AUROC=0.7672 AUPRC=0.7121 + consistency_total AUROC=0.7647 AUPRC=0.6962 + kinetic_packet AUROC=0.7422 AUPRC=0.6682 + terminal_flow AUROC=0.7309 AUPRC=0.6647 + velocity_flow AUROC=0.7231 AUPRC=0.6159 diff --git a/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicddos2019.npz new file mode 100644 index 0000000..403d095 Binary files /dev/null and b/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicids2017.json b/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicids2017.json new file mode 100644 index 0000000..f3b9291 --- /dev/null +++ b/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicids2017.json @@ -0,0 +1,740 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.6699105212640284, + "auprc": 0.6170680495599252 + }, + "causal_surprisal_flow": { + "auroc": 0.5917123597164796, + "auprc": 0.48826224621829184 + }, + "causal_surprisal_packet_max": { + "auroc": 0.7196741952155936, + "auprc": 0.5889493749751665 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.633955441523922, + "auprc": 0.5383955281838839 + }, + "causal_surprisal_packet_median": { + "auroc": 0.5950375073833432, + "auprc": 0.5180904893231839 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.6007857722976964, + "auprc": 0.5207859836070919 + }, + "causal_surprisal_total": { + "auroc": 0.5854307294743059, + "auprc": 0.45455544163974315 + }, + "consistency_total": { + "auroc": 0.6296457176609569, + "auprc": 0.4330148485772283 + }, + "curvature_flow": { + "auroc": 0.35192582693443586, + "auprc": 0.3172234076361438 + }, + "curvature_packet": { + "auroc": 0.8412018310691082, + "auprc": 0.7582025443860729 + }, + "curvature_total": { + "auroc": 0.8005971869462493, + "auprc": 0.7224489419424731 + }, + "direction_drift_flow": { + "auroc": 0.3866758121677496, + "auprc": 0.31992061378783976 + }, + "direction_drift_packet_max": { + "auroc": 0.5253155936207915, + "auprc": 0.39612389168747375 + }, + "direction_drift_packet_mean": { + "auroc": 0.31179742321323095, + "auprc": 0.29345481107918375 + }, + "direction_drift_packet_median": { + "auroc": 0.3185180005906675, + "auprc": 0.2955992240388345 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.29893761075014763, + "auprc": 0.2899929252142054 + }, + "direction_drift_total": { + "auroc": 0.3577736488481985, + "auprc": 0.31021779665249805 + }, + "flow_consistency": { + "auroc": 0.6159881940342586, + "auprc": 0.4259467570290725 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.6506700457767277, + "auprc": 0.5124240679213178 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.6255508047844064, + "auprc": 0.47903980051351924 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.6244962418783225, + "auprc": 0.4843555420274357 + }, + "kinetic_energy": { + "auroc": 0.6685729917306557, + "auprc": 0.6164258379804632 + }, + "kinetic_flow": { + "auroc": 0.7220523183697578, + "auprc": 0.5440129929918858 + }, + "kinetic_packet": { + "auroc": 0.718347880980508, + "auprc": 0.6525585486246017 + }, + "packet_consistency": { + "auroc": 0.7580005980507973, + "auprc": 0.6100930092872549 + }, + "pna_flow": { + "auroc": 0.15163437684583578, + "auprc": 0.2563506239383087 + }, + "pna_packet_max": { + "auroc": 0.661863577968104, + "auprc": 0.5463290055805369 + }, + "pna_packet_mean": { + "auroc": 0.6506700457767277, + "auprc": 0.5124240679213178 + }, + "pna_packet_median": { + "auroc": 0.6255508047844064, + "auprc": 0.47903980051351924 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.6244962418783225, + "auprc": 0.4843555420274357 + }, + "terminal_flow": { + "auroc": 0.8572203854105138, + "auprc": 0.7684938728725426 + }, + "terminal_norm": { + "auroc": 0.7603661990549321, + "auprc": 0.7070803293987583 + }, + "terminal_packet": { + "auroc": 0.8035794300059067, + "auprc": 0.7339809019110536 + }, + "velocity_flow": { + "auroc": 0.6698358535144713, + "auprc": 0.49360889781291384 + }, + "velocity_packet": { + "auroc": 0.7911671588895451, + "auprc": 0.6092144898814608 + }, + "velocity_total": { + "auroc": 0.6756564235085647, + "auprc": 0.5939668800222226 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "arc_length": 0.5876813813813813, + "causal_surprisal_flow": 0.668677027027027, + "causal_surprisal_packet_max": 0.9621791291291291, + "causal_surprisal_packet_mean": 0.9450624624624626, + "causal_surprisal_packet_median": 0.9439953453453451, + "causal_surprisal_packet_trimmed10_mean": 0.9444472972972973, + "causal_surprisal_total": 0.8670614114114114, + "consistency_total": 0.7115971471471472, + "curvature_flow": 0.05660960960960962, + "curvature_packet": 0.525056081081081, + "curvature_total": 0.3612135135135135, + "direction_drift_flow": 0.6488174174174174, + "direction_drift_packet_max": 0.5396177927927928, + "direction_drift_packet_mean": 0.3482974474474474, + "direction_drift_packet_median": 0.3465686186186186, + "direction_drift_packet_trimmed10_mean": 0.29726036036036035, + "direction_drift_total": 0.46454091591591584, + "flow_consistency": 0.7116446696696697, + "kappa2_speed2norm_packet_mean": 0.368168018018018, + "kappa2_speed2norm_packet_median": 0.3104074324324324, + "kappa2_speed2norm_packet_trimmed10_mean": 0.29692379879879877, + "kinetic_energy": 0.5928713963963964, + "kinetic_flow": 0.42353663663663665, + "kinetic_packet": 0.8173114864864864, + "packet_consistency": 0.7341636636636637, + "pna_flow": 0.07329009009009008, + "pna_packet_max": 0.5815667417417417, + "pna_packet_mean": 0.368168018018018, + "pna_packet_median": 0.3104074324324324, + "pna_packet_trimmed10_mean": 0.29692379879879877, + "terminal_flow": 0.7997751501501502, + "terminal_norm": 0.9065702702702704, + "terminal_packet": 0.9391196696696698, + "velocity_flow": 0.40372072072072074, + "velocity_packet": 0.7475581081081081, + "velocity_total": 0.4348024024024024 + }, + "DDoS": { + "_n": 666.0, + "arc_length": 0.8521777027027027, + "causal_surprisal_flow": 0.724497147147147, + "causal_surprisal_packet_max": 0.7072211711711711, + "causal_surprisal_packet_mean": 0.57247987987988, + "causal_surprisal_packet_median": 0.49147785285285284, + "causal_surprisal_packet_trimmed10_mean": 0.49709069069069073, + "causal_surprisal_total": 0.8025032282282282, + "consistency_total": 0.7085156156156157, + "curvature_flow": 0.11065165165165165, + "curvature_packet": 0.9093411411411412, + "curvature_total": 0.8265054804804806, + "direction_drift_flow": 0.46313070570570564, + "direction_drift_packet_max": 0.5350956456456456, + "direction_drift_packet_mean": 0.24467012012012013, + "direction_drift_packet_median": 0.2744771771771772, + "direction_drift_packet_trimmed10_mean": 0.22098633633633635, + "direction_drift_total": 0.31347132132132133, + "flow_consistency": 0.6911714714714714, + "kappa2_speed2norm_packet_mean": 0.42922800300300296, + "kappa2_speed2norm_packet_median": 0.435405105105105, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3910815315315315, + "kinetic_energy": 0.8529144894894894, + "kinetic_flow": 0.81212012012012, + "kinetic_packet": 0.907265915915916, + "packet_consistency": 0.9435842342342343, + "pna_flow": 0.04256261261261261, + "pna_packet_max": 0.5352620870870871, + "pna_packet_mean": 0.42922800300300296, + "pna_packet_median": 0.435405105105105, + "pna_packet_trimmed10_mean": 0.3910815315315315, + "terminal_flow": 0.9847905405405405, + "terminal_norm": 0.9690496996996997, + "terminal_packet": 0.9527003003003002, + "velocity_flow": 0.7752872372372372, + "velocity_packet": 0.9063651651651652, + "velocity_total": 0.7255106606606607 + }, + "DoS GoldenEye": { + "_n": 666.0, + "arc_length": 0.684202927927928, + "causal_surprisal_flow": 0.7266105855855857, + "causal_surprisal_packet_max": 0.7108417417417418, + "causal_surprisal_packet_mean": 0.5303201201201202, + "causal_surprisal_packet_median": 0.4665187687687688, + "causal_surprisal_packet_trimmed10_mean": 0.4822665165165165, + "causal_surprisal_total": 0.7221885885885885, + "consistency_total": 0.6508708708708708, + "curvature_flow": 0.1098987987987988, + "curvature_packet": 0.9723737237237237, + "curvature_total": 0.9601992492492494, + "direction_drift_flow": 0.42083273273273275, + "direction_drift_packet_max": 0.6440060810810811, + "direction_drift_packet_mean": 0.32223626126126126, + "direction_drift_packet_median": 0.3150092342342342, + "direction_drift_packet_trimmed10_mean": 0.2976351351351352, + "direction_drift_total": 0.446559984984985, + "flow_consistency": 0.6325072072072072, + "kappa2_speed2norm_packet_mean": 0.8166488738738739, + "kappa2_speed2norm_packet_median": 0.7685891141141141, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7861373123123122, + "kinetic_energy": 0.6835375375375375, + "kinetic_flow": 0.830852027027027, + "kinetic_packet": 0.8103594594594595, + "packet_consistency": 0.8994916666666666, + "pna_flow": 0.03449264264264264, + "pna_packet_max": 0.7746638888888888, + "pna_packet_mean": 0.8166488738738739, + "pna_packet_median": 0.7685891141141141, + "pna_packet_trimmed10_mean": 0.7861373123123122, + "terminal_flow": 0.9794735735735737, + "terminal_norm": 0.8846638138138138, + "terminal_packet": 0.8718198198198197, + "velocity_flow": 0.7677525525525527, + "velocity_packet": 0.8429014264264265, + "velocity_total": 0.660370870870871 + }, + "DoS Hulk": { + "_n": 666.0, + "arc_length": 0.7357327327327328, + "causal_surprisal_flow": 0.7212965465465465, + "causal_surprisal_packet_max": 0.687484984984985, + "causal_surprisal_packet_mean": 0.45994954954954953, + "causal_surprisal_packet_median": 0.37190638138138143, + "causal_surprisal_packet_trimmed10_mean": 0.3961985735735735, + "causal_surprisal_total": 0.7530839339339339, + "consistency_total": 0.6396066066066066, + "curvature_flow": 0.44048168168168167, + "curvature_packet": 0.9569792792792793, + "curvature_total": 0.9434501501501502, + "direction_drift_flow": 0.4525032282282283, + "direction_drift_packet_max": 0.6698276276276276, + "direction_drift_packet_mean": 0.19627454954954954, + "direction_drift_packet_median": 0.21489459459459465, + "direction_drift_packet_trimmed10_mean": 0.1649963963963964, + "direction_drift_total": 0.24110960960960962, + "flow_consistency": 0.582454054054054, + "kappa2_speed2norm_packet_mean": 0.6756627627627628, + "kappa2_speed2norm_packet_median": 0.6499805555555555, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6095439939939938, + "kinetic_energy": 0.7334834084084084, + "kinetic_flow": 0.7942321321321322, + "kinetic_packet": 0.86661006006006, + "packet_consistency": 0.9705357357357357, + "pna_flow": 0.1764716216216216, + "pna_packet_max": 0.7972864114114114, + "pna_packet_mean": 0.6756627627627628, + "pna_packet_median": 0.6499805555555555, + "pna_packet_trimmed10_mean": 0.6095439939939938, + "terminal_flow": 0.8819632882882883, + "terminal_norm": 0.7687743243243244, + "terminal_packet": 0.8390633633633635, + "velocity_flow": 0.7530915165165165, + "velocity_packet": 0.9302618618618619, + "velocity_total": 0.7348428678678679 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "arc_length": 0.7271611861861862, + "causal_surprisal_flow": 0.7284948948948949, + "causal_surprisal_packet_max": 0.7860731981981981, + "causal_surprisal_packet_mean": 0.7705777777777779, + "causal_surprisal_packet_median": 0.7033915915915916, + "causal_surprisal_packet_trimmed10_mean": 0.7334356606606606, + "causal_surprisal_total": 0.8047067567567567, + "consistency_total": 0.5347902402402402, + "curvature_flow": 0.48629564564564565, + "curvature_packet": 0.9605301801801802, + "curvature_total": 0.9417647897897897, + "direction_drift_flow": 0.3716567567567568, + "direction_drift_packet_max": 0.6153053303303303, + "direction_drift_packet_mean": 0.3139198198198198, + "direction_drift_packet_median": 0.31780165165165164, + "direction_drift_packet_trimmed10_mean": 0.2763357357357357, + "direction_drift_total": 0.40352522522522527, + "flow_consistency": 0.4894184684684684, + "kappa2_speed2norm_packet_mean": 0.7969043543543544, + "kappa2_speed2norm_packet_median": 0.7472057057057057, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7586628378378377, + "kinetic_energy": 0.7258125375375376, + "kinetic_flow": 0.7106626126126125, + "kinetic_packet": 0.8141222222222221, + "packet_consistency": 0.7843954954954956, + "pna_flow": 0.21802027027027024, + "pna_packet_max": 0.7548216966966965, + "pna_packet_mean": 0.7969043543543544, + "pna_packet_median": 0.7472057057057057, + "pna_packet_trimmed10_mean": 0.7586628378378377, + "terminal_flow": 0.8187704954954955, + "terminal_norm": 0.8406483483483483, + "terminal_packet": 0.8887905405405405, + "velocity_flow": 0.6803432432432432, + "velocity_packet": 0.8257289789789789, + "velocity_total": 0.656401051051051 + }, + "DoS Slowloris": { + "_n": 666.0, + "arc_length": 0.6482009009009009, + "causal_surprisal_flow": 0.6000250750750751, + "causal_surprisal_packet_max": 0.6802009009009008, + "causal_surprisal_packet_mean": 0.5746642642642642, + "causal_surprisal_packet_median": 0.5000648648648649, + "causal_surprisal_packet_trimmed10_mean": 0.486287012012012, + "causal_surprisal_total": 0.5137129129129129, + "consistency_total": 0.5588295795795796, + "curvature_flow": 0.270590990990991, + "curvature_packet": 0.9322475975975977, + "curvature_total": 0.9158308558558558, + "direction_drift_flow": 0.3965053303303303, + "direction_drift_packet_max": 0.5952430930930932, + "direction_drift_packet_mean": 0.272563963963964, + "direction_drift_packet_median": 0.25472897897897895, + "direction_drift_packet_trimmed10_mean": 0.24335960960960962, + "direction_drift_total": 0.2437238738738739, + "flow_consistency": 0.571823123123123, + "kappa2_speed2norm_packet_mean": 0.8008833333333333, + "kappa2_speed2norm_packet_median": 0.7246210960960962, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7467411411411411, + "kinetic_energy": 0.6442976726726727, + "kinetic_flow": 0.6947373873873874, + "kinetic_packet": 0.7333487987987988, + "packet_consistency": 0.6207449699699701, + "pna_flow": 0.14859714714714714, + "pna_packet_max": 0.8217073573573573, + "pna_packet_mean": 0.8008833333333333, + "pna_packet_median": 0.7246210960960962, + "pna_packet_trimmed10_mean": 0.7467411411411411, + "terminal_flow": 0.8049051801801801, + "terminal_norm": 0.7442686936936938, + "terminal_packet": 0.8110192192192193, + "velocity_flow": 0.5709373123123124, + "velocity_packet": 0.8041804054054055, + "velocity_total": 0.7295837087087087 + }, + "FTP-Patator": { + "_n": 666.0, + "arc_length": 0.20157620120120118, + "causal_surprisal_flow": 0.756881981981982, + "causal_surprisal_packet_max": 0.9380917417417418, + "causal_surprisal_packet_mean": 0.9021861861861862, + "causal_surprisal_packet_median": 0.8810986486486486, + "causal_surprisal_packet_trimmed10_mean": 0.889877927927928, + "causal_surprisal_total": 0.6017402402402402, + "consistency_total": 0.6279959459459459, + "curvature_flow": 0.03853438438438438, + "curvature_packet": 0.7547343843843844, + "curvature_total": 0.5882123123123123, + "direction_drift_flow": 0.5346141891891891, + "direction_drift_packet_max": 0.5636714714714715, + "direction_drift_packet_mean": 0.44807387387387393, + "direction_drift_packet_median": 0.4555227477477478, + "direction_drift_packet_trimmed10_mean": 0.439656006006006, + "direction_drift_total": 0.6877797297297297, + "flow_consistency": 0.6466598348348349, + "kappa2_speed2norm_packet_mean": 0.8201518018018018, + "kappa2_speed2norm_packet_median": 0.8041286036036036, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8063236486486487, + "kinetic_energy": 0.1983099099099099, + "kinetic_flow": 0.723451951951952, + "kinetic_packet": 0.23471306306306305, + "packet_consistency": 0.4930797297297297, + "pna_flow": 0.035488588588588596, + "pna_packet_max": 0.8395867117117116, + "pna_packet_mean": 0.8201518018018018, + "pna_packet_median": 0.8041286036036036, + "pna_packet_trimmed10_mean": 0.8063236486486487, + "terminal_flow": 0.942346996996997, + "terminal_norm": 0.40620990990990985, + "terminal_packet": 0.5540735735735736, + "velocity_flow": 0.5129204954954956, + "velocity_packet": 0.6757627627627628, + "velocity_total": 0.36140150150150147 + }, + "Heartbleed": { + "_n": 1.0, + "arc_length": 0.9188000000000001, + "causal_surprisal_flow": 0.02210000000000001, + "causal_surprisal_packet_max": 0.15969999999999995, + "causal_surprisal_packet_mean": 0.006000000000000005, + "causal_surprisal_packet_median": 0.005700000000000038, + "causal_surprisal_packet_trimmed10_mean": 0.005700000000000038, + "causal_surprisal_total": 0.00029999999999996696, + "consistency_total": 0.9954999999999999, + "curvature_flow": 0.7194, + "curvature_packet": 0.6549, + "curvature_total": 0.5246999999999999, + "direction_drift_flow": 0.01100000000000001, + "direction_drift_packet_max": 0.24429999999999996, + "direction_drift_packet_mean": 0.021399999999999975, + "direction_drift_packet_median": 0.0534, + "direction_drift_packet_trimmed10_mean": 0.024800000000000044, + "direction_drift_total": 0.02739999999999998, + "flow_consistency": 0.9954, + "kappa2_speed2norm_packet_mean": 0.16800000000000004, + "kappa2_speed2norm_packet_median": 0.21099999999999997, + "kappa2_speed2norm_packet_trimmed10_mean": 0.17720000000000002, + "kinetic_energy": 0.9159999999999999, + "kinetic_flow": 0.9986999999999999, + "kinetic_packet": 0.7391, + "packet_consistency": 0.9981, + "pna_flow": 0.012599999999999945, + "pna_packet_max": 0.2894, + "pna_packet_mean": 0.16800000000000004, + "pna_packet_median": 0.21099999999999997, + "pna_packet_trimmed10_mean": 0.17720000000000002, + "terminal_flow": 0.9819, + "terminal_norm": 0.22109999999999996, + "terminal_packet": 0.23619999999999997, + "velocity_flow": 0.9963, + "velocity_packet": 0.9764, + "velocity_total": 0.9808 + }, + "Infiltration": { + "_n": 7.0, + "arc_length": 0.8193071428571429, + "causal_surprisal_flow": 0.3526142857142857, + "causal_surprisal_packet_max": 0.3687571428571429, + "causal_surprisal_packet_mean": 0.21244285714285713, + "causal_surprisal_packet_median": 0.20090000000000002, + "causal_surprisal_packet_trimmed10_mean": 0.19628571428571429, + "causal_surprisal_total": 0.24685714285714283, + "consistency_total": 0.6870714285714286, + "curvature_flow": 0.5423428571428571, + "curvature_packet": 0.7981285714285714, + "curvature_total": 0.7118285714285715, + "direction_drift_flow": 0.10759999999999999, + "direction_drift_packet_max": 0.46478571428571425, + "direction_drift_packet_mean": 0.22149999999999997, + "direction_drift_packet_median": 0.2334571428571428, + "direction_drift_packet_trimmed10_mean": 0.23022857142857145, + "direction_drift_total": 0.3357142857142857, + "flow_consistency": 0.6689857142857143, + "kappa2_speed2norm_packet_mean": 0.4883857142857143, + "kappa2_speed2norm_packet_median": 0.4475, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4690714285714286, + "kinetic_energy": 0.8186142857142857, + "kinetic_flow": 0.8960857142857143, + "kinetic_packet": 0.7458714285714285, + "packet_consistency": 0.8437857142857143, + "pna_flow": 0.03345714285714285, + "pna_packet_max": 0.8032714285714285, + "pna_packet_mean": 0.4883857142857143, + "pna_packet_median": 0.4475, + "pna_packet_trimmed10_mean": 0.4690714285714286, + "terminal_flow": 0.9159857142857143, + "terminal_norm": 0.5710857142857142, + "terminal_packet": 0.7708285714285714, + "velocity_flow": 0.8840857142857143, + "velocity_packet": 0.8213714285714285, + "velocity_total": 0.7731428571428571 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "arc_length": 0.9890004504504505, + "causal_surprisal_flow": 0.05379331831831831, + "causal_surprisal_packet_max": 0.6139015015015016, + "causal_surprisal_packet_mean": 0.7823093093093093, + "causal_surprisal_packet_median": 0.8124357357357358, + "causal_surprisal_packet_trimmed10_mean": 0.8053237237237237, + "causal_surprisal_total": 0.14386433933933934, + "consistency_total": 0.6801891891891892, + "curvature_flow": 0.6493716966966967, + "curvature_packet": 0.6865093093093094, + "curvature_total": 0.760520870870871, + "direction_drift_flow": 0.2797236486486486, + "direction_drift_packet_max": 0.21585758258258259, + "direction_drift_packet_mean": 0.27080495495495494, + "direction_drift_packet_median": 0.269822972972973, + "direction_drift_packet_trimmed10_mean": 0.29462027027027027, + "direction_drift_total": 0.1313087087087087, + "flow_consistency": 0.6848837837837837, + "kappa2_speed2norm_packet_mean": 0.4673833333333333, + "kappa2_speed2norm_packet_median": 0.5086412162162162, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4981772522522523, + "kinetic_energy": 0.9889996996996998, + "kinetic_flow": 0.6569866366366367, + "kinetic_packet": 0.9178551051051052, + "packet_consistency": 0.6687554804804805, + "pna_flow": 0.33598738738738737, + "pna_packet_max": 0.32684001501501503, + "pna_packet_mean": 0.4673833333333333, + "pna_packet_median": 0.5086412162162162, + "pna_packet_trimmed10_mean": 0.4981772522522523, + "terminal_flow": 0.961709009009009, + "terminal_norm": 0.9905234234234234, + "terminal_packet": 0.9735545045045044, + "velocity_flow": 0.6296617867867867, + "velocity_packet": 0.7213367867867868, + "velocity_total": 0.9821747747747747 + }, + "Portscan": { + "_n": 666.0, + "arc_length": 0.9963821321321321, + "causal_surprisal_flow": 0.01974234234234234, + "causal_surprisal_packet_max": 0.38037297297297296, + "causal_surprisal_packet_mean": 0.4782283783783784, + "causal_surprisal_packet_median": 0.550643993993994, + "causal_surprisal_packet_trimmed10_mean": 0.5216609609609609, + "causal_surprisal_total": 0.04395375375375375, + "consistency_total": 0.6951917417417419, + "curvature_flow": 0.6883916666666668, + "curvature_packet": 0.8702082582582582, + "curvature_total": 0.931872072072072, + "direction_drift_flow": 0.2883154654654655, + "direction_drift_packet_max": 0.3705853603603604, + "direction_drift_packet_mean": 0.4833923423423423, + "direction_drift_packet_median": 0.49578318318318315, + "direction_drift_packet_trimmed10_mean": 0.5021683183183183, + "direction_drift_total": 0.23812252252252253, + "flow_consistency": 0.6912585585585586, + "kappa2_speed2norm_packet_mean": 0.4805123873873874, + "kappa2_speed2norm_packet_median": 0.5004575075075075, + "kappa2_speed2norm_packet_trimmed10_mean": 0.505788138138138, + "kinetic_energy": 0.9963644144144145, + "kinetic_flow": 0.5813560810810812, + "kinetic_packet": 0.9902735735735735, + "packet_consistency": 0.7840686186186185, + "pna_flow": 0.41933078078078084, + "pna_packet_max": 0.246090015015015, + "pna_packet_mean": 0.4805123873873874, + "pna_packet_median": 0.5004575075075075, + "pna_packet_trimmed10_mean": 0.505788138138138, + "terminal_flow": 0.8992140390390392, + "terminal_norm": 0.9928743243243243, + "terminal_packet": 0.9938888888888888, + "velocity_flow": 0.6118972972972972, + "velocity_packet": 0.7100406906906908, + "velocity_total": 0.9940848348348348 + }, + "SSH-Patator": { + "_n": 666.0, + "arc_length": 0.2559102102102102, + "causal_surprisal_flow": 0.9909890390390391, + "causal_surprisal_packet_max": 0.8146312312312313, + "causal_surprisal_packet_mean": 0.41020863363363363, + "causal_surprisal_packet_median": 0.3099921921921922, + "causal_surprisal_packet_trimmed10_mean": 0.33350255255255257, + "causal_surprisal_total": 0.6785606606606607, + "consistency_total": 0.5116013513513514, + "curvature_flow": 0.6546378378378378, + "curvature_packet": 0.8612772522522523, + "curvature_total": 0.8079012762762764, + "direction_drift_flow": 0.06369894894894894, + "direction_drift_packet_max": 0.5408514264264264, + "direction_drift_packet_mean": 0.25654286786786784, + "direction_drift_packet_median": 0.2787815315315315, + "direction_drift_packet_trimmed10_mean": 0.28989744744744744, + "direction_drift_total": 0.44958025525525525, + "flow_consistency": 0.5243024774774775, + "kappa2_speed2norm_packet_mean": 0.8936831831831832, + "kappa2_speed2norm_packet_median": 0.847317192192192, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8840393393393392, + "kinetic_energy": 0.2488376126126126, + "kinetic_flow": 0.9540496996996997, + "kinetic_packet": 0.12453183183183182, + "packet_consistency": 0.6501202702702703, + "pna_flow": 0.05533123123123123, + "pna_packet_max": 0.9343736486486486, + "pna_packet_mean": 0.8936831831831832, + "pna_packet_median": 0.847317192192192, + "pna_packet_trimmed10_mean": 0.8840393393393392, + "terminal_flow": 0.48869144144144144, + "terminal_norm": 0.17887259759759758, + "terminal_packet": 0.28695788288288293, + "velocity_flow": 0.9475045045045044, + "velocity_packet": 0.7238800300300301, + "velocity_total": 0.4371915915915916 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "arc_length": 0.7913863013698631, + "causal_surprisal_flow": 0.058415068493150674, + "causal_surprisal_packet_max": 0.13401369863013698, + "causal_surprisal_packet_mean": 0.009516438356164387, + "causal_surprisal_packet_median": 0.007319178082191782, + "causal_surprisal_packet_trimmed10_mean": 0.007450684931506826, + "causal_surprisal_total": 0.0073958904109589175, + "consistency_total": 0.44442876712328766, + "curvature_flow": 0.4594054794520548, + "curvature_packet": 0.7295712328767123, + "curvature_total": 0.5870212328767123, + "direction_drift_flow": 0.004889726027397239, + "direction_drift_packet_max": 0.2375287671232877, + "direction_drift_packet_mean": 0.021650684931506854, + "direction_drift_packet_median": 0.023656164383561645, + "direction_drift_packet_trimmed10_mean": 0.024108219178082195, + "direction_drift_total": 0.027672602739726024, + "flow_consistency": 0.1112068493150685, + "kappa2_speed2norm_packet_mean": 0.36209178082191784, + "kappa2_speed2norm_packet_median": 0.36682876712328766, + "kappa2_speed2norm_packet_trimmed10_mean": 0.37385205479452055, + "kinetic_energy": 0.7837219178082192, + "kinetic_flow": 0.9986643835616438, + "kinetic_packet": 0.4268328767123287, + "packet_consistency": 0.962317808219178, + "pna_flow": 0.00574246575342466, + "pna_packet_max": 0.6831849315068493, + "pna_packet_mean": 0.36209178082191784, + "pna_packet_median": 0.36682876712328766, + "pna_packet_trimmed10_mean": 0.37385205479452055, + "terminal_flow": 0.912221917808219, + "terminal_norm": 0.17857123287671234, + "terminal_packet": 0.24357328767123285, + "velocity_flow": 0.9972246575342465, + "velocity_packet": 0.9586232876712328, + "velocity_total": 0.965041095890411 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "arc_length": 0.6724153846153846, + "causal_surprisal_flow": 0.7515846153846154, + "causal_surprisal_packet_max": 0.8233230769230769, + "causal_surprisal_packet_mean": 0.8611230769230769, + "causal_surprisal_packet_median": 0.8153692307692308, + "causal_surprisal_packet_trimmed10_mean": 0.8115307692307692, + "causal_surprisal_total": 0.920423076923077, + "consistency_total": 0.6290076923076924, + "curvature_flow": 0.10309230769230772, + "curvature_packet": 0.9624999999999999, + "curvature_total": 0.9284846153846154, + "direction_drift_flow": 0.5230538461538461, + "direction_drift_packet_max": 0.6940307692307692, + "direction_drift_packet_mean": 0.43830769230769234, + "direction_drift_packet_median": 0.5075076923076923, + "direction_drift_packet_trimmed10_mean": 0.3729923076923077, + "direction_drift_total": 0.5695076923076923, + "flow_consistency": 0.6201384615384615, + "kappa2_speed2norm_packet_mean": 0.8379461538461538, + "kappa2_speed2norm_packet_median": 0.7630769230769231, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7814461538461539, + "kinetic_energy": 0.6729076923076924, + "kinetic_flow": 0.6435230769230769, + "kinetic_packet": 0.8144, + "packet_consistency": 0.8329307692307693, + "pna_flow": 0.05814615384615385, + "pna_packet_max": 0.7324076923076923, + "pna_packet_mean": 0.8379461538461538, + "pna_packet_median": 0.7630769230769231, + "pna_packet_trimmed10_mean": 0.7814461538461539, + "terminal_flow": 0.9411999999999999, + "terminal_norm": 0.9052769230769231, + "terminal_packet": 0.8726, + "velocity_flow": 0.5543461538461538, + "velocity_packet": 0.7740769230769231, + "velocity_total": 0.6086384615384615 + }, + "Web Attack - XSS": { + "_n": 18.0, + "arc_length": 0.883461111111111, + "causal_surprisal_flow": 0.029972222222222233, + "causal_surprisal_packet_max": 0.07007777777777778, + "causal_surprisal_packet_mean": 0.003155555555555541, + "causal_surprisal_packet_median": 0.0028888888888888727, + "causal_surprisal_packet_trimmed10_mean": 0.0026222222222222233, + "causal_surprisal_total": 0.0003833333333332973, + "consistency_total": 0.49755555555555553, + "curvature_flow": 0.5116722222222222, + "curvature_packet": 0.5955833333333334, + "curvature_total": 0.4588, + "direction_drift_flow": 0.0034444444444444167, + "direction_drift_packet_max": 0.24425000000000002, + "direction_drift_packet_mean": 0.012711111111111104, + "direction_drift_packet_median": 0.011866666666666668, + "direction_drift_packet_trimmed10_mean": 0.013027777777777761, + "direction_drift_total": 0.017061111111111103, + "flow_consistency": 0.16752777777777778, + "kappa2_speed2norm_packet_mean": 0.2022388888888889, + "kappa2_speed2norm_packet_median": 0.14167777777777776, + "kappa2_speed2norm_packet_trimmed10_mean": 0.19004444444444446, + "kinetic_energy": 0.8775, + "kinetic_flow": 0.9998055555555556, + "kinetic_packet": 0.6016055555555556, + "packet_consistency": 0.9780111111111112, + "pna_flow": 0.005050000000000005, + "pna_packet_max": 0.7283222222222222, + "pna_packet_mean": 0.2022388888888889, + "pna_packet_median": 0.14167777777777776, + "pna_packet_trimmed10_mean": 0.19004444444444446, + "terminal_flow": 0.9346, + "terminal_norm": 0.20342222222222223, + "terminal_packet": 0.28696666666666665, + "velocity_flow": 0.9979944444444444, + "velocity_packet": 0.9775944444444444, + "velocity_total": 0.9829777777777777 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicids2017.log b/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicids2017.log new file mode 100644 index 0000000..04497f4 --- /dev/null +++ b/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicids2017.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 2,025,564 target rows; label distribution top: + normal 1,521,748 + Portscan 159,040 + DoS Hulk 158,454 + DDoS 95,144 + Infiltration - Portscan 71,714 +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 20.0s +[eval] scoring attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done in 13.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicids2017.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicids2017.npz + +=== overall AUROC top-10 === + terminal_flow AUROC=0.8572 AUPRC=0.7685 + curvature_packet AUROC=0.8412 AUPRC=0.7582 + terminal_packet AUROC=0.8036 AUPRC=0.7340 + curvature_total AUROC=0.8006 AUPRC=0.7224 + velocity_packet AUROC=0.7912 AUPRC=0.6092 + terminal_norm AUROC=0.7604 AUPRC=0.7071 + packet_consistency AUROC=0.7580 AUPRC=0.6101 + kinetic_flow AUROC=0.7221 AUPRC=0.5440 + causal_surprisal_packet_max AUROC=0.7197 AUPRC=0.5889 + kinetic_packet AUROC=0.7183 AUPRC=0.6526 diff --git a/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicids2017.npz b/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicids2017.npz new file mode 100644 index 0000000..7d18ee9 Binary files /dev/null and b/artifacts/route_comparison/cross/route_a_causal_seed43_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicddos2019.json b/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicddos2019.json new file mode 100644 index 0000000..5868abc --- /dev/null +++ b/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicddos2019.json @@ -0,0 +1,818 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.8882192514726792, + "auprc": 0.8985238679531286 + }, + "causal_surprisal_flow": { + "auroc": 0.31957307028234816, + "auprc": 0.375946799007818 + }, + "causal_surprisal_packet_max": { + "auroc": 0.0837949268738574, + "auprc": 0.31351073013204644 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.1080802153158643, + "auprc": 0.3194639529611711 + }, + "causal_surprisal_packet_median": { + "auroc": 0.15485767824497257, + "auprc": 0.33029337771209166 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.1305763965061954, + "auprc": 0.3246214227945802 + }, + "causal_surprisal_total": { + "auroc": 0.31786300528133254, + "auprc": 0.3754237989177158 + }, + "consistency_total": { + "auroc": 0.7985954803981312, + "auprc": 0.749821292584627 + }, + "curvature_flow": { + "auroc": 0.41008962522851916, + "auprc": 0.4407894939564344 + }, + "curvature_packet": { + "auroc": 0.5161445510867357, + "auprc": 0.4952381880015613 + }, + "curvature_total": { + "auroc": 0.44911197948405446, + "auprc": 0.45467179348456266 + }, + "direction_drift_flow": { + "auroc": 0.3676984460694699, + "auprc": 0.3950218280568701 + }, + "direction_drift_packet_max": { + "auroc": 0.12721718972171442, + "auprc": 0.3212969319729195 + }, + "direction_drift_packet_mean": { + "auroc": 0.10829369794840545, + "auprc": 0.31806318877913 + }, + "direction_drift_packet_median": { + "auroc": 0.12053134775543368, + "auprc": 0.32056907201988344 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.11955377818403413, + "auprc": 0.32032798876364477 + }, + "direction_drift_total": { + "auroc": 0.07655550985171643, + "auprc": 0.3137072910157193 + }, + "flow_consistency": { + "auroc": 0.7998166768230754, + "auprc": 0.7593583299630142 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.21277953991468618, + "auprc": 0.35491065213587913 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.21744115376802764, + "auprc": 0.35678856768783473 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.2135596587446679, + "auprc": 0.3566892655982896 + }, + "kinetic_energy": { + "auroc": 0.8877397775746497, + "auprc": 0.898238680375208 + }, + "kinetic_flow": { + "auroc": 0.8013668291692058, + "auprc": 0.6945046262701722 + }, + "kinetic_packet": { + "auroc": 0.7301436065407273, + "auprc": 0.6939211352729558 + }, + "packet_consistency": { + "auroc": 0.5632958917326834, + "auprc": 0.5253612486335599 + }, + "pna_flow": { + "auroc": 0.23392979890310783, + "auprc": 0.35387092595317515 + }, + "pna_packet_max": { + "auroc": 0.23318757871216736, + "auprc": 0.37928908604172196 + }, + "pna_packet_mean": { + "auroc": 0.21277953991468618, + "auprc": 0.35491065213587913 + }, + "pna_packet_median": { + "auroc": 0.21744115376802764, + "auprc": 0.35678856768783473 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.2135596587446679, + "auprc": 0.3566892655982896 + }, + "terminal_flow": { + "auroc": 0.6934829575462117, + "auprc": 0.625219348903951 + }, + "terminal_norm": { + "auroc": 0.7463211100954702, + "auprc": 0.6969860093995155 + }, + "terminal_packet": { + "auroc": 0.6611859079829372, + "auprc": 0.6218222618281957 + }, + "velocity_flow": { + "auroc": 0.7617335313833028, + "auprc": 0.650089248321139 + }, + "velocity_packet": { + "auroc": 0.7810326071501117, + "auprc": 0.7618977204342776 + }, + "velocity_total": { + "auroc": 0.9042385994312412, + "auprc": 0.9128891970079394 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "arc_length": 0.9920147959183673, + "causal_surprisal_flow": 0.28821955782312925, + "causal_surprisal_packet_max": 0.01735459183673469, + "causal_surprisal_packet_mean": 0.04359132653061224, + "causal_surprisal_packet_median": 0.10998690476190476, + "causal_surprisal_packet_trimmed10_mean": 0.07650272108843537, + "causal_surprisal_total": 0.3206522108843538, + "consistency_total": 0.8049375850340136, + "curvature_flow": 0.14756173469387757, + "curvature_packet": 0.5636090986394559, + "curvature_total": 0.24934549319727892, + "direction_drift_flow": 0.42011862244897963, + "direction_drift_packet_max": 0.018812585034013604, + "direction_drift_packet_mean": 0.016315646258503402, + "direction_drift_packet_median": 0.020253911564625852, + "direction_drift_packet_trimmed10_mean": 0.017871258503401363, + "direction_drift_total": 0.015794897959183676, + "flow_consistency": 0.7919993197278912, + "kappa2_speed2norm_packet_mean": 0.033786564625850335, + "kappa2_speed2norm_packet_median": 0.03696207482993197, + "kappa2_speed2norm_packet_trimmed10_mean": 0.03677772108843537, + "kinetic_energy": 0.9919593537414966, + "kinetic_flow": 0.8917337585034013, + "kinetic_packet": 0.8907348639455783, + "packet_consistency": 0.8192005102040816, + "pna_flow": 0.11163248299319728, + "pna_packet_max": 0.02850425170068027, + "pna_packet_mean": 0.033786564625850335, + "pna_packet_median": 0.03696207482993197, + "pna_packet_trimmed10_mean": 0.03677772108843537, + "terminal_flow": 0.8758969387755102, + "terminal_norm": 0.9363379251700681, + "terminal_packet": 0.8609289115646258, + "velocity_flow": 0.7181417517006803, + "velocity_packet": 0.9720382653061226, + "velocity_total": 0.9927003401360543 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "arc_length": 0.9946720238095239, + "causal_surprisal_flow": 0.28912568027210883, + "causal_surprisal_packet_max": 0.01705051020408163, + "causal_surprisal_packet_mean": 0.04340204081632653, + "causal_surprisal_packet_median": 0.11047772108843537, + "causal_surprisal_packet_trimmed10_mean": 0.07651360544217688, + "causal_surprisal_total": 0.32155510204081633, + "consistency_total": 0.8025357142857142, + "curvature_flow": 0.1292607142857143, + "curvature_packet": 0.5727880102040817, + "curvature_total": 0.24177593537414965, + "direction_drift_flow": 0.43293426870748297, + "direction_drift_packet_max": 0.012263435374149662, + "direction_drift_packet_mean": 0.00840289115646258, + "direction_drift_packet_median": 0.011321598639455786, + "direction_drift_packet_trimmed10_mean": 0.00887057823129252, + "direction_drift_total": 0.012186224489795923, + "flow_consistency": 0.7873761904761906, + "kappa2_speed2norm_packet_mean": 0.013151360544217682, + "kappa2_speed2norm_packet_median": 0.015093367346938773, + "kappa2_speed2norm_packet_trimmed10_mean": 0.01488979591836735, + "kinetic_energy": 0.9946670068027211, + "kinetic_flow": 0.8961637755102041, + "kinetic_packet": 0.9068437074829933, + "packet_consistency": 0.8495744897959183, + "pna_flow": 0.10592908163265305, + "pna_packet_max": 0.017747448979591834, + "pna_packet_mean": 0.013151360544217682, + "pna_packet_median": 0.015093367346938773, + "pna_packet_trimmed10_mean": 0.01488979591836735, + "terminal_flow": 0.8888188775510205, + "terminal_norm": 0.9440756802721088, + "terminal_packet": 0.8743990646258504, + "velocity_flow": 0.7124768707482992, + "velocity_packet": 0.9915367346938776, + "velocity_total": 0.995596768707483 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "arc_length": 0.9854619047619049, + "causal_surprisal_flow": 0.29025510204081634, + "causal_surprisal_packet_max": 0.015329421768707479, + "causal_surprisal_packet_mean": 0.03420527210884353, + "causal_surprisal_packet_median": 0.09443554421768707, + "causal_surprisal_packet_trimmed10_mean": 0.06317789115646259, + "causal_surprisal_total": 0.3248590136054421, + "consistency_total": 0.9115585034013605, + "curvature_flow": 0.23583639455782315, + "curvature_packet": 0.5060038265306122, + "curvature_total": 0.30255816326530616, + "direction_drift_flow": 0.43877789115646254, + "direction_drift_packet_max": 0.0725483843537415, + "direction_drift_packet_mean": 0.07043460884353742, + "direction_drift_packet_median": 0.08775348639455782, + "direction_drift_packet_trimmed10_mean": 0.08379600340136055, + "direction_drift_total": 0.04401479591836734, + "flow_consistency": 0.9227675170068026, + "kappa2_speed2norm_packet_mean": 0.17985238095238096, + "kappa2_speed2norm_packet_median": 0.2017511054421769, + "kappa2_speed2norm_packet_trimmed10_mean": 0.19603741496598642, + "kinetic_energy": 0.9852442176870748, + "kinetic_flow": 0.8949253401360545, + "kinetic_packet": 0.768090731292517, + "packet_consistency": 0.5298653911564626, + "pna_flow": 0.1364311224489796, + "pna_packet_max": 0.15193554421768707, + "pna_packet_mean": 0.17985238095238096, + "pna_packet_median": 0.2017511054421769, + "pna_packet_trimmed10_mean": 0.19603741496598642, + "terminal_flow": 0.7712523809523809, + "terminal_norm": 0.8732408163265307, + "terminal_packet": 0.7160769557823129, + "velocity_flow": 0.8734057823129251, + "velocity_packet": 0.7657600340136054, + "velocity_total": 0.9903647959183675 + }, + "DrDoS_NTP": { + "_n": 588.0, + "arc_length": 0.6151974489795919, + "causal_surprisal_flow": 0.7113712585034013, + "causal_surprisal_packet_max": 0.03467653061224489, + "causal_surprisal_packet_mean": 0.050146768707483, + "causal_surprisal_packet_median": 0.11201394557823129, + "causal_surprisal_packet_trimmed10_mean": 0.08207397959183674, + "causal_surprisal_total": 0.2769819727891157, + "consistency_total": 0.8853960884353741, + "curvature_flow": 0.6877909863945578, + "curvature_packet": 0.5753028911564625, + "curvature_total": 0.5457179421768708, + "direction_drift_flow": 0.21069404761904761, + "direction_drift_packet_max": 0.4638301020408163, + "direction_drift_packet_mean": 0.04330663265306123, + "direction_drift_packet_median": 0.04403775510204082, + "direction_drift_packet_trimmed10_mean": 0.040181462585034015, + "direction_drift_total": 0.07873843537414967, + "flow_consistency": 0.8944404761904762, + "kappa2_speed2norm_packet_mean": 0.19163971088435375, + "kappa2_speed2norm_packet_median": 0.12529251700680272, + "kappa2_speed2norm_packet_trimmed10_mean": 0.11664319727891156, + "kinetic_energy": 0.6160795918367347, + "kinetic_flow": 0.8956532312925168, + "kinetic_packet": 0.7707428571428571, + "packet_consistency": 0.5815678571428572, + "pna_flow": 0.20368545918367348, + "pna_packet_max": 0.8458183673469387, + "pna_packet_mean": 0.19163971088435375, + "pna_packet_median": 0.12529251700680272, + "pna_packet_trimmed10_mean": 0.11664319727891156, + "terminal_flow": 0.7980750000000001, + "terminal_norm": 0.560905612244898, + "terminal_packet": 0.5766940476190476, + "velocity_flow": 0.9116323129251701, + "velocity_packet": 0.9329519557823128, + "velocity_total": 0.6510293367346939 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "arc_length": 0.9534908163265307, + "causal_surprisal_flow": 0.277864880952381, + "causal_surprisal_packet_max": 0.0018957482993197238, + "causal_surprisal_packet_mean": 0.008172789115646261, + "causal_surprisal_packet_median": 0.037695408163265304, + "causal_surprisal_packet_trimmed10_mean": 0.02303078231292517, + "causal_surprisal_total": 0.30835059523809527, + "consistency_total": 0.966374149659864, + "curvature_flow": 0.7640100340136055, + "curvature_packet": 0.2843626700680272, + "curvature_total": 0.544691156462585, + "direction_drift_flow": 0.3452670918367347, + "direction_drift_packet_max": 0.12045731292517006, + "direction_drift_packet_mean": 0.2230488095238095, + "direction_drift_packet_median": 0.24370297619047618, + "direction_drift_packet_trimmed10_mean": 0.24820493197278912, + "direction_drift_total": 0.10722448979591837, + "flow_consistency": 0.9729649659863946, + "kappa2_speed2norm_packet_mean": 0.21456717687074828, + "kappa2_speed2norm_packet_median": 0.24045833333333333, + "kappa2_speed2norm_packet_trimmed10_mean": 0.23488809523809523, + "kinetic_energy": 0.9524511904761905, + "kinetic_flow": 0.8873928571428571, + "kinetic_packet": 0.5161215986394558, + "packet_consistency": 0.2996585034013606, + "pna_flow": 0.31775306122448976, + "pna_packet_max": 0.13315204081632653, + "pna_packet_mean": 0.21456717687074828, + "pna_packet_median": 0.24045833333333333, + "pna_packet_trimmed10_mean": 0.23488809523809523, + "terminal_flow": 0.6135438775510204, + "terminal_norm": 0.7126836734693877, + "terminal_packet": 0.5205395408163265, + "velocity_flow": 0.8833617346938776, + "velocity_packet": 0.5391941326530612, + "velocity_total": 0.9904586734693878 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "arc_length": 0.9966156462585034, + "causal_surprisal_flow": 0.2887156462585034, + "causal_surprisal_packet_max": 0.0160047619047619, + "causal_surprisal_packet_mean": 0.0407828231292517, + "causal_surprisal_packet_median": 0.10615221088435375, + "causal_surprisal_packet_trimmed10_mean": 0.07281156462585035, + "causal_surprisal_total": 0.32097482993197285, + "consistency_total": 0.8158049319727891, + "curvature_flow": 0.160203231292517, + "curvature_packet": 0.5453487244897959, + "curvature_total": 0.24233086734693876, + "direction_drift_flow": 0.41088852040816326, + "direction_drift_packet_max": 0.017855442176870753, + "direction_drift_packet_mean": 0.017878231292517005, + "direction_drift_packet_median": 0.021508333333333338, + "direction_drift_packet_trimmed10_mean": 0.019358503401360548, + "direction_drift_total": 0.016085714285714287, + "flow_consistency": 0.8007326530612244, + "kappa2_speed2norm_packet_mean": 0.01838299319727891, + "kappa2_speed2norm_packet_median": 0.02085017006802721, + "kappa2_speed2norm_packet_trimmed10_mean": 0.020531632653061224, + "kinetic_energy": 0.9965846938775509, + "kinetic_flow": 0.9021947278911565, + "kinetic_packet": 0.8861122448979593, + "packet_consistency": 0.8209744897959185, + "pna_flow": 0.11669778911564625, + "pna_packet_max": 0.021486394557823127, + "pna_packet_mean": 0.01838299319727891, + "pna_packet_median": 0.02085017006802721, + "pna_packet_trimmed10_mean": 0.020531632653061224, + "terminal_flow": 0.8747153911564626, + "terminal_norm": 0.9273772108843537, + "terminal_packet": 0.8532239795918368, + "velocity_flow": 0.7877102040816326, + "velocity_packet": 0.9717297619047619, + "velocity_total": 0.9989698979591837 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "arc_length": 0.764211224489796, + "causal_surprisal_flow": 0.3521719387755102, + "causal_surprisal_packet_max": 0.011608503401360541, + "causal_surprisal_packet_mean": 0.02770561224489796, + "causal_surprisal_packet_median": 0.08329523809523809, + "causal_surprisal_packet_trimmed10_mean": 0.05313214285714286, + "causal_surprisal_total": 0.3580702380952381, + "consistency_total": 0.6315187074829931, + "curvature_flow": 0.42250850340136054, + "curvature_packet": 0.38660110544217685, + "curvature_total": 0.3584501700680272, + "direction_drift_flow": 0.3053730442176871, + "direction_drift_packet_max": 0.12360986394557824, + "direction_drift_packet_mean": 0.0858938775510204, + "direction_drift_packet_median": 0.10346802721088436, + "direction_drift_packet_trimmed10_mean": 0.0960704081632653, + "direction_drift_total": 0.08088571428571428, + "flow_consistency": 0.6399122448979592, + "kappa2_speed2norm_packet_mean": 0.17106743197278912, + "kappa2_speed2norm_packet_median": 0.17293503401360544, + "kappa2_speed2norm_packet_trimmed10_mean": 0.15894557823129252, + "kinetic_energy": 0.762249149659864, + "kinetic_flow": 0.7021964285714286, + "kinetic_packet": 0.5858897108843538, + "packet_consistency": 0.3430955782312925, + "pna_flow": 0.3315497448979592, + "pna_packet_max": 0.21053715986394556, + "pna_packet_mean": 0.17106743197278912, + "pna_packet_median": 0.17293503401360544, + "pna_packet_trimmed10_mean": 0.15894557823129252, + "terminal_flow": 0.3954619897959184, + "terminal_norm": 0.445953656462585, + "terminal_packet": 0.4041607142857143, + "velocity_flow": 0.7308168367346939, + "velocity_packet": 0.7489384353741497, + "velocity_total": 0.8270367346938776 + }, + "DrDoS_UDP": { + "_n": 588.0, + "arc_length": 0.7701653061224489, + "causal_surprisal_flow": 0.35343588435374146, + "causal_surprisal_packet_max": 0.011617517006802722, + "causal_surprisal_packet_mean": 0.027624659863945578, + "causal_surprisal_packet_median": 0.08316632653061226, + "causal_surprisal_packet_trimmed10_mean": 0.053125680272108844, + "causal_surprisal_total": 0.36388350340136055, + "consistency_total": 0.6268671768707482, + "curvature_flow": 0.47468962585034014, + "curvature_packet": 0.3999649659863946, + "curvature_total": 0.38923146258503394, + "direction_drift_flow": 0.30551267006802724, + "direction_drift_packet_max": 0.106078231292517, + "direction_drift_packet_mean": 0.08679387755102042, + "direction_drift_packet_median": 0.10590187074829932, + "direction_drift_packet_trimmed10_mean": 0.09963333333333334, + "direction_drift_total": 0.07829251700680273, + "flow_consistency": 0.6373210884353742, + "kappa2_speed2norm_packet_mean": 0.17540612244897957, + "kappa2_speed2norm_packet_median": 0.18445382653061226, + "kappa2_speed2norm_packet_trimmed10_mean": 0.17464642857142856, + "kinetic_energy": 0.7683525510204082, + "kinetic_flow": 0.7001238945578232, + "kinetic_packet": 0.5995977891156463, + "packet_consistency": 0.3245280612244898, + "pna_flow": 0.3678666666666667, + "pna_packet_max": 0.19104727891156464, + "pna_packet_mean": 0.17540612244897957, + "pna_packet_median": 0.18445382653061226, + "pna_packet_trimmed10_mean": 0.17464642857142856, + "terminal_flow": 0.3856066326530612, + "terminal_norm": 0.4390340136054422, + "terminal_packet": 0.4042522108843537, + "velocity_flow": 0.7282044217687075, + "velocity_packet": 0.7418638605442177, + "velocity_total": 0.8271321428571428 + }, + "LDAP": { + "_n": 588.0, + "arc_length": 0.9953642857142857, + "causal_surprisal_flow": 0.28896343537414965, + "causal_surprisal_packet_max": 0.017528401360544215, + "causal_surprisal_packet_mean": 0.04341445578231292, + "causal_surprisal_packet_median": 0.10970680272108844, + "causal_surprisal_packet_trimmed10_mean": 0.0758465986394558, + "causal_surprisal_total": 0.3214884353741497, + "consistency_total": 0.8101054421768707, + "curvature_flow": 0.13014991496598638, + "curvature_packet": 0.57453018707483, + "curvature_total": 0.2448527210884354, + "direction_drift_flow": 0.4708083333333334, + "direction_drift_packet_max": 0.013467687074829936, + "direction_drift_packet_mean": 0.008752721088435373, + "direction_drift_packet_median": 0.011759523809523812, + "direction_drift_packet_trimmed10_mean": 0.009323809523809524, + "direction_drift_total": 0.012543367346938774, + "flow_consistency": 0.7950836734693878, + "kappa2_speed2norm_packet_mean": 0.016973299319727887, + "kappa2_speed2norm_packet_median": 0.01790017006802721, + "kappa2_speed2norm_packet_trimmed10_mean": 0.019079761904761905, + "kinetic_energy": 0.9953908163265306, + "kinetic_flow": 0.8953054421768708, + "kinetic_packet": 0.9101744897959184, + "packet_consistency": 0.8508012755102041, + "pna_flow": 0.10713197278911565, + "pna_packet_max": 0.02097015306122449, + "pna_packet_mean": 0.016973299319727887, + "pna_packet_median": 0.01790017006802721, + "pna_packet_trimmed10_mean": 0.019079761904761905, + "terminal_flow": 0.894242006802721, + "terminal_norm": 0.9487210884353741, + "terminal_packet": 0.8793019557823128, + "velocity_flow": 0.6792072278911564, + "velocity_packet": 0.9909778911564626, + "velocity_total": 0.9955289115646259 + }, + "MSSQL": { + "_n": 588.0, + "arc_length": 0.9826753401360543, + "causal_surprisal_flow": 0.29133231292517003, + "causal_surprisal_packet_max": 0.015334863945578231, + "causal_surprisal_packet_mean": 0.034428571428571426, + "causal_surprisal_packet_median": 0.09473333333333335, + "causal_surprisal_packet_trimmed10_mean": 0.06354608843537415, + "causal_surprisal_total": 0.3275639455782313, + "consistency_total": 0.912912074829932, + "curvature_flow": 0.26533792517006805, + "curvature_packet": 0.5124653911564626, + "curvature_total": 0.32603826530612245, + "direction_drift_flow": 0.4214943027210884, + "direction_drift_packet_max": 0.08018248299319729, + "direction_drift_packet_mean": 0.07725246598639456, + "direction_drift_packet_median": 0.09462797619047618, + "direction_drift_packet_trimmed10_mean": 0.09104974489795918, + "direction_drift_total": 0.04641819727891156, + "flow_consistency": 0.9247984693877551, + "kappa2_speed2norm_packet_mean": 0.19866666666666666, + "kappa2_speed2norm_packet_median": 0.2203534013605442, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2158058673469388, + "kinetic_energy": 0.9824256802721089, + "kinetic_flow": 0.893615306122449, + "kinetic_packet": 0.7556125850340136, + "packet_consistency": 0.5125318027210884, + "pna_flow": 0.14689897959183673, + "pna_packet_max": 0.16503613945578233, + "pna_packet_mean": 0.19866666666666666, + "pna_packet_median": 0.2203534013605442, + "pna_packet_trimmed10_mean": 0.2158058673469388, + "terminal_flow": 0.7610986394557824, + "terminal_norm": 0.8657959183673469, + "terminal_packet": 0.7083445578231293, + "velocity_flow": 0.8732877551020408, + "velocity_packet": 0.7570571428571429, + "velocity_total": 0.989103231292517 + }, + "NetBIOS": { + "_n": 588.0, + "arc_length": 0.9356122448979592, + "causal_surprisal_flow": 0.28240493197278915, + "causal_surprisal_packet_max": 0.002630612244897954, + "causal_surprisal_packet_mean": 0.00964047619047619, + "causal_surprisal_packet_median": 0.04107942176870748, + "causal_surprisal_packet_trimmed10_mean": 0.02527840136054422, + "causal_surprisal_total": 0.3244426870748299, + "consistency_total": 0.9634161564625849, + "curvature_flow": 0.7493374149659863, + "curvature_packet": 0.276710119047619, + "curvature_total": 0.5376294217687074, + "direction_drift_flow": 0.3351919217687075, + "direction_drift_packet_max": 0.12750884353741498, + "direction_drift_packet_mean": 0.24312176870748298, + "direction_drift_packet_median": 0.2630892857142857, + "direction_drift_packet_trimmed10_mean": 0.2678246598639456, + "direction_drift_total": 0.11688707482993198, + "flow_consistency": 0.9700403061224491, + "kappa2_speed2norm_packet_mean": 0.22481377551020407, + "kappa2_speed2norm_packet_median": 0.24968886054421768, + "kappa2_speed2norm_packet_trimmed10_mean": 0.24425833333333336, + "kinetic_energy": 0.9345483843537415, + "kinetic_flow": 0.873621768707483, + "kinetic_packet": 0.4919491496598639, + "packet_consistency": 0.2926875, + "pna_flow": 0.32803078231292515, + "pna_packet_max": 0.13334149659863948, + "pna_packet_mean": 0.22481377551020407, + "pna_packet_median": 0.24968886054421768, + "pna_packet_trimmed10_mean": 0.24425833333333336, + "terminal_flow": 0.6052659863945578, + "terminal_norm": 0.7010341836734695, + "terminal_packet": 0.5042353741496598, + "velocity_flow": 0.8732102040816326, + "velocity_packet": 0.5096970238095238, + "velocity_total": 0.9829554421768707 + }, + "Portmap": { + "_n": 588.0, + "arc_length": 0.9462738095238096, + "causal_surprisal_flow": 0.2801561224489796, + "causal_surprisal_packet_max": 0.004789965986394552, + "causal_surprisal_packet_mean": 0.011751020408163266, + "causal_surprisal_packet_median": 0.04208775510204081, + "causal_surprisal_packet_trimmed10_mean": 0.026945578231292514, + "causal_surprisal_total": 0.3201562925170068, + "consistency_total": 0.9629284013605443, + "curvature_flow": 0.7331969387755102, + "curvature_packet": 0.2815375, + "curvature_total": 0.5145094387755101, + "direction_drift_flow": 0.3599266156462585, + "direction_drift_packet_max": 0.12483928571428574, + "direction_drift_packet_mean": 0.23246156462585035, + "direction_drift_packet_median": 0.252234693877551, + "direction_drift_packet_trimmed10_mean": 0.2572872448979592, + "direction_drift_total": 0.11327746598639457, + "flow_consistency": 0.9693843537414967, + "kappa2_speed2norm_packet_mean": 0.2257777210884354, + "kappa2_speed2norm_packet_median": 0.2472589285714286, + "kappa2_speed2norm_packet_trimmed10_mean": 0.24428809523809525, + "kinetic_energy": 0.9452397108843538, + "kinetic_flow": 0.8759971088435374, + "kinetic_packet": 0.5161674319727891, + "packet_consistency": 0.298859693877551, + "pna_flow": 0.30109268707482995, + "pna_packet_max": 0.1344017857142857, + "pna_packet_mean": 0.2257777210884354, + "pna_packet_median": 0.2472589285714286, + "pna_packet_trimmed10_mean": 0.24428809523809525, + "terminal_flow": 0.6283062925170068, + "terminal_norm": 0.7221038265306122, + "terminal_packet": 0.5224841836734694, + "velocity_flow": 0.8712644557823129, + "velocity_packet": 0.5232545918367346, + "velocity_total": 0.9816447278911565 + }, + "Syn": { + "_n": 588.0, + "arc_length": 0.9097061224489795, + "causal_surprisal_flow": 0.20811581632653062, + "causal_surprisal_packet_max": 0.4851386904761905, + "causal_surprisal_packet_mean": 0.5999027210884353, + "causal_surprisal_packet_median": 0.615696768707483, + "causal_surprisal_packet_trimmed10_mean": 0.6090040816326531, + "causal_surprisal_total": 0.24250782312925168, + "consistency_total": 0.7943452380952382, + "curvature_flow": 0.37857704081632654, + "curvature_packet": 0.9469074829931973, + "curvature_total": 0.8696506802721088, + "direction_drift_flow": 0.4774932823129252, + "direction_drift_packet_max": 0.1990723639455782, + "direction_drift_packet_mean": 0.1532000850340136, + "direction_drift_packet_median": 0.15523018707482994, + "direction_drift_packet_trimmed10_mean": 0.17178358843537417, + "direction_drift_total": 0.11105680272108844, + "flow_consistency": 0.7797544217687075, + "kappa2_speed2norm_packet_mean": 0.6277117346938776, + "kappa2_speed2norm_packet_median": 0.6130555272108844, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6316034013605443, + "kinetic_energy": 0.911061649659864, + "kinetic_flow": 0.5670306122448979, + "kinetic_packet": 0.9894600340136055, + "packet_consistency": 0.8899124149659864, + "pna_flow": 0.2326610544217687, + "pna_packet_max": 0.6479569727891157, + "pna_packet_mean": 0.6277117346938776, + "pna_packet_median": 0.6130555272108844, + "pna_packet_trimmed10_mean": 0.6316034013605443, + "terminal_flow": 0.8943331632653062, + "terminal_norm": 0.9527523809523809, + "terminal_packet": 0.9797901360544218, + "velocity_flow": 0.5640373299319728, + "velocity_packet": 0.8677916666666667, + "velocity_total": 0.8349321428571428 + }, + "TFTP": { + "_n": 588.0, + "arc_length": 0.8279000000000001, + "causal_surprisal_flow": 0.3082600340136055, + "causal_surprisal_packet_max": 0.013866666666666664, + "causal_surprisal_packet_mean": 0.03026581632653061, + "causal_surprisal_packet_median": 0.08499030612244897, + "causal_surprisal_packet_trimmed10_mean": 0.05528826530612244, + "causal_surprisal_total": 0.3199511904761905, + "consistency_total": 0.6907192176870748, + "curvature_flow": 0.23318027210884357, + "curvature_packet": 0.5515880952380952, + "curvature_total": 0.3812998299319728, + "direction_drift_flow": 0.2665699829931973, + "direction_drift_packet_max": 0.09238350340136055, + "direction_drift_packet_mean": 0.08596632653061224, + "direction_drift_packet_median": 0.10276666666666666, + "direction_drift_packet_trimmed10_mean": 0.10077772108843537, + "direction_drift_total": 0.09466921768707483, + "flow_consistency": 0.7016979591836735, + "kappa2_speed2norm_packet_mean": 0.23273078231292516, + "kappa2_speed2norm_packet_median": 0.2510998299319728, + "kappa2_speed2norm_packet_trimmed10_mean": 0.23835127551020407, + "kinetic_energy": 0.8265799319727891, + "kinetic_flow": 0.740916156462585, + "kinetic_packet": 0.747708843537415, + "packet_consistency": 0.547221768707483, + "pna_flow": 0.15577891156462587, + "pna_packet_max": 0.20147329931972788, + "pna_packet_mean": 0.23273078231292516, + "pna_packet_median": 0.2510998299319728, + "pna_packet_trimmed10_mean": 0.23835127551020407, + "terminal_flow": 0.749829761904762, + "terminal_norm": 0.7792105442176871, + "terminal_packet": 0.5990442176870749, + "velocity_flow": 0.7076982993197279, + "velocity_packet": 0.7862971088435375, + "velocity_total": 0.8319804421768708 + }, + "UDP": { + "_n": 588.0, + "arc_length": 0.7511079081632652, + "causal_surprisal_flow": 0.35786930272108836, + "causal_surprisal_packet_max": 0.01144625850340136, + "causal_surprisal_packet_mean": 0.027728401360544216, + "causal_surprisal_packet_median": 0.08326394557823127, + "causal_surprisal_packet_trimmed10_mean": 0.05319999999999999, + "causal_surprisal_total": 0.36917738095238095, + "consistency_total": 0.6037581632653062, + "curvature_flow": 0.48030102040816325, + "curvature_packet": 0.39475841836734693, + "curvature_total": 0.39196615646258504, + "direction_drift_flow": 0.29124285714285714, + "direction_drift_packet_max": 0.11410119047619048, + "direction_drift_packet_mean": 0.09159940476190476, + "direction_drift_packet_median": 0.1116422619047619, + "direction_drift_packet_trimmed10_mean": 0.10334625850340137, + "direction_drift_total": 0.0822343537414966, + "flow_consistency": 0.6132333333333333, + "kappa2_speed2norm_packet_mean": 0.17467653061224492, + "kappa2_speed2norm_packet_median": 0.18542925170068025, + "kappa2_speed2norm_packet_trimmed10_mean": 0.17370357142857146, + "kinetic_energy": 0.7491239795918366, + "kinetic_flow": 0.6831392857142858, + "kinetic_packet": 0.587320238095238, + "packet_consistency": 0.32430068027210884, + "pna_flow": 0.380544387755102, + "pna_packet_max": 0.2013442176870748, + "pna_packet_mean": 0.17467653061224492, + "pna_packet_median": 0.18542925170068025, + "pna_packet_trimmed10_mean": 0.17370357142857146, + "terminal_flow": 0.36407619047619044, + "terminal_norm": 0.4128444727891156, + "terminal_packet": 0.39164804421768706, + "velocity_flow": 0.713608843537415, + "velocity_packet": 0.7364738945578232, + "velocity_total": 0.8136704081632653 + }, + "UDPLag": { + "_n": 588.0, + "arc_length": 0.8991097789115645, + "causal_surprisal_flow": 0.24382414965986393, + "causal_surprisal_packet_max": 0.4427353741496599, + "causal_surprisal_packet_mean": 0.5385321428571428, + "causal_surprisal_packet_median": 0.5580598639455782, + "causal_surprisal_packet_trimmed10_mean": 0.5493248299319727, + "causal_surprisal_total": 0.28549931972789117, + "consistency_total": 0.7721329931972787, + "curvature_flow": 0.39702670068027207, + "curvature_packet": 0.8709215136054421, + "curvature_total": 0.7842666666666666, + "direction_drift_flow": 0.44595688775510206, + "direction_drift_packet_max": 0.11440221088435373, + "direction_drift_packet_mean": 0.09683520408163265, + "direction_drift_packet_median": 0.11234319727891157, + "direction_drift_packet_trimmed10_mean": 0.11270085034013605, + "direction_drift_total": 0.07032431972789116, + "flow_consistency": 0.7607945578231292, + "kappa2_speed2norm_packet_mean": 0.46738537414965986, + "kappa2_speed2norm_packet_median": 0.46918078231292515, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4787453231292518, + "kinetic_energy": 0.8995617346938775, + "kinetic_flow": 0.5745534013605442, + "kinetic_packet": 0.9470756802721089, + "packet_consistency": 0.8123690476190477, + "pna_flow": 0.24822423469387755, + "pna_packet_max": 0.4813346088435374, + "pna_packet_mean": 0.46738537414965986, + "pna_packet_median": 0.46918078231292515, + "pna_packet_trimmed10_mean": 0.4787453231292518, + "terminal_flow": 0.843440306122449, + "terminal_norm": 0.8996661564625851, + "terminal_packet": 0.9187231292517006, + "velocity_flow": 0.5787914965986394, + "velocity_packet": 0.8717146258503402, + "velocity_total": 0.8423063775510204 + }, + "WebDDoS": { + "_n": 438.0, + "arc_length": 0.7431381278538813, + "causal_surprisal_flow": 0.32102705479452054, + "causal_surprisal_packet_max": 0.38143356164383563, + "causal_surprisal_packet_mean": 0.3201744292237443, + "causal_surprisal_packet_median": 0.303712100456621, + "causal_surprisal_packet_trimmed10_mean": 0.3056609589041096, + "causal_surprisal_total": 0.29060228310502284, + "consistency_total": 0.5599280821917808, + "curvature_flow": 0.6416187214611871, + "curvature_packet": 0.5361644977168949, + "curvature_total": 0.800136301369863, + "direction_drift_flow": 0.2937618721461187, + "direction_drift_packet_max": 0.44143755707762555, + "direction_drift_packet_mean": 0.365288698630137, + "direction_drift_packet_median": 0.3713842465753424, + "direction_drift_packet_trimmed10_mean": 0.36761472602739725, + "direction_drift_total": 0.2702123287671233, + "flow_consistency": 0.5779947488584475, + "kappa2_speed2norm_packet_mean": 0.5321293378995433, + "kappa2_speed2norm_packet_median": 0.5225772831050228, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5058937214611872, + "kinetic_energy": 0.7431787671232877, + "kinetic_flow": 0.7306271689497715, + "kinetic_packet": 0.4786940639269407, + "packet_consistency": 0.44997191780821916, + "pna_flow": 0.43659965753424657, + "pna_packet_max": 0.42772979452054793, + "pna_packet_mean": 0.5321293378995433, + "pna_packet_median": 0.5225772831050228, + "pna_packet_trimmed10_mean": 0.5058937214611872, + "terminal_flow": 0.3602344748858447, + "terminal_norm": 0.503872602739726, + "terminal_packet": 0.4801242009132419, + "velocity_flow": 0.736066894977169, + "velocity_packet": 0.49810068493150683, + "velocity_total": 0.8000729452054794 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicddos2019.log b/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicddos2019.log new file mode 100644 index 0000000..29fb985 --- /dev/null +++ b/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicddos2019.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 8,993,376 target rows; label distribution top: + Syn 1,495,248 + NetBIOS 702,760 + UDP 611,999 + MSSQL 523,845 + LDAP 509,665 +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 20.2s +[eval] scoring attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done in 19.2s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicddos2019.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicddos2019.npz + +=== overall AUROC top-10 === + velocity_total AUROC=0.9042 AUPRC=0.9129 + arc_length AUROC=0.8882 AUPRC=0.8985 + kinetic_energy AUROC=0.8877 AUPRC=0.8982 + kinetic_flow AUROC=0.8014 AUPRC=0.6945 + flow_consistency AUROC=0.7998 AUPRC=0.7594 + consistency_total AUROC=0.7986 AUPRC=0.7498 + velocity_packet AUROC=0.7810 AUPRC=0.7619 + velocity_flow AUROC=0.7617 AUPRC=0.6501 + terminal_norm AUROC=0.7463 AUPRC=0.6970 + kinetic_packet AUROC=0.7301 AUPRC=0.6939 diff --git a/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicddos2019.npz new file mode 100644 index 0000000..16e0626 Binary files /dev/null and b/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicids2017.json b/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicids2017.json new file mode 100644 index 0000000..f0cca7a --- /dev/null +++ b/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicids2017.json @@ -0,0 +1,740 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.6529387551683402, + "auprc": 0.5837816296780536 + }, + "causal_surprisal_flow": { + "auroc": 0.6162600265800354, + "auprc": 0.5006504102796281 + }, + "causal_surprisal_packet_max": { + "auroc": 0.6979259376845837, + "auprc": 0.5799568116530551 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.6281688053750738, + "auprc": 0.5188956090890018 + }, + "causal_surprisal_packet_median": { + "auroc": 0.5824218103957473, + "auprc": 0.49655442096490565 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.5954604843473125, + "auprc": 0.5017005406393282 + }, + "causal_surprisal_total": { + "auroc": 0.6020080404607207, + "auprc": 0.4757814436941894 + }, + "consistency_total": { + "auroc": 0.6363224453632605, + "auprc": 0.43147244308809873 + }, + "curvature_flow": { + "auroc": 0.3752246455995275, + "auprc": 0.36799288289472143 + }, + "curvature_packet": { + "auroc": 0.8351762108682812, + "auprc": 0.7664100431318434 + }, + "curvature_total": { + "auroc": 0.8122894196692262, + "auprc": 0.7264784585902881 + }, + "direction_drift_flow": { + "auroc": 0.27686791199054933, + "auprc": 0.2851269094847485 + }, + "direction_drift_packet_max": { + "auroc": 0.5497849527466037, + "auprc": 0.42696046816328703 + }, + "direction_drift_packet_mean": { + "auroc": 0.33155577377436507, + "auprc": 0.3006386783480421 + }, + "direction_drift_packet_median": { + "auroc": 0.33782928972238624, + "auprc": 0.30323351878662724 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.3191991878322505, + "auprc": 0.29672663173963243 + }, + "direction_drift_total": { + "auroc": 0.36853381571175425, + "auprc": 0.32777737686532615 + }, + "flow_consistency": { + "auroc": 0.636775251033668, + "auprc": 0.4320432184329891 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.6040082398109864, + "auprc": 0.49948751402737396 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.5889501476668635, + "auprc": 0.49476936705869157 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.5641755316007089, + "auprc": 0.4804527876088339 + }, + "kinetic_energy": { + "auroc": 0.6512546367395157, + "auprc": 0.5831782710699143 + }, + "kinetic_flow": { + "auroc": 0.6397925502067336, + "auprc": 0.47718233697577 + }, + "kinetic_packet": { + "auroc": 0.7668451491435322, + "auprc": 0.7081437257563981 + }, + "packet_consistency": { + "auroc": 0.7736654681039574, + "auprc": 0.6167530706134019 + }, + "pna_flow": { + "auroc": 0.19989338452451272, + "auprc": 0.2655812848572722 + }, + "pna_packet_max": { + "auroc": 0.7083074276432368, + "auprc": 0.5879902803377693 + }, + "pna_packet_mean": { + "auroc": 0.6040082398109864, + "auprc": 0.49948751402737396 + }, + "pna_packet_median": { + "auroc": 0.5889501476668635, + "auprc": 0.49476936705869157 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.5641755316007089, + "auprc": 0.4804527876088339 + }, + "terminal_flow": { + "auroc": 0.9107572135262847, + "auprc": 0.8190026519595687 + }, + "terminal_norm": { + "auroc": 0.792186798582398, + "auprc": 0.7396289612932421 + }, + "terminal_packet": { + "auroc": 0.8189956512108683, + "auprc": 0.756662051954847 + }, + "velocity_flow": { + "auroc": 0.6385084465445954, + "auprc": 0.47103284103638154 + }, + "velocity_packet": { + "auroc": 0.7879546662728882, + "auprc": 0.6185605216809199 + }, + "velocity_total": { + "auroc": 0.670522172179563, + "auprc": 0.5810260547262115 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "arc_length": 0.7035637387387388, + "causal_surprisal_flow": 0.6588533033033033, + "causal_surprisal_packet_max": 0.9654684684684685, + "causal_surprisal_packet_mean": 0.9416340840840839, + "causal_surprisal_packet_median": 0.9399361861861864, + "causal_surprisal_packet_trimmed10_mean": 0.939760960960961, + "causal_surprisal_total": 0.8769445945945946, + "consistency_total": 0.7066599099099099, + "curvature_flow": 0.06942297297297298, + "curvature_packet": 0.6113054054054055, + "curvature_total": 0.5020464714714715, + "direction_drift_flow": 0.5324126876876877, + "direction_drift_packet_max": 0.3237626126126126, + "direction_drift_packet_mean": 0.12048633633633632, + "direction_drift_packet_median": 0.14709894894894895, + "direction_drift_packet_trimmed10_mean": 0.10350180180180181, + "direction_drift_total": 0.14287372372372373, + "flow_consistency": 0.6926786786786787, + "kappa2_speed2norm_packet_mean": 0.16011111111111112, + "kappa2_speed2norm_packet_median": 0.20952169669669668, + "kappa2_speed2norm_packet_trimmed10_mean": 0.10874504504504504, + "kinetic_energy": 0.7077521771771771, + "kinetic_flow": 0.43708911411411416, + "kinetic_packet": 0.9419459459459459, + "packet_consistency": 0.9017960960960961, + "pna_flow": 0.06631621621621621, + "pna_packet_max": 0.41905420420420425, + "pna_packet_mean": 0.16011111111111112, + "pna_packet_median": 0.20952169669669668, + "pna_packet_trimmed10_mean": 0.10874504504504504, + "terminal_flow": 0.897226876876877, + "terminal_norm": 0.9407773273273274, + "terminal_packet": 0.9638752252252252, + "velocity_flow": 0.41628918918918917, + "velocity_packet": 0.9183765765765765, + "velocity_total": 0.5959111111111112 + }, + "DDoS": { + "_n": 666.0, + "arc_length": 0.6900047297297296, + "causal_surprisal_flow": 0.741607057057057, + "causal_surprisal_packet_max": 0.6829237237237239, + "causal_surprisal_packet_mean": 0.5668618618618618, + "causal_surprisal_packet_median": 0.5184867867867868, + "causal_surprisal_packet_trimmed10_mean": 0.5029989489489489, + "causal_surprisal_total": 0.8473316816816816, + "consistency_total": 0.6613758258258259, + "curvature_flow": 0.16210518018018016, + "curvature_packet": 0.8897666666666667, + "curvature_total": 0.8568295045045045, + "direction_drift_flow": 0.2348458708708709, + "direction_drift_packet_max": 0.5305957957957957, + "direction_drift_packet_mean": 0.19851201201201202, + "direction_drift_packet_median": 0.17370435435435436, + "direction_drift_packet_trimmed10_mean": 0.16603633633633635, + "direction_drift_total": 0.2586186186186186, + "flow_consistency": 0.6541547297297298, + "kappa2_speed2norm_packet_mean": 0.5195332582582584, + "kappa2_speed2norm_packet_median": 0.5494168168168168, + "kappa2_speed2norm_packet_trimmed10_mean": 0.45500893393393393, + "kinetic_energy": 0.6927527777777778, + "kinetic_flow": 0.6934662162162162, + "kinetic_packet": 0.8875271021021022, + "packet_consistency": 0.9011360360360361, + "pna_flow": 0.06942192192192193, + "pna_packet_max": 0.6403088588588588, + "pna_packet_mean": 0.5195332582582584, + "pna_packet_median": 0.5494168168168168, + "pna_packet_trimmed10_mean": 0.45500893393393393, + "terminal_flow": 0.9837834834834834, + "terminal_norm": 0.9685357357357358, + "terminal_packet": 0.9545807807807807, + "velocity_flow": 0.5745024024024025, + "velocity_packet": 0.8604450450450449, + "velocity_total": 0.6444400900900902 + }, + "DoS GoldenEye": { + "_n": 666.0, + "arc_length": 0.5874217717717718, + "causal_surprisal_flow": 0.7483118618618619, + "causal_surprisal_packet_max": 0.6520484234234234, + "causal_surprisal_packet_mean": 0.4965745495495495, + "causal_surprisal_packet_median": 0.3650953453453453, + "causal_surprisal_packet_trimmed10_mean": 0.40259474474474477, + "causal_surprisal_total": 0.7678865615615615, + "consistency_total": 0.6304348348348349, + "curvature_flow": 0.10496381381381381, + "curvature_packet": 0.8766921921921922, + "curvature_total": 0.8442343093093093, + "direction_drift_flow": 0.2271933933933934, + "direction_drift_packet_max": 0.5322948198198199, + "direction_drift_packet_mean": 0.2771788288288288, + "direction_drift_packet_median": 0.2906813813813814, + "direction_drift_packet_trimmed10_mean": 0.2644714714714715, + "direction_drift_total": 0.3836563063063063, + "flow_consistency": 0.6337825075075074, + "kappa2_speed2norm_packet_mean": 0.5111364114114114, + "kappa2_speed2norm_packet_median": 0.5124425675675676, + "kappa2_speed2norm_packet_trimmed10_mean": 0.47797627627627626, + "kinetic_energy": 0.5869538288288287, + "kinetic_flow": 0.6177286786786786, + "kinetic_packet": 0.7905432432432432, + "packet_consistency": 0.8010767267267268, + "pna_flow": 0.060892642642642644, + "pna_packet_max": 0.5665275525525526, + "pna_packet_mean": 0.5111364114114114, + "pna_packet_median": 0.5124425675675676, + "pna_packet_trimmed10_mean": 0.47797627627627626, + "terminal_flow": 0.9818713213213214, + "terminal_norm": 0.9066126126126126, + "terminal_packet": 0.8657608858858858, + "velocity_flow": 0.5597445195195194, + "velocity_packet": 0.7870825825825825, + "velocity_total": 0.5586653903903904 + }, + "DoS Hulk": { + "_n": 666.0, + "arc_length": 0.6178615615615615, + "causal_surprisal_flow": 0.7408975975975975, + "causal_surprisal_packet_max": 0.6564124624624624, + "causal_surprisal_packet_mean": 0.5175148648648649, + "causal_surprisal_packet_median": 0.3571475975975976, + "causal_surprisal_packet_trimmed10_mean": 0.37814669669669676, + "causal_surprisal_total": 0.8006659159159158, + "consistency_total": 0.5982043543543544, + "curvature_flow": 0.22850840840840841, + "curvature_packet": 0.9315192192192193, + "curvature_total": 0.9174114114114114, + "direction_drift_flow": 0.21924767267267264, + "direction_drift_packet_max": 0.6183874624624623, + "direction_drift_packet_mean": 0.18450262762762765, + "direction_drift_packet_median": 0.20084669669669672, + "direction_drift_packet_trimmed10_mean": 0.14839249249249248, + "direction_drift_total": 0.2446105105105105, + "flow_consistency": 0.5673073573573573, + "kappa2_speed2norm_packet_mean": 0.6463489489489489, + "kappa2_speed2norm_packet_median": 0.6135389639639639, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5503655405405405, + "kinetic_energy": 0.6156463963963963, + "kinetic_flow": 0.5870746246246246, + "kinetic_packet": 0.8250714714714713, + "packet_consistency": 0.9539457957957959, + "pna_flow": 0.13439331831831833, + "pna_packet_max": 0.7668107357357358, + "pna_packet_mean": 0.6463489489489489, + "pna_packet_median": 0.6135389639639639, + "pna_packet_trimmed10_mean": 0.5503655405405405, + "terminal_flow": 0.9184657657657658, + "terminal_norm": 0.8241786786786787, + "terminal_packet": 0.8502085585585585, + "velocity_flow": 0.5613659159159159, + "velocity_packet": 0.9117358108108108, + "velocity_total": 0.6670453453453454 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "arc_length": 0.6706051051051051, + "causal_surprisal_flow": 0.7571267267267267, + "causal_surprisal_packet_max": 0.7675354354354355, + "causal_surprisal_packet_mean": 0.7202846846846847, + "causal_surprisal_packet_median": 0.6070702702702703, + "causal_surprisal_packet_trimmed10_mean": 0.6690120120120121, + "causal_surprisal_total": 0.8559731231231231, + "consistency_total": 0.6235990990990992, + "curvature_flow": 0.5187190690690691, + "curvature_packet": 0.9755045045045045, + "curvature_total": 0.9708405405405405, + "direction_drift_flow": 0.19613716216216215, + "direction_drift_packet_max": 0.6789686936936937, + "direction_drift_packet_mean": 0.3626165165165165, + "direction_drift_packet_median": 0.3117043543543544, + "direction_drift_packet_trimmed10_mean": 0.3069240240240241, + "direction_drift_total": 0.4676157657657658, + "flow_consistency": 0.6314534534534535, + "kappa2_speed2norm_packet_mean": 0.6274789039039039, + "kappa2_speed2norm_packet_median": 0.5144740240240241, + "kappa2_speed2norm_packet_trimmed10_mean": 0.537077927927928, + "kinetic_energy": 0.6667584084084085, + "kinetic_flow": 0.7137063063063063, + "kinetic_packet": 0.8453783783783784, + "packet_consistency": 0.6846633633633633, + "pna_flow": 0.2299487987987988, + "pna_packet_max": 0.7531036786786787, + "pna_packet_mean": 0.6274789039039039, + "pna_packet_median": 0.5144740240240241, + "pna_packet_trimmed10_mean": 0.537077927927928, + "terminal_flow": 0.8743855855855857, + "terminal_norm": 0.8739938438438439, + "terminal_packet": 0.89816996996997, + "velocity_flow": 0.7152301051051051, + "velocity_packet": 0.8262241741741742, + "velocity_total": 0.6850288288288289 + }, + "DoS Slowloris": { + "_n": 666.0, + "arc_length": 0.6633368618618618, + "causal_surprisal_flow": 0.6437234234234234, + "causal_surprisal_packet_max": 0.6765953453453453, + "causal_surprisal_packet_mean": 0.58485, + "causal_surprisal_packet_median": 0.5854935435435435, + "causal_surprisal_packet_trimmed10_mean": 0.5831554054054053, + "causal_surprisal_total": 0.6156557057057057, + "consistency_total": 0.5720135135135136, + "curvature_flow": 0.31948153153153147, + "curvature_packet": 0.8565583333333333, + "curvature_total": 0.8474909159159159, + "direction_drift_flow": 0.17959879879879878, + "direction_drift_packet_max": 0.46929579579579583, + "direction_drift_packet_mean": 0.21189504504504503, + "direction_drift_packet_median": 0.25504924924924927, + "direction_drift_packet_trimmed10_mean": 0.19806336336336336, + "direction_drift_total": 0.21021493993993995, + "flow_consistency": 0.5953906906906906, + "kappa2_speed2norm_packet_mean": 0.6370593843843844, + "kappa2_speed2norm_packet_median": 0.5979447447447447, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5952322072072073, + "kinetic_energy": 0.6584812312312313, + "kinetic_flow": 0.643515165165165, + "kinetic_packet": 0.7726876876876878, + "packet_consistency": 0.6032809309309309, + "pna_flow": 0.1697054054054054, + "pna_packet_max": 0.6635188438438437, + "pna_packet_mean": 0.6370593843843844, + "pna_packet_median": 0.5979447447447447, + "pna_packet_trimmed10_mean": 0.5952322072072073, + "terminal_flow": 0.8515893393393393, + "terminal_norm": 0.8223617117117118, + "terminal_packet": 0.8283378378378377, + "velocity_flow": 0.7508695945945947, + "velocity_packet": 0.8470075075075076, + "velocity_total": 0.7618448948948948 + }, + "FTP-Patator": { + "_n": 666.0, + "arc_length": 0.3299937687687688, + "causal_surprisal_flow": 0.747396096096096, + "causal_surprisal_packet_max": 0.9617020270270271, + "causal_surprisal_packet_mean": 0.9326740240240241, + "causal_surprisal_packet_median": 0.9370460960960961, + "causal_surprisal_packet_trimmed10_mean": 0.9355024024024023, + "causal_surprisal_total": 0.5584552552552553, + "consistency_total": 0.6114594594594596, + "curvature_flow": 0.34338843843843847, + "curvature_packet": 0.681658933933934, + "curvature_total": 0.6799542042042042, + "direction_drift_flow": 0.5463133633633633, + "direction_drift_packet_max": 0.794671096096096, + "direction_drift_packet_mean": 0.6704193693693694, + "direction_drift_packet_median": 0.6689793543543544, + "direction_drift_packet_trimmed10_mean": 0.6411902402402403, + "direction_drift_total": 0.894562912912913, + "flow_consistency": 0.6299549549549549, + "kappa2_speed2norm_packet_mean": 0.5909204954954955, + "kappa2_speed2norm_packet_median": 0.5370409159159159, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5431515765765765, + "kinetic_energy": 0.3254587837837838, + "kinetic_flow": 0.6620372372372373, + "kinetic_packet": 0.43501591591591593, + "packet_consistency": 0.5156933933933935, + "pna_flow": 0.1757749249249249, + "pna_packet_max": 0.8110813063063063, + "pna_packet_mean": 0.5909204954954955, + "pna_packet_median": 0.5370409159159159, + "pna_packet_trimmed10_mean": 0.5431515765765765, + "terminal_flow": 0.9639445945945945, + "terminal_norm": 0.49267372372372376, + "terminal_packet": 0.6134476726726726, + "velocity_flow": 0.5280726726726728, + "velocity_packet": 0.6578304804804805, + "velocity_total": 0.3671028528528528 + }, + "Heartbleed": { + "_n": 1.0, + "arc_length": 0.9289000000000001, + "causal_surprisal_flow": 0.3006, + "causal_surprisal_packet_max": 0.23429999999999995, + "causal_surprisal_packet_mean": 0.0032999999999999696, + "causal_surprisal_packet_median": 0.017800000000000038, + "causal_surprisal_packet_trimmed10_mean": 0.009800000000000031, + "causal_surprisal_total": 0.0013999999999999568, + "consistency_total": 0.6556, + "curvature_flow": 0.9632000000000001, + "curvature_packet": 0.624, + "curvature_total": 0.6725, + "direction_drift_flow": 0.021100000000000008, + "direction_drift_packet_max": 0.28890000000000005, + "direction_drift_packet_mean": 0.01859999999999995, + "direction_drift_packet_median": 0.045599999999999974, + "direction_drift_packet_trimmed10_mean": 0.022499999999999964, + "direction_drift_total": 0.02939999999999998, + "flow_consistency": 0.6362, + "kappa2_speed2norm_packet_mean": 0.04400000000000004, + "kappa2_speed2norm_packet_median": 0.0393, + "kappa2_speed2norm_packet_trimmed10_mean": 0.0403, + "kinetic_energy": 0.9181999999999999, + "kinetic_flow": 0.999, + "kinetic_packet": 0.8143, + "packet_consistency": 0.9783, + "pna_flow": 0.010099999999999998, + "pna_packet_max": 0.5276000000000001, + "pna_packet_mean": 0.04400000000000004, + "pna_packet_median": 0.0393, + "pna_packet_trimmed10_mean": 0.0403, + "terminal_flow": 0.9843000000000001, + "terminal_norm": 0.2871, + "terminal_packet": 0.32089999999999996, + "velocity_flow": 0.9934000000000001, + "velocity_packet": 0.9778, + "velocity_total": 0.9824 + }, + "Infiltration": { + "_n": 7.0, + "arc_length": 0.7896, + "causal_surprisal_flow": 0.42197142857142855, + "causal_surprisal_packet_max": 0.43938571428571427, + "causal_surprisal_packet_mean": 0.28254285714285715, + "causal_surprisal_packet_median": 0.2904285714285714, + "causal_surprisal_packet_trimmed10_mean": 0.27562857142857144, + "causal_surprisal_total": 0.23977142857142852, + "consistency_total": 0.6690857142857143, + "curvature_flow": 0.8630857142857145, + "curvature_packet": 0.8000142857142857, + "curvature_total": 0.8327428571428571, + "direction_drift_flow": 0.06615714285714283, + "direction_drift_packet_max": 0.7602714285714286, + "direction_drift_packet_mean": 0.31852857142857144, + "direction_drift_packet_median": 0.3588571428571428, + "direction_drift_packet_trimmed10_mean": 0.3146, + "direction_drift_total": 0.5185428571428572, + "flow_consistency": 0.6620857142857143, + "kappa2_speed2norm_packet_mean": 0.48728571428571427, + "kappa2_speed2norm_packet_median": 0.45189999999999997, + "kappa2_speed2norm_packet_trimmed10_mean": 0.47015714285714283, + "kinetic_energy": 0.7879142857142857, + "kinetic_flow": 0.9046857142857143, + "kinetic_packet": 0.7842857142857143, + "packet_consistency": 0.7766142857142857, + "pna_flow": 0.11504285714285714, + "pna_packet_max": 0.7177428571428571, + "pna_packet_mean": 0.48728571428571427, + "pna_packet_median": 0.45189999999999997, + "pna_packet_trimmed10_mean": 0.47015714285714283, + "terminal_flow": 0.9441285714285714, + "terminal_norm": 0.6191285714285715, + "terminal_packet": 0.7951571428571428, + "velocity_flow": 0.9063714285714285, + "velocity_packet": 0.7744285714285715, + "velocity_total": 0.7908571428571429 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "arc_length": 0.9930983483483483, + "causal_surprisal_flow": 0.086184984984985, + "causal_surprisal_packet_max": 0.5081432432432432, + "causal_surprisal_packet_mean": 0.6220448948948949, + "causal_surprisal_packet_median": 0.6661291291291291, + "causal_surprisal_packet_trimmed10_mean": 0.6667800300300301, + "causal_surprisal_total": 0.10461561561561561, + "consistency_total": 0.6839596096096097, + "curvature_flow": 0.3095144144144144, + "curvature_packet": 0.9741533033033033, + "curvature_total": 0.930793993993994, + "direction_drift_flow": 0.2897119369369369, + "direction_drift_packet_max": 0.34336846846846847, + "direction_drift_packet_mean": 0.4247906156156157, + "direction_drift_packet_median": 0.4181759009009009, + "direction_drift_packet_trimmed10_mean": 0.452421021021021, + "direction_drift_total": 0.2000725975975976, + "flow_consistency": 0.682223048048048, + "kappa2_speed2norm_packet_mean": 0.9326010510510512, + "kappa2_speed2norm_packet_median": 0.9353801801801801, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9391915915915916, + "kinetic_energy": 0.9933136636636637, + "kinetic_flow": 0.5279843843843844, + "kinetic_packet": 0.9934360360360361, + "packet_consistency": 0.838249924924925, + "pna_flow": 0.18452837837837835, + "pna_packet_max": 0.853798123123123, + "pna_packet_mean": 0.9326010510510512, + "pna_packet_median": 0.9353801801801801, + "pna_packet_trimmed10_mean": 0.9391915915915916, + "terminal_flow": 0.9635543543543543, + "terminal_norm": 0.9920007507507507, + "terminal_packet": 0.9904913663663664, + "velocity_flow": 0.6712416666666666, + "velocity_packet": 0.7017860360360361, + "velocity_total": 0.9832042042042041 + }, + "Portscan": { + "_n": 666.0, + "arc_length": 0.9950880630630631, + "causal_surprisal_flow": 0.10514744744744745, + "causal_surprisal_packet_max": 0.42974857357357354, + "causal_surprisal_packet_mean": 0.5138250750750751, + "causal_surprisal_packet_median": 0.570950900900901, + "causal_surprisal_packet_trimmed10_mean": 0.5588423423423423, + "causal_surprisal_total": 0.12995555555555555, + "consistency_total": 0.686801051051051, + "curvature_flow": 0.656046021021021, + "curvature_packet": 0.9274684684684684, + "curvature_total": 0.8765789789789789, + "direction_drift_flow": 0.2731074324324324, + "direction_drift_packet_max": 0.41232192192192185, + "direction_drift_packet_mean": 0.4285111861861862, + "direction_drift_packet_median": 0.45469144144144147, + "direction_drift_packet_trimmed10_mean": 0.45563753753753755, + "direction_drift_total": 0.15924984984984986, + "flow_consistency": 0.6790888888888887, + "kappa2_speed2norm_packet_mean": 0.8572022522522523, + "kappa2_speed2norm_packet_median": 0.8625138138138139, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8722527027027026, + "kinetic_energy": 0.9950945945945946, + "kinetic_flow": 0.5171264264264264, + "kinetic_packet": 0.9919956456456456, + "packet_consistency": 0.8930393393393393, + "pna_flow": 0.4447180930930931, + "pna_packet_max": 0.7993273273273273, + "pna_packet_mean": 0.8572022522522523, + "pna_packet_median": 0.8625138138138139, + "pna_packet_trimmed10_mean": 0.8722527027027026, + "terminal_flow": 0.9398522522522522, + "terminal_norm": 0.9932019519519519, + "terminal_packet": 0.99451006006006, + "velocity_flow": 0.6085884384384385, + "velocity_packet": 0.6696621621621622, + "velocity_total": 0.9917217717717718 + }, + "SSH-Patator": { + "_n": 666.0, + "arc_length": 0.25802244744744746, + "causal_surprisal_flow": 0.9906198198198198, + "causal_surprisal_packet_max": 0.7463321321321321, + "causal_surprisal_packet_mean": 0.4727722222222222, + "causal_surprisal_packet_median": 0.35568798798798795, + "causal_surprisal_packet_trimmed10_mean": 0.3992632132132132, + "causal_surprisal_total": 0.5431647147147147, + "consistency_total": 0.5906542042042042, + "curvature_flow": 0.9644345345345345, + "curvature_packet": 0.6465893393393394, + "curvature_total": 0.7089643393393393, + "direction_drift_flow": 0.10487792792792791, + "direction_drift_packet_max": 0.8176142642642643, + "direction_drift_packet_mean": 0.4828688438438439, + "direction_drift_packet_median": 0.5027811561561562, + "direction_drift_packet_trimmed10_mean": 0.4999615615615615, + "direction_drift_total": 0.7718773273273274, + "flow_consistency": 0.6064045795795795, + "kappa2_speed2norm_packet_mean": 0.6274338588588589, + "kappa2_speed2norm_packet_median": 0.6263315315315315, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6278233483483483, + "kinetic_energy": 0.25133783783783786, + "kinetic_flow": 0.9487162162162163, + "kinetic_packet": 0.21763453453453457, + "packet_consistency": 0.6168825825825824, + "pna_flow": 0.4923990990990991, + "pna_packet_max": 0.8420429429429429, + "pna_packet_mean": 0.6274338588588589, + "pna_packet_median": 0.6263315315315315, + "pna_packet_trimmed10_mean": 0.6278233483483483, + "terminal_flow": 0.7302414414414415, + "terminal_norm": 0.192616966966967, + "terminal_packet": 0.3096681681681681, + "velocity_flow": 0.9498153153153154, + "velocity_packet": 0.6724483483483483, + "velocity_total": 0.4071463963963964 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "arc_length": 0.7596253424657534, + "causal_surprisal_flow": 0.20162191780821917, + "causal_surprisal_packet_max": 0.22652328767123284, + "causal_surprisal_packet_mean": 0.007989041095890412, + "causal_surprisal_packet_median": 0.026787671232876717, + "causal_surprisal_packet_trimmed10_mean": 0.018775342465753422, + "causal_surprisal_total": 0.007412328767123266, + "consistency_total": 0.6208616438356165, + "curvature_flow": 0.9251917808219179, + "curvature_packet": 0.6853123287671233, + "curvature_total": 0.7143821917808219, + "direction_drift_flow": 0.006108219178082177, + "direction_drift_packet_max": 0.4027465753424658, + "direction_drift_packet_mean": 0.01667671232876712, + "direction_drift_packet_median": 0.02140821917808219, + "direction_drift_packet_trimmed10_mean": 0.018130136986301365, + "direction_drift_total": 0.02674794520547946, + "flow_consistency": 0.6051630136986301, + "kappa2_speed2norm_packet_mean": 0.15674383561643834, + "kappa2_speed2norm_packet_median": 0.1681150684931507, + "kappa2_speed2norm_packet_trimmed10_mean": 0.16459383561643837, + "kinetic_energy": 0.7474424657534247, + "kinetic_flow": 0.9988684931506849, + "kinetic_packet": 0.4573931506849315, + "packet_consistency": 0.9602219178082192, + "pna_flow": 0.008295890410958918, + "pna_packet_max": 0.4838698630136986, + "pna_packet_mean": 0.15674383561643834, + "pna_packet_median": 0.1681150684931507, + "pna_packet_trimmed10_mean": 0.16459383561643837, + "terminal_flow": 0.9182321917808219, + "terminal_norm": 0.1637082191780822, + "terminal_packet": 0.22856301369863016, + "velocity_flow": 0.9972082191780821, + "velocity_packet": 0.9758068493150684, + "velocity_total": 0.9806397260273974 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "arc_length": 0.6365923076923077, + "causal_surprisal_flow": 0.7345461538461538, + "causal_surprisal_packet_max": 0.7766384615384615, + "causal_surprisal_packet_mean": 0.7373384615384615, + "causal_surprisal_packet_median": 0.652453846153846, + "causal_surprisal_packet_trimmed10_mean": 0.6924692307692307, + "causal_surprisal_total": 0.8878384615384616, + "consistency_total": 0.6594153846153846, + "curvature_flow": 0.12226153846153848, + "curvature_packet": 0.9186153846153846, + "curvature_total": 0.8740307692307692, + "direction_drift_flow": 0.5278461538461539, + "direction_drift_packet_max": 0.4817923076923077, + "direction_drift_packet_mean": 0.2063076923076923, + "direction_drift_packet_median": 0.2378, + "direction_drift_packet_trimmed10_mean": 0.1739615384615385, + "direction_drift_total": 0.2588615384615385, + "flow_consistency": 0.6533846153846155, + "kappa2_speed2norm_packet_mean": 0.4137153846153846, + "kappa2_speed2norm_packet_median": 0.2802769230769231, + "kappa2_speed2norm_packet_trimmed10_mean": 0.28116153846153846, + "kinetic_energy": 0.6356076923076923, + "kinetic_flow": 0.48964615384615384, + "kinetic_packet": 0.8687538461538462, + "packet_consistency": 0.8170384615384615, + "pna_flow": 0.11422307692307693, + "pna_packet_max": 0.7521, + "pna_packet_mean": 0.4137153846153846, + "pna_packet_median": 0.2802769230769231, + "pna_packet_trimmed10_mean": 0.28116153846153846, + "terminal_flow": 0.9420307692307692, + "terminal_norm": 0.9202153846153845, + "terminal_packet": 0.8813153846153846, + "velocity_flow": 0.48430769230769233, + "velocity_packet": 0.8178730769230769, + "velocity_total": 0.6051538461538463 + }, + "Web Attack - XSS": { + "_n": 18.0, + "arc_length": 0.9180666666666667, + "causal_surprisal_flow": 0.18659444444444442, + "causal_surprisal_packet_max": 0.1761111111111111, + "causal_surprisal_packet_mean": 0.0017388888888888701, + "causal_surprisal_packet_median": 0.013616666666666654, + "causal_surprisal_packet_trimmed10_mean": 0.0073722222222222305, + "causal_surprisal_total": 0.00019999999999997797, + "consistency_total": 0.59685, + "curvature_flow": 0.9046055555555556, + "curvature_packet": 0.6882944444444445, + "curvature_total": 0.7113111111111111, + "direction_drift_flow": 0.003455555555555533, + "direction_drift_packet_max": 0.2608888888888889, + "direction_drift_packet_mean": 0.011200000000000005, + "direction_drift_packet_median": 0.020855555555555544, + "direction_drift_packet_trimmed10_mean": 0.01287222222222221, + "direction_drift_total": 0.017844444444444447, + "flow_consistency": 0.5697777777777778, + "kappa2_speed2norm_packet_mean": 0.05134999999999999, + "kappa2_speed2norm_packet_median": 0.045594444444444444, + "kappa2_speed2norm_packet_trimmed10_mean": 0.04718333333333334, + "kinetic_energy": 0.9073611111111111, + "kinetic_flow": 0.9998111111111112, + "kinetic_packet": 0.7258, + "packet_consistency": 0.9681833333333334, + "pna_flow": 0.00323888888888889, + "pna_packet_max": 0.39079444444444444, + "pna_packet_mean": 0.05134999999999999, + "pna_packet_median": 0.045594444444444444, + "pna_packet_trimmed10_mean": 0.04718333333333334, + "terminal_flow": 0.9391055555555555, + "terminal_norm": 0.19575555555555557, + "terminal_packet": 0.27898333333333336, + "velocity_flow": 0.9977555555555556, + "velocity_packet": 0.996288888888889, + "velocity_total": 0.9910111111111112 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicids2017.log b/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicids2017.log new file mode 100644 index 0000000..5009457 --- /dev/null +++ b/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicids2017.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=20 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 2,025,564 target rows; label distribution top: + normal 1,521,748 + Portscan 159,040 + DoS Hulk 158,454 + DDoS 95,144 + Infiltration - Portscan 71,714 +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 20.2s +[eval] scoring attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done in 13.8s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicids2017.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicids2017.npz + +=== overall AUROC top-10 === + terminal_flow AUROC=0.9108 AUPRC=0.8190 + curvature_packet AUROC=0.8352 AUPRC=0.7664 + terminal_packet AUROC=0.8190 AUPRC=0.7567 + curvature_total AUROC=0.8123 AUPRC=0.7265 + terminal_norm AUROC=0.7922 AUPRC=0.7396 + velocity_packet AUROC=0.7880 AUPRC=0.6186 + packet_consistency AUROC=0.7737 AUPRC=0.6168 + kinetic_packet AUROC=0.7668 AUPRC=0.7081 + pna_packet_max AUROC=0.7083 AUPRC=0.5880 + causal_surprisal_packet_max AUROC=0.6979 AUPRC=0.5800 diff --git a/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicids2017.npz b/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicids2017.npz new file mode 100644 index 0000000..b47d408 Binary files /dev/null and b/artifacts/route_comparison/cross/route_a_causal_seed44_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_ciciot2023.json b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_ciciot2023.json new file mode 100644 index 0000000..1fec3e8 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_ciciot2023.json @@ -0,0 +1,480 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "n_benign": 10000, + "n_attack": 9999, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.45976179617961793, + "auprc": 0.5246421093338973 + }, + "disc_nll_ch3": { + "auroc": 0.6063352485248525, + "auprc": 0.6235052895901612 + }, + "disc_nll_ch4": { + "auroc": 0.47919988998899893, + "auprc": 0.4826895941446947 + }, + "disc_nll_ch5": { + "auroc": 0.6397653115311531, + "auprc": 0.6748879578622871 + }, + "disc_nll_ch6": { + "auroc": 0.49723127812781276, + "auprc": 0.544395334742973 + }, + "disc_nll_ch7": { + "auroc": 0.6688372237223723, + "auprc": 0.7242696263849957 + }, + "disc_nll_total": { + "auroc": 0.594737703770377, + "auprc": 0.6843691069062285 + }, + "terminal_flow": { + "auroc": 0.5684024452445244, + "auprc": 0.58822084093915 + }, + "terminal_norm": { + "auroc": 0.5605227372737274, + "auprc": 0.5650880447385236 + }, + "terminal_packet": { + "auroc": 0.598494499449945, + "auprc": 0.6316235430038692 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 303.0, + "disc_nll_ch2": 0.5416607260726073, + "disc_nll_ch3": 0.5582960396039605, + "disc_nll_ch4": 0.42007887788778875, + "disc_nll_ch5": 0.4649886138613861, + "disc_nll_ch6": 0.4826293729372937, + "disc_nll_ch7": 0.5477830033003299, + "disc_nll_total": 0.49844075907590757, + "terminal_flow": 0.4944851485148515, + "terminal_norm": 0.45448811881188117, + "terminal_packet": 0.552463201320132 + }, + "browserhijacking": { + "_n": 303.0, + "disc_nll_ch2": 0.5453744224422442, + "disc_nll_ch3": 0.530103795379538, + "disc_nll_ch4": 0.4122207920792079, + "disc_nll_ch5": 0.4240287128712872, + "disc_nll_ch6": 0.44935115511551155, + "disc_nll_ch7": 0.5342770627062705, + "disc_nll_total": 0.4906777227722773, + "terminal_flow": 0.5591978547854785, + "terminal_norm": 0.49240924092409244, + "terminal_packet": 0.5595547854785479 + }, + "commandinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.5528382838283828, + "disc_nll_ch3": 0.5268602310231023, + "disc_nll_ch4": 0.36981980198019804, + "disc_nll_ch5": 0.4344635313531353, + "disc_nll_ch6": 0.4479435643564357, + "disc_nll_ch7": 0.46484554455445537, + "disc_nll_total": 0.46955280528052806, + "terminal_flow": 0.5018645214521452, + "terminal_norm": 0.46753811881188123, + "terminal_packet": 0.5577057755775577 + }, + "ddos-ack_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.3032404290429044, + "disc_nll_ch3": 0.05559851485148512, + "disc_nll_ch4": 0.46667970297029693, + "disc_nll_ch5": 0.26171006600660063, + "disc_nll_ch6": 0.8313196369636964, + "disc_nll_ch7": 0.2816542904290429, + "disc_nll_total": 0.27698960396039607, + "terminal_flow": 0.8989674917491749, + "terminal_norm": 0.9131285478547855, + "terminal_packet": 0.273730198019802 + }, + "ddos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5589518151815182, + "disc_nll_ch3": 0.7395689768976897, + "disc_nll_ch4": 0.5707823432343234, + "disc_nll_ch5": 0.9129491749174917, + "disc_nll_ch6": 0.5793742574257426, + "disc_nll_ch7": 0.8958041254125413, + "disc_nll_total": 0.891734488448845, + "terminal_flow": 0.6214491749174917, + "terminal_norm": 0.6522146864686469, + "terminal_packet": 0.7170481848184819 + }, + "ddos-icmp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.4538069306930693, + "disc_nll_ch3": 0.5692742574257426, + "disc_nll_ch4": 0.4964712871287128, + "disc_nll_ch5": 0.5479856435643564, + "disc_nll_ch6": 0.44840379537953795, + "disc_nll_ch7": 0.5459821782178218, + "disc_nll_total": 0.5036254125412541, + "terminal_flow": 0.49015478547854785, + "terminal_norm": 0.47040808580858084, + "terminal_packet": 0.5285887788778878 + }, + "ddos-icmp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.5024536303630363, + "disc_nll_ch3": 0.5574980198019802, + "disc_nll_ch4": 0.4147194719471947, + "disc_nll_ch5": 0.5684810231023103, + "disc_nll_ch6": 0.4464638613861386, + "disc_nll_ch7": 0.5553260726072606, + "disc_nll_total": 0.5038432343234324, + "terminal_flow": 0.48580495049504946, + "terminal_norm": 0.47350066006600655, + "terminal_packet": 0.5258755775577558 + }, + "ddos-pshack_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.20187260726072606, + "disc_nll_ch3": 0.6742924092409242, + "disc_nll_ch4": 0.5142128712871288, + "disc_nll_ch5": 0.6266957095709571, + "disc_nll_ch6": 0.9999735973597359, + "disc_nll_ch7": 0.8196836633663367, + "disc_nll_total": 0.9726023102310231, + "terminal_flow": 0.5568795379537954, + "terminal_norm": 0.46877788778877894, + "terminal_packet": 0.7027734323432344 + }, + "ddos-rstfinflood": { + "_n": 303.0, + "disc_nll_ch2": 0.20940000000000003, + "disc_nll_ch3": 0.7043, + "disc_nll_ch4": 0.9892, + "disc_nll_ch5": 0.9997, + "disc_nll_ch6": 0.5085, + "disc_nll_ch7": 0.9999, + "disc_nll_total": 0.9999999999999999, + "terminal_flow": 0.4786, + "terminal_norm": 0.5363, + "terminal_packet": 0.22089999999999999 + }, + "ddos-slowloris": { + "_n": 303.0, + "disc_nll_ch2": 0.46323712871287126, + "disc_nll_ch3": 0.5482663366336634, + "disc_nll_ch4": 0.5312554455445544, + "disc_nll_ch5": 0.8757833333333334, + "disc_nll_ch6": 0.7372551155115512, + "disc_nll_ch7": 0.6920343234323433, + "disc_nll_total": 0.860826402640264, + "terminal_flow": 0.3118313531353135, + "terminal_norm": 0.32228993399339934, + "terminal_packet": 0.4226204620462046 + }, + "ddos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.22637854785478548, + "disc_nll_ch3": 0.9624046204620461, + "disc_nll_ch4": 0.49762310231023105, + "disc_nll_ch5": 0.7024590759075907, + "disc_nll_ch6": 0.43126336633663365, + "disc_nll_ch7": 0.835986798679868, + "disc_nll_total": 0.4518396039603961, + "terminal_flow": 0.6521490099009901, + "terminal_norm": 0.7338483498349835, + "terminal_packet": 0.9506689768976897 + }, + "ddos-synonymousip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.3044151815181518, + "disc_nll_ch3": 0.759579207920792, + "disc_nll_ch4": 0.502056105610561, + "disc_nll_ch5": 0.7421201320132013, + "disc_nll_ch6": 0.006653795379537954, + "disc_nll_ch7": 0.9161912541254125, + "disc_nll_total": 0.26817623762376236, + "terminal_flow": 0.9955864686468647, + "terminal_norm": 0.9344501650165017, + "terminal_packet": 0.9590194719471947 + }, + "ddos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.03293333333333332, + "disc_nll_ch3": 0.7529640264026403, + "disc_nll_ch4": 0.5007980198019802, + "disc_nll_ch5": 0.6150917491749175, + "disc_nll_ch6": 0.4902016501650165, + "disc_nll_ch7": 0.9791947194719473, + "disc_nll_total": 0.2884805280528053, + "terminal_flow": 0.6255290429042903, + "terminal_norm": 0.6821556105610561, + "terminal_packet": 0.9373016501650164 + }, + "ddos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.4398089108910891, + "disc_nll_ch3": 0.3647907590759075, + "disc_nll_ch4": 0.4477062706270627, + "disc_nll_ch5": 0.5855722772277228, + "disc_nll_ch6": 0.4844745874587459, + "disc_nll_ch7": 0.3636323432343234, + "disc_nll_total": 0.26302706270627063, + "terminal_flow": 0.8601458745874588, + "terminal_norm": 0.3621996699669967, + "terminal_packet": 0.5526046204620462 + }, + "ddos-udp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.49978696369636966, + "disc_nll_ch3": 0.5457490099009901, + "disc_nll_ch4": 0.37621468646864686, + "disc_nll_ch5": 0.48182871287128715, + "disc_nll_ch6": 0.4915760726072608, + "disc_nll_ch7": 0.5979608910891089, + "disc_nll_total": 0.5903539603960396, + "terminal_flow": 0.6752150165016503, + "terminal_norm": 0.4767656765676567, + "terminal_packet": 0.4902958745874587 + }, + "dictionarybruteforce": { + "_n": 303.0, + "disc_nll_ch2": 0.5920145214521452, + "disc_nll_ch3": 0.5629785478547855, + "disc_nll_ch4": 0.49827821782178217, + "disc_nll_ch5": 0.5504668316831683, + "disc_nll_ch6": 0.5468983498349835, + "disc_nll_ch7": 0.6061262376237623, + "disc_nll_total": 0.6030107260726073, + "terminal_flow": 0.43908861386138615, + "terminal_norm": 0.4142490099009901, + "terminal_packet": 0.5354193069306931 + }, + "dns_spoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.43159158415841586, + "disc_nll_ch3": 0.4374320132013201, + "disc_nll_ch4": 0.4506343234323432, + "disc_nll_ch5": 0.5630620462046205, + "disc_nll_ch6": 0.5015823432343234, + "disc_nll_ch7": 0.6615833333333333, + "disc_nll_total": 0.4553503300330033, + "terminal_flow": 0.5512031353135313, + "terminal_norm": 0.5721513201320132, + "terminal_packet": 0.48997244224422454 + }, + "dos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5652623762376237, + "disc_nll_ch3": 0.5017016501650164, + "disc_nll_ch4": 0.5466709570957096, + "disc_nll_ch5": 0.940517491749175, + "disc_nll_ch6": 0.5703838283828383, + "disc_nll_ch7": 0.8771514851485148, + "disc_nll_total": 0.923346204620462, + "terminal_flow": 0.5842217821782179, + "terminal_norm": 0.6509567656765676, + "terminal_packet": 0.5876397689768977 + }, + "dos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.48635544554455445, + "disc_nll_ch3": 0.9414518151815181, + "disc_nll_ch4": 0.5007877887788779, + "disc_nll_ch5": 0.95013201320132, + "disc_nll_ch6": 0.2658250825082508, + "disc_nll_ch7": 0.9345392739273928, + "disc_nll_total": 0.7708917491749174, + "terminal_flow": 0.5193768976897689, + "terminal_norm": 0.6193201320132014, + "terminal_packet": 0.943282508250825 + }, + "dos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5348333333333334, + "disc_nll_ch3": 0.7262693069306931, + "disc_nll_ch4": 0.5090128712871287, + "disc_nll_ch5": 0.9400702970297029, + "disc_nll_ch6": 0.46016270627062705, + "disc_nll_ch7": 0.9838009900990099, + "disc_nll_total": 0.7765072607260726, + "terminal_flow": 0.5032557755775577, + "terminal_norm": 0.6283273927392738, + "terminal_packet": 0.909039603960396 + }, + "dos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.29957689768976903, + "disc_nll_ch3": 0.741485808580858, + "disc_nll_ch4": 0.47780297029702967, + "disc_nll_ch5": 0.6677739273927392, + "disc_nll_ch6": 0.44366303630363035, + "disc_nll_ch7": 0.6715105610561056, + "disc_nll_total": 0.059380858085808556, + "terminal_flow": 0.744469801980198, + "terminal_norm": 0.9499158415841584, + "terminal_packet": 0.9960627062706271 + }, + "mirai-greeth_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6139226072607261, + "disc_nll_ch3": 0.5022272277227723, + "disc_nll_ch4": 0.3175062706270627, + "disc_nll_ch5": 0.43354917491749173, + "disc_nll_ch6": 0.4163143564356435, + "disc_nll_ch7": 0.5212283828382838, + "disc_nll_total": 0.5536907590759076, + "terminal_flow": 0.6488569306930694, + "terminal_norm": 0.5631184818481848, + "terminal_packet": 0.5965463696369638 + }, + "mirai-greip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5728115511551156, + "disc_nll_ch3": 0.5613092409240924, + "disc_nll_ch4": 0.38591336633663365, + "disc_nll_ch5": 0.5490683168316832, + "disc_nll_ch6": 0.4584211221122112, + "disc_nll_ch7": 0.5604257425742574, + "disc_nll_total": 0.6034201320132013, + "terminal_flow": 0.5167970297029704, + "terminal_norm": 0.4965023102310231, + "terminal_packet": 0.6056668316831684 + }, + "mirai-udpplain": { + "_n": 303.0, + "disc_nll_ch2": 0.5904193069306931, + "disc_nll_ch3": 0.5896773927392739, + "disc_nll_ch4": 0.34208663366336634, + "disc_nll_ch5": 0.5690785478547855, + "disc_nll_ch6": 0.46722772277227725, + "disc_nll_ch7": 0.5643219471947195, + "disc_nll_total": 0.6456846534653465, + "terminal_flow": 0.6605262376237623, + "terminal_norm": 0.5455389438943895, + "terminal_packet": 0.5682899339933993 + }, + "mitm-arpspoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.5755564356435644, + "disc_nll_ch3": 0.4860037953795379, + "disc_nll_ch4": 0.4223790429042904, + "disc_nll_ch5": 0.4885650165016502, + "disc_nll_ch6": 0.44489290429042905, + "disc_nll_ch7": 0.5352156765676568, + "disc_nll_total": 0.5283255775577558, + "terminal_flow": 0.533513201320132, + "terminal_norm": 0.501066501650165, + "terminal_packet": 0.5632344884488449 + }, + "recon-hostdiscovery": { + "_n": 303.0, + "disc_nll_ch2": 0.1316750825082508, + "disc_nll_ch3": 0.7217544554455445, + "disc_nll_ch4": 0.5619851485148515, + "disc_nll_ch5": 0.9348737623762378, + "disc_nll_ch6": 0.5006574257425742, + "disc_nll_ch7": 0.8575026402640263, + "disc_nll_total": 0.9698778877887789, + "terminal_flow": 0.36628283828382835, + "terminal_norm": 0.5314673267326734, + "terminal_packet": 0.2492551155115512 + }, + "recon-osscan": { + "_n": 303.0, + "disc_nll_ch2": 0.6019458745874587, + "disc_nll_ch3": 0.8310768976897691, + "disc_nll_ch4": 0.5259620462046204, + "disc_nll_ch5": 0.8523536303630364, + "disc_nll_ch6": 0.5034333333333333, + "disc_nll_ch7": 0.8439521452145216, + "disc_nll_total": 0.8864145214521453, + "terminal_flow": 0.5593607260726072, + "terminal_norm": 0.6245646864686469, + "terminal_packet": 0.5762151815181518 + }, + "recon-pingsweep": { + "_n": 303.0, + "disc_nll_ch2": 0.5932556105610561, + "disc_nll_ch3": 0.5210884488448846, + "disc_nll_ch4": 0.45612079207920797, + "disc_nll_ch5": 0.5035625412541254, + "disc_nll_ch6": 0.5688514851485149, + "disc_nll_ch7": 0.4940605610561057, + "disc_nll_total": 0.5823810231023103, + "terminal_flow": 0.4792815181518152, + "terminal_norm": 0.46274141914191425, + "terminal_packet": 0.5010641914191418 + }, + "recon-portscan": { + "_n": 303.0, + "disc_nll_ch2": 0.5330757425742574, + "disc_nll_ch3": 0.8292978547854786, + "disc_nll_ch4": 0.5461, + "disc_nll_ch5": 0.8822437293729373, + "disc_nll_ch6": 0.4879559405940595, + "disc_nll_ch7": 0.8353838283828383, + "disc_nll_total": 0.862469306930693, + "terminal_flow": 0.4912113861386138, + "terminal_norm": 0.5804059405940594, + "terminal_packet": 0.5391277227722773 + }, + "sqlinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.5307787128712871, + "disc_nll_ch3": 0.5410001650165016, + "disc_nll_ch4": 0.5223905940594059, + "disc_nll_ch5": 0.5664981848184818, + "disc_nll_ch6": 0.5401815181518151, + "disc_nll_ch7": 0.5117536303630362, + "disc_nll_total": 0.5188249174917492, + "terminal_flow": 0.4356298679867987, + "terminal_norm": 0.4365501650165016, + "terminal_packet": 0.45341897689768973 + }, + "uploading_attack": { + "_n": 303.0, + "disc_nll_ch2": 0.5568338283828382, + "disc_nll_ch3": 0.5422805280528052, + "disc_nll_ch4": 0.36053300330033, + "disc_nll_ch5": 0.4279821782178218, + "disc_nll_ch6": 0.45888531353135315, + "disc_nll_ch7": 0.45968943894389436, + "disc_nll_total": 0.45856996699669966, + "terminal_flow": 0.4962285478547855, + "terminal_norm": 0.4611112211221122, + "terminal_packet": 0.580173102310231 + }, + "vulnerabilityscan": { + "_n": 303.0, + "disc_nll_ch2": 0.5543343234323432, + "disc_nll_ch3": 0.5923372937293729, + "disc_nll_ch4": 0.4689518151815182, + "disc_nll_ch5": 0.6121042904290428, + "disc_nll_ch6": 0.46667227722772275, + "disc_nll_ch7": 0.5902070957095711, + "disc_nll_total": 0.5784795379537954, + "terminal_flow": 0.49100280528052803, + "terminal_norm": 0.5310691419141914, + "terminal_packet": 0.5416287128712871 + }, + "xss": { + "_n": 303.0, + "disc_nll_ch2": 0.5717371287128713, + "disc_nll_ch3": 0.5301445544554455, + "disc_nll_ch4": 0.41064174917491747, + "disc_nll_ch5": 0.4364955445544555, + "disc_nll_ch6": 0.47123960396039605, + "disc_nll_ch7": 0.5329191419141913, + "disc_nll_total": 0.5195486798679868, + "terminal_flow": 0.5291133663366336, + "terminal_norm": 0.4877189768976897, + "terminal_packet": 0.5631305280528054 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_ciciot2023.log b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_ciciot2023.log new file mode 100644 index 0000000..d82c42f --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_ciciot2023.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,193,621 target rows +[sample] benign=10,000 attack=9,999 (33 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/9,999 +[score] 5,376/9,999 +[eval] attack done 3.9s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_ciciot2023.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_ciciot2023.npz b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_ciciot2023.npz new file mode 100644 index 0000000..34cc9ef Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_ciciot2023.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_iscxtor2016.json b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_iscxtor2016.json new file mode 100644 index 0000000..8e12528 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_iscxtor2016.json @@ -0,0 +1,64 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42", + "target_store": "None", + "n_benign": 10000, + "n_attack": 1888, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.5876835010593221, + "auprc": 0.21480206238518923 + }, + "disc_nll_ch3": { + "auroc": 0.41304014830508473, + "auprc": 0.14321182216724285 + }, + "disc_nll_ch4": { + "auroc": 0.3947111228813559, + "auprc": 0.17785198213918124 + }, + "disc_nll_ch5": { + "auroc": 0.404497748940678, + "auprc": 0.1567122979687099 + }, + "disc_nll_ch6": { + "auroc": 0.5142036016949152, + "auprc": 0.15720929966373665 + }, + "disc_nll_ch7": { + "auroc": 0.5287739671610169, + "auprc": 0.1794835400728114 + }, + "disc_nll_total": { + "auroc": 0.5785372086864407, + "auprc": 0.19181176104753922 + }, + "terminal_flow": { + "auroc": 0.7595041578389831, + "auprc": 0.35359546955502924 + }, + "terminal_norm": { + "auroc": 0.675061811440678, + "auprc": 0.3398221866922042 + }, + "terminal_packet": { + "auroc": 0.6251854872881356, + "auprc": 0.21540171038475653 + } + }, + "per_class": { + "tor": { + "_n": 1888.0, + "disc_nll_ch2": 0.5876835010593221, + "disc_nll_ch3": 0.41304014830508473, + "disc_nll_ch4": 0.3947111228813559, + "disc_nll_ch5": 0.404497748940678, + "disc_nll_ch6": 0.5142036016949152, + "disc_nll_ch7": 0.5287739671610169, + "disc_nll_total": 0.5785372086864407, + "terminal_flow": 0.7595041578389831, + "terminal_norm": 0.675061811440678, + "terminal_packet": 0.6251854872881356 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_iscxtor2016.log b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_iscxtor2016.log new file mode 100644 index 0000000..2b0d3a2 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_iscxtor2016.log @@ -0,0 +1,13 @@ +[model] T=64 flow_dim=20 +[data] 103,079 target rows +[sample] benign=10,000 attack=1,888 (1 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.2s +[eval] attack... +[score] 256/1,888 +[eval] attack done 0.8s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_iscxtor2016.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_iscxtor2016.npz b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_iscxtor2016.npz new file mode 100644 index 0000000..e7f1bca Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicddos2019_to_iscxtor2016.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_cicddos2019.json b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_cicddos2019.json new file mode 100644 index 0000000..1015775 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_cicddos2019.json @@ -0,0 +1,272 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.2979805860247816, + "auprc": 0.3858317259099947 + }, + "disc_nll_ch3": { + "auroc": 0.12775167072923016, + "auprc": 0.3404276613231079 + }, + "disc_nll_ch4": { + "auroc": 0.1967464097095267, + "auprc": 0.35139612002920784 + }, + "disc_nll_ch5": { + "auroc": 0.2662990148283567, + "auprc": 0.37256952213963485 + }, + "disc_nll_ch6": { + "auroc": 0.6088495378834043, + "auprc": 0.5202810382877667 + }, + "disc_nll_ch7": { + "auroc": 0.25867875787121675, + "auprc": 0.37163645756506253 + }, + "disc_nll_total": { + "auroc": 0.1675566981515336, + "auprc": 0.3393615905289678 + }, + "terminal_flow": { + "auroc": 0.9234306469632337, + "auprc": 0.9064682198200303 + }, + "terminal_norm": { + "auroc": 0.8675219937030267, + "auprc": 0.8587771744961038 + }, + "terminal_packet": { + "auroc": 0.724777559414991, + "auprc": 0.7267111998961192 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "disc_nll_ch2": 0.02510561224489794, + "disc_nll_ch3": 0.008608333333333357, + "disc_nll_ch4": 0.2782697278911564, + "disc_nll_ch5": 0.21094328231292517, + "disc_nll_ch6": 0.6885768707482993, + "disc_nll_ch7": 0.4462065476190476, + "disc_nll_total": 0.002292517006802721, + "terminal_flow": 0.9940278911564626, + "terminal_norm": 0.9951117346938775, + "terminal_packet": 0.9796594387755102 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.016549149659863926, + "disc_nll_ch3": 0.007666666666666695, + "disc_nll_ch4": 0.2936360544217687, + "disc_nll_ch5": 0.2127937074829932, + "disc_nll_ch6": 0.6919692176870749, + "disc_nll_ch7": 0.471350850340136, + "disc_nll_total": 0.0006168367346938776, + "terminal_flow": 0.9985418367346939, + "terminal_norm": 0.9999190476190476, + "terminal_packet": 0.9994389455782313 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.13893231292517005, + "disc_nll_ch3": 0.004845068027210881, + "disc_nll_ch4": 0.0348484693877551, + "disc_nll_ch5": 0.1504170068027211, + "disc_nll_ch6": 0.669012925170068, + "disc_nll_ch7": 0.09961020408163265, + "disc_nll_total": 0.0006215986394557822, + "terminal_flow": 0.9672782312925171, + "terminal_norm": 0.962210544217687, + "terminal_packet": 0.7437158163265306 + }, + "DrDoS_NTP": { + "_n": 588.0, + "disc_nll_ch2": 0.6024350340136055, + "disc_nll_ch3": 0.012534353741496597, + "disc_nll_ch4": 0.2172765306122449, + "disc_nll_ch5": 0.43576394557823134, + "disc_nll_ch6": 0.6584010204081634, + "disc_nll_ch7": 0.021537585034013606, + "disc_nll_total": 0.34326173469387755, + "terminal_flow": 0.9663906462585033, + "terminal_norm": 0.5574437925170068, + "terminal_packet": 0.470308843537415 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.191116156462585, + "disc_nll_ch3": 0.006331122448979627, + "disc_nll_ch4": 0.021434353741496572, + "disc_nll_ch5": 0.12592380952380952, + "disc_nll_ch6": 0.66284268707483, + "disc_nll_ch7": 0.05161564625850342, + "disc_nll_total": 0.0008666666666666557, + "terminal_flow": 0.9033901360544218, + "terminal_norm": 0.7983988095238096, + "terminal_packet": 0.5419469387755103 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "disc_nll_ch2": 0.023469897959183677, + "disc_nll_ch3": 0.007614965986394594, + "disc_nll_ch4": 0.2703073129251701, + "disc_nll_ch5": 0.20693010204081633, + "disc_nll_ch6": 0.6895335034013605, + "disc_nll_ch7": 0.4489248299319728, + "disc_nll_total": 4.761904761904238e-06, + "terminal_flow": 0.9937920068027211, + "terminal_norm": 0.9903488095238095, + "terminal_packet": 0.9784860544217687 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "disc_nll_ch2": 0.4107724489795918, + "disc_nll_ch3": 0.004567176870748293, + "disc_nll_ch4": 0.02858197278911565, + "disc_nll_ch5": 0.1621651360544218, + "disc_nll_ch6": 0.6661452380952381, + "disc_nll_ch7": 0.060751870748299325, + "disc_nll_total": 0.17362942176870746, + "terminal_flow": 0.9262984693877551, + "terminal_norm": 0.840232568027211, + "terminal_packet": 0.5810333333333333 + }, + "DrDoS_UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.41719744897959177, + "disc_nll_ch3": 0.004397108843537414, + "disc_nll_ch4": 0.023497278911564626, + "disc_nll_ch5": 0.16157006802721088, + "disc_nll_ch6": 0.6657680272108843, + "disc_nll_ch7": 0.05133469387755102, + "disc_nll_total": 0.1754515306122449, + "terminal_flow": 0.9243639455782312, + "terminal_norm": 0.8456494897959185, + "terminal_packet": 0.5723850340136054 + }, + "LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.017198979591836715, + "disc_nll_ch3": 0.009087244897959213, + "disc_nll_ch4": 0.2926823129251701, + "disc_nll_ch5": 0.2137551020408163, + "disc_nll_ch6": 0.6918707482993198, + "disc_nll_ch7": 0.4712760204081633, + "disc_nll_total": 0.0012569727891156462, + "terminal_flow": 0.9978617346938775, + "terminal_norm": 0.9993918367346938, + "terminal_packet": 0.9993323129251701 + }, + "MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.14200510204081632, + "disc_nll_ch3": 0.004756292517006797, + "disc_nll_ch4": 0.03371632653061224, + "disc_nll_ch5": 0.14975850340136054, + "disc_nll_ch6": 0.6688505102040816, + "disc_nll_ch7": 0.09815739795918367, + "disc_nll_total": 0.00061734693877551, + "terminal_flow": 0.9649605442176872, + "terminal_norm": 0.961101530612245, + "terminal_packet": 0.7356227891156462 + }, + "NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.19279829931972786, + "disc_nll_ch3": 0.006232482993197308, + "disc_nll_ch4": 0.021679081632653033, + "disc_nll_ch5": 0.1265362244897959, + "disc_nll_ch6": 0.6625110544217687, + "disc_nll_ch7": 0.05101105442176873, + "disc_nll_total": 0.001579251700680261, + "terminal_flow": 0.9050008503401359, + "terminal_norm": 0.8018780612244899, + "terminal_packet": 0.5438141156462585 + }, + "Portmap": { + "_n": 588.0, + "disc_nll_ch2": 0.1953891156462585, + "disc_nll_ch3": 0.009100850340136087, + "disc_nll_ch4": 0.023792346938775483, + "disc_nll_ch5": 0.12896683673469383, + "disc_nll_ch6": 0.6625229591836734, + "disc_nll_ch7": 0.053224829931972806, + "disc_nll_total": 0.004213095238095227, + "terminal_flow": 0.9034336734693879, + "terminal_norm": 0.8015852040816326, + "terminal_packet": 0.5450784013605442 + }, + "Syn": { + "_n": 588.0, + "disc_nll_ch2": 0.7622668367346939, + "disc_nll_ch3": 0.8441819727891156, + "disc_nll_ch4": 0.6063789115646259, + "disc_nll_ch5": 0.8310574829931973, + "disc_nll_ch6": 0.24108180272108845, + "disc_nll_ch7": 0.6775404761904762, + "disc_nll_total": 0.6147518707482994, + "terminal_flow": 0.8035090136054421, + "terminal_norm": 0.8439239795918367, + "terminal_packet": 0.8632212585034014 + }, + "TFTP": { + "_n": 588.0, + "disc_nll_ch2": 0.44363979591836733, + "disc_nll_ch3": 0.011781632653061253, + "disc_nll_ch4": 0.033314625850340125, + "disc_nll_ch5": 0.19852517006802722, + "disc_nll_ch6": 0.6623438775510204, + "disc_nll_ch7": 0.060193197278911544, + "disc_nll_total": 0.19284353741496596, + "terminal_flow": 0.9708741496598638, + "terminal_norm": 0.9324659863945578, + "terminal_packet": 0.730474149659864 + }, + "UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.4312493197278911, + "disc_nll_ch3": 0.004406802721088435, + "disc_nll_ch4": 0.023475680272108838, + "disc_nll_ch5": 0.16345544217687077, + "disc_nll_ch6": 0.6655440476190476, + "disc_nll_ch7": 0.04939030612244899, + "disc_nll_total": 0.18473061224489792, + "terminal_flow": 0.9250295918367347, + "terminal_norm": 0.8379583333333334, + "terminal_packet": 0.5703646258503402 + }, + "UDPLag": { + "_n": 588.0, + "disc_nll_ch2": 0.7097709183673468, + "disc_nll_ch3": 0.7547722789115646, + "disc_nll_ch4": 0.5565188775510204, + "disc_nll_ch5": 0.7470158163265307, + "disc_nll_ch6": 0.30430799319727897, + "disc_nll_ch7": 0.6161911564625852, + "disc_nll_total": 0.5484615646258503, + "terminal_flow": 0.8590045918367347, + "terminal_norm": 0.8678074829931973, + "terminal_packet": 0.8435299319727891 + }, + "WebDDoS": { + "_n": 438.0, + "disc_nll_ch2": 0.36214098173515985, + "disc_nll_ch3": 0.5884085616438357, + "disc_nll_ch4": 0.7183382420091324, + "disc_nll_ch5": 0.3135626712328767, + "disc_nll_ch6": 0.3273480593607306, + "disc_nll_ch7": 0.809819292237443, + "disc_nll_total": 0.7524795662100456, + "terminal_flow": 0.6161845890410959, + "terminal_norm": 0.6593386986301368, + "terminal_packet": 0.5878849315068493 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_cicddos2019.log b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_cicddos2019.log new file mode 100644 index 0000000..c4b917b --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_cicddos2019.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,993,376 target rows +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done 4.0s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_cicddos2019.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_cicddos2019.npz new file mode 100644 index 0000000..0ab13c0 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_ciciot2023.json b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_ciciot2023.json new file mode 100644 index 0000000..30a5397 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_ciciot2023.json @@ -0,0 +1,480 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "n_benign": 10000, + "n_attack": 9999, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.48953545854585456, + "auprc": 0.472523683052152 + }, + "disc_nll_ch3": { + "auroc": 0.4870787078707871, + "auprc": 0.5383585861767888 + }, + "disc_nll_ch4": { + "auroc": 0.5564250225022502, + "auprc": 0.6014382054949581 + }, + "disc_nll_ch5": { + "auroc": 0.6445743324332434, + "auprc": 0.6975801462659398 + }, + "disc_nll_ch6": { + "auroc": 0.5247160266026604, + "auprc": 0.5538100110296867 + }, + "disc_nll_ch7": { + "auroc": 0.6185202520252026, + "auprc": 0.5645748814037456 + }, + "disc_nll_total": { + "auroc": 0.5954832833283328, + "auprc": 0.6390059176218883 + }, + "terminal_flow": { + "auroc": 0.6493733573357335, + "auprc": 0.6672502070099231 + }, + "terminal_norm": { + "auroc": 0.6393969396939694, + "auprc": 0.621520077804255 + }, + "terminal_packet": { + "auroc": 0.6970913641364136, + "auprc": 0.6909365846640474 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 303.0, + "disc_nll_ch2": 0.6212914191419142, + "disc_nll_ch3": 0.30290181518151815, + "disc_nll_ch4": 0.42588217821782176, + "disc_nll_ch5": 0.46725643564356434, + "disc_nll_ch6": 0.6227206270627063, + "disc_nll_ch7": 0.49258250825082506, + "disc_nll_total": 0.44039059405940595, + "terminal_flow": 0.5453595709570958, + "terminal_norm": 0.5680257425742574, + "terminal_packet": 0.633946699669967 + }, + "browserhijacking": { + "_n": 303.0, + "disc_nll_ch2": 0.555404785478548, + "disc_nll_ch3": 0.30864026402640266, + "disc_nll_ch4": 0.3855716171617162, + "disc_nll_ch5": 0.4487255775577558, + "disc_nll_ch6": 0.5809216171617162, + "disc_nll_ch7": 0.5171864686468647, + "disc_nll_total": 0.41073019801980204, + "terminal_flow": 0.4883628712871287, + "terminal_norm": 0.4406318481848185, + "terminal_packet": 0.5210912541254126 + }, + "commandinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.5733084158415842, + "disc_nll_ch3": 0.29543003300330034, + "disc_nll_ch4": 0.3628605610561056, + "disc_nll_ch5": 0.35332805280528057, + "disc_nll_ch6": 0.6230407590759076, + "disc_nll_ch7": 0.5112227722772277, + "disc_nll_total": 0.4200569306930693, + "terminal_flow": 0.5129808580858085, + "terminal_norm": 0.5441869636963697, + "terminal_packet": 0.6083429042904291 + }, + "ddos-ack_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.08676617161716171, + "disc_nll_ch3": 0.4025123762376237, + "disc_nll_ch4": 0.13887739273927394, + "disc_nll_ch5": 0.7407239273927393, + "disc_nll_ch6": 0.7219321782178217, + "disc_nll_ch7": 0.885587293729373, + "disc_nll_total": 0.9620615511551154, + "terminal_flow": 0.9872400990099008, + "terminal_norm": 0.9892417491749175, + "terminal_packet": 0.9737430693069306 + }, + "ddos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6002709570957095, + "disc_nll_ch3": 0.5642349834983498, + "disc_nll_ch4": 0.7484663366336634, + "disc_nll_ch5": 0.9137240924092408, + "disc_nll_ch6": 0.6508217821782178, + "disc_nll_ch7": 0.7178501650165017, + "disc_nll_total": 0.789705610561056, + "terminal_flow": 0.6663011551155115, + "terminal_norm": 0.7151828382838284, + "terminal_packet": 0.7677506600660066 + }, + "ddos-icmp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5106602310231023, + "disc_nll_ch3": 0.45641237623762376, + "disc_nll_ch4": 0.44144966996699675, + "disc_nll_ch5": 0.5101445544554456, + "disc_nll_ch6": 0.6169358085808581, + "disc_nll_ch7": 0.5223226072607261, + "disc_nll_total": 0.5035534653465347, + "terminal_flow": 0.4807483498349835, + "terminal_norm": 0.4648424092409241, + "terminal_packet": 0.5071293729372937 + }, + "ddos-icmp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.5318706270627063, + "disc_nll_ch3": 0.3251564356435644, + "disc_nll_ch4": 0.3718445544554455, + "disc_nll_ch5": 0.4425597359735974, + "disc_nll_ch6": 0.6233925742574258, + "disc_nll_ch7": 0.5153021452145214, + "disc_nll_total": 0.48282871287128715, + "terminal_flow": 0.5401432343234324, + "terminal_norm": 0.5450173267326732, + "terminal_packet": 0.5869874587458745 + }, + "ddos-pshack_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.2586013201320132, + "disc_nll_ch3": 0.8868986798679868, + "disc_nll_ch4": 0.845663696369637, + "disc_nll_ch5": 0.8368627062706272, + "disc_nll_ch6": 0.9999003300330033, + "disc_nll_ch7": 0.7591864686468647, + "disc_nll_total": 0.9956062706270626, + "terminal_flow": 0.7587488448844885, + "terminal_norm": 0.7239696369636964, + "terminal_packet": 0.7477891089108911 + }, + "ddos-rstfinflood": { + "_n": 303.0, + "disc_nll_ch2": 0.0, + "disc_nll_ch3": 0.5795, + "disc_nll_ch4": 0.999, + "disc_nll_ch5": 0.9870000000000001, + "disc_nll_ch6": 0.11199999999999999, + "disc_nll_ch7": 0.7342, + "disc_nll_total": 0.997, + "terminal_flow": 0.9702, + "terminal_norm": 0.9797, + "terminal_packet": 0.9210999999999999 + }, + "ddos-slowloris": { + "_n": 303.0, + "disc_nll_ch2": 0.6032747524752474, + "disc_nll_ch3": 0.5349731023102311, + "disc_nll_ch4": 0.5914635313531353, + "disc_nll_ch5": 0.8660658415841584, + "disc_nll_ch6": 0.7692706270627063, + "disc_nll_ch7": 0.6158080858085808, + "disc_nll_total": 0.7914113861386138, + "terminal_flow": 0.5668574257425743, + "terminal_norm": 0.5650374587458746, + "terminal_packet": 0.6361171617161716 + }, + "ddos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.30459669966996705, + "disc_nll_ch3": 0.7426656765676567, + "disc_nll_ch4": 0.9077719471947195, + "disc_nll_ch5": 0.9551415841584159, + "disc_nll_ch6": 0.0775950495049505, + "disc_nll_ch7": 0.7487016501650166, + "disc_nll_total": 0.5406442244224424, + "terminal_flow": 0.7216663366336634, + "terminal_norm": 0.684626402640264, + "terminal_packet": 0.7314755775577558 + }, + "ddos-synonymousip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.7096709570957095, + "disc_nll_ch3": 0.995449504950495, + "disc_nll_ch4": 0.9555092409240924, + "disc_nll_ch5": 0.960119801980198, + "disc_nll_ch6": 0.7373267326732673, + "disc_nll_ch7": 0.8223630363036304, + "disc_nll_total": 0.9703462046204621, + "terminal_flow": 0.9967227722772277, + "terminal_norm": 0.743657095709571, + "terminal_packet": 0.9323524752475246 + }, + "ddos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.21587425742574262, + "disc_nll_ch3": 0.9515046204620462, + "disc_nll_ch4": 0.8597244224422442, + "disc_nll_ch5": 0.9158610561056106, + "disc_nll_ch6": 0.0536722772277228, + "disc_nll_ch7": 0.7439884488448845, + "disc_nll_total": 0.5289765676567657, + "terminal_flow": 0.7216782178217822, + "terminal_norm": 0.6875940594059406, + "terminal_packet": 0.7358881188118812 + }, + "ddos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6482693069306931, + "disc_nll_ch3": 0.11714224422442243, + "disc_nll_ch4": 0.24036534653465347, + "disc_nll_ch5": 0.41522574257425743, + "disc_nll_ch6": 0.7203719471947194, + "disc_nll_ch7": 0.3761234323432343, + "disc_nll_total": 0.4512924092409241, + "terminal_flow": 0.8540696369636964, + "terminal_norm": 0.6961112211221122, + "terminal_packet": 0.8955445544554456 + }, + "ddos-udp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.5687407590759076, + "disc_nll_ch3": 0.35531765676567656, + "disc_nll_ch4": 0.43312590759075914, + "disc_nll_ch5": 0.4583077557755776, + "disc_nll_ch6": 0.6382970297029703, + "disc_nll_ch7": 0.5886899339933993, + "disc_nll_total": 0.5544133663366336, + "terminal_flow": 0.6756031353135313, + "terminal_norm": 0.6017919141914191, + "terminal_packet": 0.6378859735973598 + }, + "dictionarybruteforce": { + "_n": 303.0, + "disc_nll_ch2": 0.5549815181518153, + "disc_nll_ch3": 0.41764785478547856, + "disc_nll_ch4": 0.5393082508250826, + "disc_nll_ch5": 0.5200481848184819, + "disc_nll_ch6": 0.6167298679867986, + "disc_nll_ch7": 0.5341980198019802, + "disc_nll_total": 0.5097419141914192, + "terminal_flow": 0.546209405940594, + "terminal_norm": 0.5284077557755775, + "terminal_packet": 0.5913014851485149 + }, + "dns_spoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.4814311881188119, + "disc_nll_ch3": 0.31253630363036305, + "disc_nll_ch4": 0.35034702970297027, + "disc_nll_ch5": 0.3723719471947195, + "disc_nll_ch6": 0.5590872937293729, + "disc_nll_ch7": 0.45442013201320136, + "disc_nll_total": 0.3678244224422442, + "terminal_flow": 0.5917940594059407, + "terminal_norm": 0.590289603960396, + "terminal_packet": 0.5366443894389439 + }, + "dos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.4913409240924092, + "disc_nll_ch3": 0.4311092409240924, + "disc_nll_ch4": 0.54270099009901, + "disc_nll_ch5": 0.9280287128712871, + "disc_nll_ch6": 0.6644861386138614, + "disc_nll_ch7": 0.6579353135313531, + "disc_nll_total": 0.7793112211221123, + "terminal_flow": 0.6778234323432343, + "terminal_norm": 0.7800953795379537, + "terminal_packet": 0.8209353135313531 + }, + "dos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6361300330033004, + "disc_nll_ch3": 0.6758871287128713, + "disc_nll_ch4": 0.9070894389438944, + "disc_nll_ch5": 0.9668874587458747, + "disc_nll_ch6": 0.271217491749175, + "disc_nll_ch7": 0.7527577557755776, + "disc_nll_total": 0.5885772277227722, + "terminal_flow": 0.7364178217821782, + "terminal_norm": 0.6749300330033003, + "terminal_packet": 0.7121656765676567 + }, + "dos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6715963696369638, + "disc_nll_ch3": 0.82706699669967, + "disc_nll_ch4": 0.8451023102310231, + "disc_nll_ch5": 0.95510099009901, + "disc_nll_ch6": 0.05913036303630363, + "disc_nll_ch7": 0.7514597359735973, + "disc_nll_total": 0.709296699669967, + "terminal_flow": 0.6703884488448845, + "terminal_norm": 0.6697785478547854, + "terminal_packet": 0.8004009900990098 + }, + "dos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.33756831683168315, + "disc_nll_ch3": 0.49708118811881186, + "disc_nll_ch4": 0.7370643564356436, + "disc_nll_ch5": 0.8465049504950495, + "disc_nll_ch6": 0.058410231023102284, + "disc_nll_ch7": 0.7280028052805281, + "disc_nll_total": 0.4090339933993399, + "terminal_flow": 0.7212168316831683, + "terminal_norm": 0.6618128712871287, + "terminal_packet": 0.9519399339933994 + }, + "mirai-greeth_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5486034653465347, + "disc_nll_ch3": 0.3322876237623762, + "disc_nll_ch4": 0.3821008250825083, + "disc_nll_ch5": 0.5003392739273927, + "disc_nll_ch6": 0.5528278877887789, + "disc_nll_ch7": 0.49624884488448845, + "disc_nll_total": 0.4051397689768977, + "terminal_flow": 0.4460003300330033, + "terminal_norm": 0.3956278877887789, + "terminal_packet": 0.3940376237623762 + }, + "mirai-greip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6000148514851484, + "disc_nll_ch3": 0.34216006600660065, + "disc_nll_ch4": 0.3862333333333333, + "disc_nll_ch5": 0.47221551155115515, + "disc_nll_ch6": 0.6645617161716171, + "disc_nll_ch7": 0.5662834983498349, + "disc_nll_total": 0.5461333333333334, + "terminal_flow": 0.548983498349835, + "terminal_norm": 0.5741574257425742, + "terminal_packet": 0.6437372937293729 + }, + "mirai-udpplain": { + "_n": 303.0, + "disc_nll_ch2": 0.5501311881188119, + "disc_nll_ch3": 0.3581199669966997, + "disc_nll_ch4": 0.45527541254125414, + "disc_nll_ch5": 0.5929519801980199, + "disc_nll_ch6": 0.6072201320132014, + "disc_nll_ch7": 0.608676402640264, + "disc_nll_total": 0.5244315181518151, + "terminal_flow": 0.5821391089108912, + "terminal_norm": 0.5141303630363037, + "terminal_packet": 0.5528582508250824 + }, + "mitm-arpspoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.5536757425742573, + "disc_nll_ch3": 0.2641780528052805, + "disc_nll_ch4": 0.31892590759075906, + "disc_nll_ch5": 0.3853589108910891, + "disc_nll_ch6": 0.6159717821782178, + "disc_nll_ch7": 0.4986511551155115, + "disc_nll_total": 0.4366605610561056, + "terminal_flow": 0.47129851485148516, + "terminal_norm": 0.5170608910891089, + "terminal_packet": 0.5781962046204621 + }, + "recon-hostdiscovery": { + "_n": 303.0, + "disc_nll_ch2": 0.24593498349834983, + "disc_nll_ch3": 0.6681788778877887, + "disc_nll_ch4": 0.5686018151815182, + "disc_nll_ch5": 0.6925914191419141, + "disc_nll_ch6": 0.5074854785478548, + "disc_nll_ch7": 0.7873567656765676, + "disc_nll_total": 0.6838686468646865, + "terminal_flow": 0.9234508250825082, + "terminal_norm": 0.9435465346534655, + "terminal_packet": 0.9458749174917492 + }, + "recon-osscan": { + "_n": 303.0, + "disc_nll_ch2": 0.5050986798679868, + "disc_nll_ch3": 0.6344216171617161, + "disc_nll_ch4": 0.6913618811881188, + "disc_nll_ch5": 0.7414742574257426, + "disc_nll_ch6": 0.38785610561056105, + "disc_nll_ch7": 0.6829196369636963, + "disc_nll_total": 0.6944254125412541, + "terminal_flow": 0.6661854785478548, + "terminal_norm": 0.7069879537953796, + "terminal_packet": 0.7464260726072609 + }, + "recon-pingsweep": { + "_n": 303.0, + "disc_nll_ch2": 0.5568297029702971, + "disc_nll_ch3": 0.36811782178217817, + "disc_nll_ch4": 0.500570297029703, + "disc_nll_ch5": 0.5119056105610561, + "disc_nll_ch6": 0.5623452145214521, + "disc_nll_ch7": 0.529515511551155, + "disc_nll_total": 0.5468778877887789, + "terminal_flow": 0.5660575907590759, + "terminal_norm": 0.5968077557755775, + "terminal_packet": 0.6781077557755776 + }, + "recon-portscan": { + "_n": 303.0, + "disc_nll_ch2": 0.453926897689769, + "disc_nll_ch3": 0.6645272277227723, + "disc_nll_ch4": 0.6845750825082509, + "disc_nll_ch5": 0.7440546204620462, + "disc_nll_ch6": 0.37708844884488446, + "disc_nll_ch7": 0.7077635313531353, + "disc_nll_total": 0.7048377887788779, + "terminal_flow": 0.684593894389439, + "terminal_norm": 0.7248580858085809, + "terminal_packet": 0.7471397689768977 + }, + "sqlinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.5199635313531353, + "disc_nll_ch3": 0.4096298679867987, + "disc_nll_ch4": 0.4920681518151815, + "disc_nll_ch5": 0.45512392739273927, + "disc_nll_ch6": 0.5600064356435643, + "disc_nll_ch7": 0.5344787128712871, + "disc_nll_total": 0.5217047854785478, + "terminal_flow": 0.5111952145214522, + "terminal_norm": 0.5321034653465346, + "terminal_packet": 0.5836031353135314 + }, + "uploading_attack": { + "_n": 303.0, + "disc_nll_ch2": 0.605249504950495, + "disc_nll_ch3": 0.2763699669966997, + "disc_nll_ch4": 0.33508481848184823, + "disc_nll_ch5": 0.32590610561056105, + "disc_nll_ch6": 0.6430084158415842, + "disc_nll_ch7": 0.4817457095709571, + "disc_nll_total": 0.4179219471947194, + "terminal_flow": 0.5126082508250825, + "terminal_norm": 0.5955052805280528, + "terminal_packet": 0.653770297029703 + }, + "vulnerabilityscan": { + "_n": 303.0, + "disc_nll_ch2": 0.4659795379537954, + "disc_nll_ch3": 0.43822970297029706, + "disc_nll_ch4": 0.4864448844884488, + "disc_nll_ch5": 0.5368859735973597, + "disc_nll_ch6": 0.4907785478547855, + "disc_nll_ch7": 0.5477183168316833, + "disc_nll_total": 0.5144234323432344, + "terminal_flow": 0.5222546204620462, + "terminal_norm": 0.5701792079207921, + "terminal_packet": 0.5969620462046205 + }, + "xss": { + "_n": 303.0, + "disc_nll_ch2": 0.5876130363036303, + "disc_nll_ch3": 0.33730808580858085, + "disc_nll_ch4": 0.4315945544554455, + "disc_nll_ch5": 0.45215627062706265, + "disc_nll_ch6": 0.56921798679868, + "disc_nll_ch7": 0.5399214521452145, + "disc_nll_total": 0.451720297029703, + "terminal_flow": 0.5640209570957095, + "terminal_norm": 0.574203300330033, + "terminal_packet": 0.6327694719471946 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_ciciot2023.log b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_ciciot2023.log new file mode 100644 index 0000000..62ca908 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_ciciot2023.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,193,621 target rows +[sample] benign=10,000 attack=9,999 (33 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/9,999 +[score] 5,376/9,999 +[eval] attack done 3.9s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_ciciot2023.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_ciciot2023.npz b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_ciciot2023.npz new file mode 100644 index 0000000..18096f0 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_ciciot2023.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_iscxtor2016.json b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_iscxtor2016.json new file mode 100644 index 0000000..c5036b4 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_iscxtor2016.json @@ -0,0 +1,64 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed42", + "target_store": "None", + "n_benign": 10000, + "n_attack": 1888, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.5139645127118644, + "auprc": 0.1835373503391034 + }, + "disc_nll_ch3": { + "auroc": 0.42797907838983057, + "auprc": 0.1736408121443478 + }, + "disc_nll_ch4": { + "auroc": 0.3449238347457627, + "auprc": 0.18084919586296322 + }, + "disc_nll_ch5": { + "auroc": 0.4298506091101695, + "auprc": 0.17012868101632034 + }, + "disc_nll_ch6": { + "auroc": 0.5693310381355933, + "auprc": 0.22489342648022712 + }, + "disc_nll_ch7": { + "auroc": 0.44667224576271186, + "auprc": 0.27909545283444437 + }, + "disc_nll_total": { + "auroc": 0.4348426377118644, + "auprc": 0.2573307050028939 + }, + "terminal_flow": { + "auroc": 0.5180118644067797, + "auprc": 0.23217254605804535 + }, + "terminal_norm": { + "auroc": 0.4886813559322034, + "auprc": 0.26498404897922684 + }, + "terminal_packet": { + "auroc": 0.4109404661016949, + "auprc": 0.16855973411935288 + } + }, + "per_class": { + "tor": { + "_n": 1888.0, + "disc_nll_ch2": 0.5139645127118644, + "disc_nll_ch3": 0.42797907838983057, + "disc_nll_ch4": 0.3449238347457627, + "disc_nll_ch5": 0.4298506091101695, + "disc_nll_ch6": 0.5693310381355933, + "disc_nll_ch7": 0.44667224576271186, + "disc_nll_total": 0.4348426377118644, + "terminal_flow": 0.5180118644067797, + "terminal_norm": 0.4886813559322034, + "terminal_packet": 0.4109404661016949 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_iscxtor2016.log b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_iscxtor2016.log new file mode 100644 index 0000000..a39d316 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_iscxtor2016.log @@ -0,0 +1,13 @@ +[model] T=64 flow_dim=20 +[data] 103,079 target rows +[sample] benign=10,000 attack=1,888 (1 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/1,888 +[eval] attack done 0.7s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_iscxtor2016.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_iscxtor2016.npz b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_iscxtor2016.npz new file mode 100644 index 0000000..c911364 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed42_cicids2017_to_iscxtor2016.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_ciciot2023_to_iscxtor2016.json b/artifacts/route_comparison/cross/route_ac_combo_seed42_ciciot2023_to_iscxtor2016.json new file mode 100644 index 0000000..8d2ec1f --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_ciciot2023_to_iscxtor2016.json @@ -0,0 +1,64 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42", + "target_store": "None", + "n_benign": 10000, + "n_attack": 1888, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.4523323622881356, + "auprc": 0.14659330715228003 + }, + "disc_nll_ch3": { + "auroc": 0.37170847457627115, + "auprc": 0.1481532685496872 + }, + "disc_nll_ch4": { + "auroc": 0.3088254237288135, + "auprc": 0.10920783570404133 + }, + "disc_nll_ch5": { + "auroc": 0.4749519862288135, + "auprc": 0.14485216324545166 + }, + "disc_nll_ch6": { + "auroc": 0.43323400423728814, + "auprc": 0.14470143110305617 + }, + "disc_nll_ch7": { + "auroc": 0.4187674523305085, + "auprc": 0.215598258972049 + }, + "disc_nll_total": { + "auroc": 0.3089511387711864, + "auprc": 0.12879154735603218 + }, + "terminal_flow": { + "auroc": 0.49545527012711865, + "auprc": 0.2478044692154227 + }, + "terminal_norm": { + "auroc": 0.4543329449152542, + "auprc": 0.17958891737115637 + }, + "terminal_packet": { + "auroc": 0.4668683792372881, + "auprc": 0.2628800695275872 + } + }, + "per_class": { + "tor": { + "_n": 1888.0, + "disc_nll_ch2": 0.4523323622881356, + "disc_nll_ch3": 0.37170847457627115, + "disc_nll_ch4": 0.3088254237288135, + "disc_nll_ch5": 0.4749519862288135, + "disc_nll_ch6": 0.43323400423728814, + "disc_nll_ch7": 0.4187674523305085, + "disc_nll_total": 0.3089511387711864, + "terminal_flow": 0.49545527012711865, + "terminal_norm": 0.4543329449152542, + "terminal_packet": 0.4668683792372881 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_ciciot2023_to_iscxtor2016.log b/artifacts/route_comparison/cross/route_ac_combo_seed42_ciciot2023_to_iscxtor2016.log new file mode 100644 index 0000000..e9add0f --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_ciciot2023_to_iscxtor2016.log @@ -0,0 +1,13 @@ +[model] T=64 flow_dim=20 +[data] 103,079 target rows +[sample] benign=10,000 attack=1,888 (1 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.2s +[eval] attack... +[score] 256/1,888 +[eval] attack done 0.7s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed42_ciciot2023_to_iscxtor2016.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_ciciot2023_to_iscxtor2016.npz b/artifacts/route_comparison/cross/route_ac_combo_seed42_ciciot2023_to_iscxtor2016.npz new file mode 100644 index 0000000..b41dd32 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed42_ciciot2023_to_iscxtor2016.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_ddos2019_to_cicids2017.json b/artifacts/route_comparison/cross/route_ac_combo_seed42_ddos2019_to_cicids2017.json new file mode 100644 index 0000000..0bbd160 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_ddos2019_to_cicids2017.json @@ -0,0 +1,246 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.7631167675723568, + "auprc": 0.7251511572262688 + }, + "disc_nll_ch3": { + "auroc": 0.8493508860011814, + "auprc": 0.784609463409399 + }, + "disc_nll_ch4": { + "auroc": 0.8356486119314827, + "auprc": 0.6701775393875826 + }, + "disc_nll_ch5": { + "auroc": 0.8184920629060839, + "auprc": 0.7834368911065702 + }, + "disc_nll_ch6": { + "auroc": 0.8407140874187832, + "auprc": 0.7192261160654317 + }, + "disc_nll_ch7": { + "auroc": 0.8919865475487301, + "auprc": 0.8782898902191303 + }, + "disc_nll_total": { + "auroc": 0.9027125886001182, + "auprc": 0.8522487223102588 + }, + "terminal_flow": { + "auroc": 0.5197175575900768, + "auprc": 0.5271384882268608 + }, + "terminal_norm": { + "auroc": 0.4939704223272298, + "auprc": 0.3648000347613509 + }, + "terminal_packet": { + "auroc": 0.5588011813349084, + "auprc": 0.40148262671275414 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "disc_nll_ch2": 0.9506804804804804, + "disc_nll_ch3": 0.8092375375375375, + "disc_nll_ch4": 0.7450144144144145, + "disc_nll_ch5": 0.9367656156156157, + "disc_nll_ch6": 0.7807034534534535, + "disc_nll_ch7": 0.9639737237237236, + "disc_nll_total": 0.9016114114114114, + "terminal_flow": 0.20255165165165168, + "terminal_norm": 0.5204579579579579, + "terminal_packet": 0.6972902402402401 + }, + "DDoS": { + "_n": 666.0, + "disc_nll_ch2": 0.9293872372372373, + "disc_nll_ch3": 0.9487150900900901, + "disc_nll_ch4": 0.9345096096096096, + "disc_nll_ch5": 0.9587753753753753, + "disc_nll_ch6": 0.9240036036036036, + "disc_nll_ch7": 0.9852256756756756, + "disc_nll_total": 0.9838090090090091, + "terminal_flow": 0.9745597597597598, + "terminal_norm": 0.7613267267267269, + "terminal_packet": 0.8051451951951952 + }, + "DoS GoldenEye": { + "_n": 666.0, + "disc_nll_ch2": 0.9277058558558559, + "disc_nll_ch3": 0.8674136636636638, + "disc_nll_ch4": 0.868030930930931, + "disc_nll_ch5": 0.8625638888888889, + "disc_nll_ch6": 0.7769394894894895, + "disc_nll_ch7": 0.8855710210210211, + "disc_nll_total": 0.9271478978978979, + "terminal_flow": 0.9779376876876879, + "terminal_norm": 0.6794791291291292, + "terminal_packet": 0.6821129129129129 + }, + "DoS Hulk": { + "_n": 666.0, + "disc_nll_ch2": 0.8896861861861861, + "disc_nll_ch3": 0.8814484984984985, + "disc_nll_ch4": 0.9231214714714714, + "disc_nll_ch5": 0.9541037537537537, + "disc_nll_ch6": 0.8618504504504504, + "disc_nll_ch7": 0.8587177177177178, + "disc_nll_total": 0.953971021021021, + "terminal_flow": 0.8204007507507507, + "terminal_norm": 0.5587735735735735, + "terminal_packet": 0.5998191441441441 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "disc_nll_ch2": 0.7341235735735736, + "disc_nll_ch3": 0.7675741741741742, + "disc_nll_ch4": 0.859774024024024, + "disc_nll_ch5": 0.7227154654654655, + "disc_nll_ch6": 0.8441454954954953, + "disc_nll_ch7": 0.9058845345345345, + "disc_nll_total": 0.829962012012012, + "terminal_flow": 0.6532887387387386, + "terminal_norm": 0.6482274774774774, + "terminal_packet": 0.7034328078078078 + }, + "DoS Slowloris": { + "_n": 666.0, + "disc_nll_ch2": 0.6434027777777779, + "disc_nll_ch3": 0.74529984984985, + "disc_nll_ch4": 0.762989039039039, + "disc_nll_ch5": 0.8971213213213214, + "disc_nll_ch6": 0.9719657657657659, + "disc_nll_ch7": 0.7442328828828829, + "disc_nll_total": 0.8559642642642642, + "terminal_flow": 0.599034984984985, + "terminal_norm": 0.4700373873873874, + "terminal_packet": 0.5513408408408409 + }, + "FTP-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.5975842342342343, + "disc_nll_ch3": 0.8013534534534534, + "disc_nll_ch4": 0.7207869369369369, + "disc_nll_ch5": 0.7856594594594595, + "disc_nll_ch6": 0.9946893393393393, + "disc_nll_ch7": 0.9033726726726727, + "disc_nll_total": 0.8597217717717718, + "terminal_flow": 0.28483303303303303, + "terminal_norm": 0.24989414414414415, + "terminal_packet": 0.37465262762762763 + }, + "Heartbleed": { + "_n": 1.0, + "disc_nll_ch2": 0.4315, + "disc_nll_ch3": 0.6699999999999999, + "disc_nll_ch4": 0.45899999999999996, + "disc_nll_ch5": 0.00019999999999997797, + "disc_nll_ch6": 0.7263999999999999, + "disc_nll_ch7": 0.6678999999999999, + "disc_nll_total": 0.42500000000000004, + "terminal_flow": 0.9996999999999999, + "terminal_norm": 0.2539, + "terminal_packet": 0.27949999999999997 + }, + "Infiltration": { + "_n": 7.0, + "disc_nll_ch2": 0.46727142857142856, + "disc_nll_ch3": 0.6199428571428571, + "disc_nll_ch4": 0.6062428571428571, + "disc_nll_ch5": 0.2856142857142857, + "disc_nll_ch6": 0.9057142857142857, + "disc_nll_ch7": 0.7357142857142858, + "disc_nll_total": 0.6264000000000001, + "terminal_flow": 0.8472285714285713, + "terminal_norm": 0.38589999999999997, + "terminal_packet": 0.43929999999999997 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.36712867867867865, + "disc_nll_ch3": 0.9903127627627629, + "disc_nll_ch4": 0.9496064564564564, + "disc_nll_ch5": 0.9756321321321322, + "disc_nll_ch6": 0.6839686186186187, + "disc_nll_ch7": 0.9851175675675676, + "disc_nll_total": 0.9861528528528529, + "terminal_flow": 0.19158543543543544, + "terminal_norm": 0.38070645645645645, + "terminal_packet": 0.3793738738738739 + }, + "Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.9810096096096096, + "disc_nll_ch3": 0.999601951951952, + "disc_nll_ch4": 0.928913063063063, + "disc_nll_ch5": 0.9935522522522522, + "disc_nll_ch6": 0.6907963963963965, + "disc_nll_ch7": 0.9998734234234234, + "disc_nll_total": 0.9996875375375375, + "terminal_flow": 0.17771306306306306, + "terminal_norm": 0.5521992492492491, + "terminal_packet": 0.6729125375375375 + }, + "SSH-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.6493495495495495, + "disc_nll_ch3": 0.7094885135135135, + "disc_nll_ch4": 0.7127603603603604, + "disc_nll_ch5": 0.21534294294294293, + "disc_nll_ch6": 0.8855735735735736, + "disc_nll_ch7": 0.7183045045045044, + "disc_nll_total": 0.7920903153153154, + "terminal_flow": 0.2399003003003003, + "terminal_norm": 0.15133588588588587, + "terminal_packet": 0.1671111111111111 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "disc_nll_ch2": 0.48136438356164385, + "disc_nll_ch3": 0.6713958904109588, + "disc_nll_ch4": 0.4863095890410959, + "disc_nll_ch5": 0.0075904109589040765, + "disc_nll_ch6": 0.7492383561643835, + "disc_nll_ch7": 0.6698164383561643, + "disc_nll_total": 0.45049452054794514, + "terminal_flow": 0.9912123287671233, + "terminal_norm": 0.2359191780821918, + "terminal_packet": 0.2083123287671233 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "disc_nll_ch2": 0.9851923076923078, + "disc_nll_ch3": 0.8525384615384616, + "disc_nll_ch4": 0.9251538461538461, + "disc_nll_ch5": 0.8451153846153846, + "disc_nll_ch6": 0.7701769230769231, + "disc_nll_ch7": 0.9879461538461539, + "disc_nll_total": 0.9583461538461538, + "terminal_flow": 0.8557846153846154, + "terminal_norm": 0.6686692307692308, + "terminal_packet": 0.6689076923076923 + }, + "Web Attack - XSS": { + "_n": 18.0, + "disc_nll_ch2": 0.4399166666666666, + "disc_nll_ch3": 0.6712777777777779, + "disc_nll_ch4": 0.4841611111111111, + "disc_nll_ch5": 8.333333333333031e-05, + "disc_nll_ch6": 0.9663888888888889, + "disc_nll_ch7": 0.6718222222222222, + "disc_nll_total": 0.4998111111111111, + "terminal_flow": 0.9994944444444445, + "terminal_norm": 0.25855555555555554, + "terminal_packet": 0.2910555555555555 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_ddos2019_to_cicids2017.log b/artifacts/route_comparison/cross/route_ac_combo_seed42_ddos2019_to_cicids2017.log new file mode 100644 index 0000000..0bc4a36 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_ddos2019_to_cicids2017.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 2,025,564 target rows +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.4s +[eval] attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done 3.3s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed42_ddos2019_to_cicids2017.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_ddos2019_to_cicids2017.npz b/artifacts/route_comparison/cross/route_ac_combo_seed42_ddos2019_to_cicids2017.npz new file mode 100644 index 0000000..1c8da6f Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed42_ddos2019_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicddos2019.json b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicddos2019.json new file mode 100644 index 0000000..92cb52e --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicddos2019.json @@ -0,0 +1,272 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.26697793520211255, + "auprc": 0.386471725052149 + }, + "disc_nll_ch3": { + "auroc": 0.6008848314036156, + "auprc": 0.5301761495049552 + }, + "disc_nll_ch4": { + "auroc": 0.13713099735933373, + "auprc": 0.3379346094854223 + }, + "disc_nll_ch5": { + "auroc": 0.13190669307332925, + "auprc": 0.3470955088702549 + }, + "disc_nll_ch6": { + "auroc": 0.15457413162705666, + "auprc": 0.334457746915401 + }, + "disc_nll_ch7": { + "auroc": 0.25698309465772906, + "auprc": 0.404969619125653 + }, + "disc_nll_total": { + "auroc": 0.15461164940077188, + "auprc": 0.35015177513532475 + }, + "terminal_flow": { + "auroc": 0.7352729027016046, + "auprc": 0.6927428683823396 + }, + "terminal_norm": { + "auroc": 0.7733176975421492, + "auprc": 0.7200281167235557 + }, + "terminal_packet": { + "auroc": 0.671538553727402, + "auprc": 0.588550489302696 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "disc_nll_ch2": 0.16000459183673468, + "disc_nll_ch3": 0.6392210884353742, + "disc_nll_ch4": 0.03620425170068027, + "disc_nll_ch5": 0.01588758503401356, + "disc_nll_ch6": 0.1004892857142857, + "disc_nll_ch7": 0.1998770408163265, + "disc_nll_total": 0.0058223639455782135, + "terminal_flow": 0.938059693877551, + "terminal_norm": 0.9429163265306123, + "terminal_packet": 0.8318606292517007 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.16689370748299318, + "disc_nll_ch3": 0.6486413265306122, + "disc_nll_ch4": 0.035330272108843534, + "disc_nll_ch5": 0.014442006802721043, + "disc_nll_ch6": 0.09627959183673467, + "disc_nll_ch7": 0.20678350340136054, + "disc_nll_total": 0.004492517006802703, + "terminal_flow": 0.958566156462585, + "terminal_norm": 0.9515955782312925, + "terminal_packet": 0.8425505102040816 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.12213656462585035, + "disc_nll_ch3": 0.644780612244898, + "disc_nll_ch4": 0.038908673469387756, + "disc_nll_ch5": 0.012599999999999984, + "disc_nll_ch6": 0.05550246598639456, + "disc_nll_ch7": 0.12784302721088436, + "disc_nll_total": 0.004117346938775493, + "terminal_flow": 0.8072595238095238, + "terminal_norm": 0.8689510204081633, + "terminal_packet": 0.7506384353741496 + }, + "DrDoS_NTP": { + "_n": 588.0, + "disc_nll_ch2": 0.2748840136054422, + "disc_nll_ch3": 0.536197619047619, + "disc_nll_ch4": 0.018676530612244894, + "disc_nll_ch5": 0.014643367346938763, + "disc_nll_ch6": 0.06817950680272108, + "disc_nll_ch7": 0.09322534013605441, + "disc_nll_total": 0.07902380952380951, + "terminal_flow": 0.632224574829932, + "terminal_norm": 0.2668100340136054, + "terminal_packet": 0.3721825680272109 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.07644166666666667, + "disc_nll_ch3": 0.5961139455782314, + "disc_nll_ch4": 0.05986037414965988, + "disc_nll_ch5": 0.011922448979591854, + "disc_nll_ch6": 0.01607329931972789, + "disc_nll_ch7": 0.10860646258503404, + "disc_nll_total": 0.0036838435374149823, + "terminal_flow": 0.5722632653061225, + "terminal_norm": 0.8000736394557824, + "terminal_packet": 0.7219151360544217 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "disc_nll_ch2": 0.1609573129251701, + "disc_nll_ch3": 0.6563523809523809, + "disc_nll_ch4": 0.03650867346938775, + "disc_nll_ch5": 0.014264625850340107, + "disc_nll_ch6": 0.08261887755102038, + "disc_nll_ch7": 0.19743554421768705, + "disc_nll_total": 0.0041741496598639285, + "terminal_flow": 0.9449562925170067, + "terminal_norm": 0.9465391156462584, + "terminal_packet": 0.8326884353741497 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "disc_nll_ch2": 0.3287181972789116, + "disc_nll_ch3": 0.484783843537415, + "disc_nll_ch4": 0.024794217687074835, + "disc_nll_ch5": 0.013171768707482979, + "disc_nll_ch6": 0.29383418367346936, + "disc_nll_ch7": 0.11220867346938776, + "disc_nll_total": 0.09636887755102039, + "terminal_flow": 0.6042369047619047, + "terminal_norm": 0.6192967687074831, + "terminal_packet": 0.4601418367346939 + }, + "DrDoS_UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.3281113945578231, + "disc_nll_ch3": 0.4799756802721088, + "disc_nll_ch4": 0.024889285714285718, + "disc_nll_ch5": 0.01311836734693876, + "disc_nll_ch6": 0.29624634353741497, + "disc_nll_ch7": 0.11028112244897958, + "disc_nll_total": 0.08172312925170068, + "terminal_flow": 0.5942591836734693, + "terminal_norm": 0.6217977891156463, + "terminal_packet": 0.45507074829931976 + }, + "LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.17108435374149658, + "disc_nll_ch3": 0.654497619047619, + "disc_nll_ch4": 0.03701326530612245, + "disc_nll_ch5": 0.016134863945578184, + "disc_nll_ch6": 0.09366003401360543, + "disc_nll_ch7": 0.21710935374149656, + "disc_nll_total": 0.005639795918367329, + "terminal_flow": 0.9651894557823129, + "terminal_norm": 0.9576755102040816, + "terminal_packet": 0.8515624149659864 + }, + "MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.11896870748299321, + "disc_nll_ch3": 0.6416091836734694, + "disc_nll_ch4": 0.038873809523809526, + "disc_nll_ch5": 0.012506292517006785, + "disc_nll_ch6": 0.05384931972789116, + "disc_nll_ch7": 0.12658384353741495, + "disc_nll_total": 0.004716156462585017, + "terminal_flow": 0.7836794217687075, + "terminal_norm": 0.860454761904762, + "terminal_packet": 0.7486414965986395 + }, + "NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.07564761904761906, + "disc_nll_ch3": 0.5786163265306123, + "disc_nll_ch4": 0.05841819727891158, + "disc_nll_ch5": 0.012016666666666679, + "disc_nll_ch6": 0.018720068027210882, + "disc_nll_ch7": 0.10798248299319729, + "disc_nll_total": 0.0036052721088435484, + "terminal_flow": 0.5743268707482994, + "terminal_norm": 0.7859731292517007, + "terminal_packet": 0.723932993197279 + }, + "Portmap": { + "_n": 588.0, + "disc_nll_ch2": 0.07876343537414968, + "disc_nll_ch3": 0.5875767006802721, + "disc_nll_ch4": 0.06269761904761907, + "disc_nll_ch5": 0.015253571428571444, + "disc_nll_ch6": 0.01902397959183673, + "disc_nll_ch7": 0.11103010204081634, + "disc_nll_total": 0.0066028911564625994, + "terminal_flow": 0.5852085034013605, + "terminal_norm": 0.809801700680272, + "terminal_packet": 0.7274809523809523 + }, + "Syn": { + "_n": 588.0, + "disc_nll_ch2": 0.8902078231292516, + "disc_nll_ch3": 0.8877270408163265, + "disc_nll_ch4": 0.6418503401360544, + "disc_nll_ch5": 0.889321343537415, + "disc_nll_ch6": 0.22505323129251703, + "disc_nll_ch7": 0.9500530612244897, + "disc_nll_total": 0.8620267006802721, + "terminal_flow": 0.7762721088435376, + "terminal_norm": 0.8455670068027212, + "terminal_packet": 0.7932760204081633 + }, + "TFTP": { + "_n": 588.0, + "disc_nll_ch2": 0.09947772108843538, + "disc_nll_ch3": 0.4370916666666667, + "disc_nll_ch4": 0.023136054421768703, + "disc_nll_ch5": 0.01921258503401357, + "disc_nll_ch6": 0.3452079931972789, + "disc_nll_ch7": 0.1133168367346939, + "disc_nll_total": 0.00909183673469387, + "terminal_flow": 0.6775909863945577, + "terminal_norm": 0.6824952380952382, + "terminal_packet": 0.45481904761904757 + }, + "UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.3372630952380953, + "disc_nll_ch3": 0.46311479591836735, + "disc_nll_ch4": 0.023418197278911573, + "disc_nll_ch5": 0.013182142857142842, + "disc_nll_ch6": 0.315678231292517, + "disc_nll_ch7": 0.10931547619047619, + "disc_nll_total": 0.08748129251700679, + "terminal_flow": 0.5878436224489796, + "terminal_norm": 0.6021802721088435, + "terminal_packet": 0.435177380952381 + }, + "UDPLag": { + "_n": 588.0, + "disc_nll_ch2": 0.8186294217687073, + "disc_nll_ch3": 0.8603091836734693, + "disc_nll_ch4": 0.5795519557823128, + "disc_nll_ch5": 0.787211224489796, + "disc_nll_ch6": 0.20183027210884358, + "disc_nll_ch7": 0.8641409863945578, + "disc_nll_total": 0.7811200680272109, + "terminal_flow": 0.8134249149659863, + "terminal_norm": 0.8442404761904762, + "terminal_packet": 0.763503231292517 + }, + "WebDDoS": { + "_n": 438.0, + "disc_nll_ch2": 0.35216723744292233, + "disc_nll_ch3": 0.35594965753424657, + "disc_nll_ch4": 0.7465624429223745, + "disc_nll_ch5": 0.44821609589041095, + "disc_nll_ch6": 0.4109037671232877, + "disc_nll_ch7": 0.7348158675799087, + "disc_nll_total": 0.7373711187214613, + "terminal_flow": 0.6668138127853882, + "terminal_norm": 0.7286334474885846, + "terminal_packet": 0.6435817351598173 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicddos2019.log b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicddos2019.log new file mode 100644 index 0000000..22f399e --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicddos2019.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,993,376 target rows +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 3.8s +[eval] attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done 3.5s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicddos2019.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicddos2019.npz new file mode 100644 index 0000000..0962e7c Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicids2017.json b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicids2017.json new file mode 100644 index 0000000..9ea70ab --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicids2017.json @@ -0,0 +1,246 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.6697628174837567, + "auprc": 0.6037531294101238 + }, + "disc_nll_ch3": { + "auroc": 0.44465369167158886, + "auprc": 0.5215862714263062 + }, + "disc_nll_ch4": { + "auroc": 0.8099404607206144, + "auprc": 0.6880675257994993 + }, + "disc_nll_ch5": { + "auroc": 0.7961041568222091, + "auprc": 0.7860350893117019 + }, + "disc_nll_ch6": { + "auroc": 0.6877858092144123, + "auprc": 0.5636716742762364 + }, + "disc_nll_ch7": { + "auroc": 0.5075357649143533, + "auprc": 0.5823602891771492 + }, + "disc_nll_total": { + "auroc": 0.8774349379799171, + "auprc": 0.7991268613922091 + }, + "terminal_flow": { + "auroc": 0.7748536695215594, + "auprc": 0.7237200359248883 + }, + "terminal_norm": { + "auroc": 0.7125397445363261, + "auprc": 0.6151240384020317 + }, + "terminal_packet": { + "auroc": 0.6864979400472534, + "auprc": 0.5622340975288656 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "disc_nll_ch2": 0.13567927927927928, + "disc_nll_ch3": 0.1848243243243243, + "disc_nll_ch4": 0.9507105105105105, + "disc_nll_ch5": 0.8608133633633633, + "disc_nll_ch6": 0.7146024024024024, + "disc_nll_ch7": 0.24858063063063063, + "disc_nll_total": 0.6406072072072072, + "terminal_flow": 0.6147868618618619, + "terminal_norm": 0.4651198198198198, + "terminal_packet": 0.48167732732732726 + }, + "DDoS": { + "_n": 666.0, + "disc_nll_ch2": 0.4440881381381382, + "disc_nll_ch3": 0.25373318318318316, + "disc_nll_ch4": 0.9729498498498499, + "disc_nll_ch5": 0.9580869369369369, + "disc_nll_ch6": 0.804543018018018, + "disc_nll_ch7": 0.22551891891891893, + "disc_nll_total": 0.8812621621621621, + "terminal_flow": 0.9622165915915917, + "terminal_norm": 0.8928114114114115, + "terminal_packet": 0.8748516516516516 + }, + "DoS GoldenEye": { + "_n": 666.0, + "disc_nll_ch2": 0.723345045045045, + "disc_nll_ch3": 0.29212372372372375, + "disc_nll_ch4": 0.7847108108108108, + "disc_nll_ch5": 0.9004997747747747, + "disc_nll_ch6": 0.8063376126126126, + "disc_nll_ch7": 0.3143241741741742, + "disc_nll_total": 0.7972195195195196, + "terminal_flow": 0.9013061561561562, + "terminal_norm": 0.8672477477477477, + "terminal_packet": 0.8660385885885885 + }, + "DoS Hulk": { + "_n": 666.0, + "disc_nll_ch2": 0.40809309309309305, + "disc_nll_ch3": 0.32736861861861866, + "disc_nll_ch4": 0.9720202702702704, + "disc_nll_ch5": 0.9446474474474474, + "disc_nll_ch6": 0.7982761261261262, + "disc_nll_ch7": 0.3089918918918919, + "disc_nll_total": 0.9119337837837839, + "terminal_flow": 0.9577381381381381, + "terminal_norm": 0.9292252252252252, + "terminal_packet": 0.919906906906907 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "disc_nll_ch2": 0.6033337837837838, + "disc_nll_ch3": 0.5109876876876878, + "disc_nll_ch4": 0.8713141141141141, + "disc_nll_ch5": 0.8795087087087087, + "disc_nll_ch6": 0.8225411411411412, + "disc_nll_ch7": 0.4714111111111111, + "disc_nll_total": 0.8285094594594594, + "terminal_flow": 0.9487057057057056, + "terminal_norm": 0.9190916666666666, + "terminal_packet": 0.9062807807807808 + }, + "DoS Slowloris": { + "_n": 666.0, + "disc_nll_ch2": 0.7521096096096096, + "disc_nll_ch3": 0.7522753753753755, + "disc_nll_ch4": 0.7123576576576576, + "disc_nll_ch5": 0.8677666666666666, + "disc_nll_ch6": 0.8434825825825826, + "disc_nll_ch7": 0.8909866366366366, + "disc_nll_total": 0.9637265015015016, + "terminal_flow": 0.8184031531531532, + "terminal_norm": 0.7738181681681682, + "terminal_packet": 0.7560409159159159 + }, + "FTP-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.9382036036036037, + "disc_nll_ch3": 0.17935390390390388, + "disc_nll_ch4": 0.7941252252252252, + "disc_nll_ch5": 0.7045043543543544, + "disc_nll_ch6": 0.9365761261261261, + "disc_nll_ch7": 0.6828636636636636, + "disc_nll_total": 0.9593977477477478, + "terminal_flow": 0.6007556306306308, + "terminal_norm": 0.323494069069069, + "terminal_packet": 0.48101066066066067 + }, + "Heartbleed": { + "_n": 1.0, + "disc_nll_ch2": 0.05010000000000003, + "disc_nll_ch3": 0.1724, + "disc_nll_ch4": 0.03590000000000004, + "disc_nll_ch5": 0.0968, + "disc_nll_ch6": 0.7474, + "disc_nll_ch7": 0.020000000000000018, + "disc_nll_total": 0.016199999999999992, + "terminal_flow": 0.9579000000000001, + "terminal_norm": 0.8717999999999999, + "terminal_packet": 0.885 + }, + "Infiltration": { + "_n": 7.0, + "disc_nll_ch2": 0.7419714285714285, + "disc_nll_ch3": 0.2120714285714286, + "disc_nll_ch4": 0.14945714285714284, + "disc_nll_ch5": 0.30634285714285714, + "disc_nll_ch6": 0.8898285714285714, + "disc_nll_ch7": 0.18672857142857144, + "disc_nll_total": 0.8387857142857142, + "terminal_flow": 0.7986, + "terminal_norm": 0.42004285714285716, + "terminal_packet": 0.5113857142857143 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.971237087087087, + "disc_nll_ch3": 0.9914118618618619, + "disc_nll_ch4": 0.7106962462462463, + "disc_nll_ch5": 0.9571618618618618, + "disc_nll_ch6": 0.14733153153153153, + "disc_nll_ch7": 0.9921241741741743, + "disc_nll_total": 0.9911659159159159, + "terminal_flow": 0.9695361861861863, + "terminal_norm": 0.9343947447447447, + "terminal_packet": 0.5321213213213213 + }, + "Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.8516801801801803, + "disc_nll_ch3": 0.9861812312312312, + "disc_nll_ch4": 0.7016803303303304, + "disc_nll_ch5": 0.996901951951952, + "disc_nll_ch6": 0.11162192192192193, + "disc_nll_ch7": 0.9809887387387388, + "disc_nll_total": 0.9926642642642644, + "terminal_flow": 0.770966966966967, + "terminal_norm": 0.933822972972973, + "terminal_packet": 0.7636330330330331 + }, + "SSH-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.837506156156156, + "disc_nll_ch3": 0.03482702702702703, + "disc_nll_ch4": 0.7437684684684684, + "disc_nll_ch5": 0.004322822822822788, + "disc_nll_ch6": 0.8470732732732733, + "disc_nll_ch7": 0.03778288288288287, + "disc_nll_total": 0.8013262012012012, + "terminal_flow": 0.1882702702702703, + "terminal_norm": 0.13860022522522525, + "terminal_packet": 0.3070683183183183 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "disc_nll_ch2": 0.948531506849315, + "disc_nll_ch3": 0.011569863013698653, + "disc_nll_ch4": 0.011080821917808199, + "disc_nll_ch5": 0.0010301369863013172, + "disc_nll_ch6": 0.9888493150684932, + "disc_nll_ch7": 0.00912191780821918, + "disc_nll_total": 0.957558904109589, + "terminal_flow": 0.8872657534246575, + "terminal_norm": 0.3254602739726027, + "terminal_packet": 0.4920958904109589 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "disc_nll_ch2": 0.36360000000000003, + "disc_nll_ch3": 0.2066692307692308, + "disc_nll_ch4": 0.9442230769230769, + "disc_nll_ch5": 0.8816307692307692, + "disc_nll_ch6": 0.7846, + "disc_nll_ch7": 0.20009230769230768, + "disc_nll_total": 0.7184307692307692, + "terminal_flow": 0.6971076923076923, + "terminal_norm": 0.8390461538461539, + "terminal_packet": 0.8541615384615384 + }, + "Web Attack - XSS": { + "_n": 18.0, + "disc_nll_ch2": 0.9636944444444445, + "disc_nll_ch3": 0.01614999999999998, + "disc_nll_ch4": 0.0002666666666666373, + "disc_nll_ch5": 0.0007388888888889186, + "disc_nll_ch6": 0.9974777777777778, + "disc_nll_ch7": 0.008805555555555573, + "disc_nll_total": 0.9720555555555555, + "terminal_flow": 0.9421944444444444, + "terminal_norm": 0.36343888888888887, + "terminal_packet": 0.5358333333333333 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicids2017.log b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicids2017.log new file mode 100644 index 0000000..b373915 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicids2017.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 2,025,564 target rows +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done 2.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicids2017.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicids2017.npz b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicids2017.npz new file mode 100644 index 0000000..fb6c705 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_ciciot2023.json b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_ciciot2023.json new file mode 100644 index 0000000..36ce24a --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_ciciot2023.json @@ -0,0 +1,480 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "n_benign": 10000, + "n_attack": 9999, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.3901115911591159, + "auprc": 0.4231568203666986 + }, + "disc_nll_ch3": { + "auroc": 0.5035800530053005, + "auprc": 0.6028376190901892 + }, + "disc_nll_ch4": { + "auroc": 0.4812163516351635, + "auprc": 0.5117951551756599 + }, + "disc_nll_ch5": { + "auroc": 0.5826128562856285, + "auprc": 0.6349432149256158 + }, + "disc_nll_ch6": { + "auroc": 0.48116510151015107, + "auprc": 0.515261493008504 + }, + "disc_nll_ch7": { + "auroc": 0.5425933143314331, + "auprc": 0.5529235014489244 + }, + "disc_nll_total": { + "auroc": 0.6039043604360437, + "auprc": 0.6835153842223873 + }, + "terminal_flow": { + "auroc": 0.7013291529152915, + "auprc": 0.7154324172045603 + }, + "terminal_norm": { + "auroc": 0.6006159465946594, + "auprc": 0.5854050914840994 + }, + "terminal_packet": { + "auroc": 0.5764771577157716, + "auprc": 0.600696222565558 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 303.0, + "disc_nll_ch2": 0.5383803630363037, + "disc_nll_ch3": 0.5084405940594059, + "disc_nll_ch4": 0.38714026402640267, + "disc_nll_ch5": 0.4008549504950495, + "disc_nll_ch6": 0.5075178217821782, + "disc_nll_ch7": 0.4264856435643564, + "disc_nll_total": 0.4222688118811881, + "terminal_flow": 0.5709181518151816, + "terminal_norm": 0.48123498349834976, + "terminal_packet": 0.5023863036303631 + }, + "browserhijacking": { + "_n": 303.0, + "disc_nll_ch2": 0.5578485148514851, + "disc_nll_ch3": 0.4932189768976898, + "disc_nll_ch4": 0.404290099009901, + "disc_nll_ch5": 0.38647293729372934, + "disc_nll_ch6": 0.41572557755775574, + "disc_nll_ch7": 0.42901419141914193, + "disc_nll_total": 0.4489402640264027, + "terminal_flow": 0.5518795379537954, + "terminal_norm": 0.4696374587458746, + "terminal_packet": 0.4826080858085808 + }, + "commandinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.4868574257425743, + "disc_nll_ch3": 0.48276518151815184, + "disc_nll_ch4": 0.3385019801980198, + "disc_nll_ch5": 0.33941831683168316, + "disc_nll_ch6": 0.44118531353135315, + "disc_nll_ch7": 0.4535547854785479, + "disc_nll_total": 0.3553224422442244, + "terminal_flow": 0.5744612211221122, + "terminal_norm": 0.45016864686468655, + "terminal_packet": 0.44022475247524756 + }, + "ddos-ack_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.09982425742574258, + "disc_nll_ch3": 0.061690594059405975, + "disc_nll_ch4": 0.3593836633663366, + "disc_nll_ch5": 0.8102523102310231, + "disc_nll_ch6": 0.6771430693069307, + "disc_nll_ch7": 0.8669552805280527, + "disc_nll_total": 0.9408364686468648, + "terminal_flow": 0.9889011551155116, + "terminal_norm": 0.9715632013201321, + "terminal_packet": 0.5809635313531353 + }, + "ddos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.4358514851485148, + "disc_nll_ch3": 0.7685382838283827, + "disc_nll_ch4": 0.6486475247524752, + "disc_nll_ch5": 0.9212947194719472, + "disc_nll_ch6": 0.6805062706270626, + "disc_nll_ch7": 0.7227433993399339, + "disc_nll_total": 0.9276387788778878, + "terminal_flow": 0.7942993399339935, + "terminal_norm": 0.7665544554455446, + "terminal_packet": 0.891630198019802 + }, + "ddos-icmp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5399224422442244, + "disc_nll_ch3": 0.5631993399339934, + "disc_nll_ch4": 0.5305019801980199, + "disc_nll_ch5": 0.5871404290429043, + "disc_nll_ch6": 0.49251782178217823, + "disc_nll_ch7": 0.4982513201320131, + "disc_nll_total": 0.570919306930693, + "terminal_flow": 0.578124587458746, + "terminal_norm": 0.5421270627062706, + "terminal_packet": 0.5554222772277227 + }, + "ddos-icmp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.5078359735973597, + "disc_nll_ch3": 0.4998575907590759, + "disc_nll_ch4": 0.45479125412541255, + "disc_nll_ch5": 0.4960410891089109, + "disc_nll_ch6": 0.43765099009900993, + "disc_nll_ch7": 0.49096996699669965, + "disc_nll_total": 0.47594950495049504, + "terminal_flow": 0.6269526402640264, + "terminal_norm": 0.5355615511551155, + "terminal_packet": 0.5369564356435644 + }, + "ddos-pshack_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.07795115511551154, + "disc_nll_ch3": 0.057330033003300335, + "disc_nll_ch4": 0.5656927392739274, + "disc_nll_ch5": 0.603970297029703, + "disc_nll_ch6": 0.999763696369637, + "disc_nll_ch7": 0.9536996699669966, + "disc_nll_total": 0.9940049504950494, + "terminal_flow": 0.7679191419141914, + "terminal_norm": 0.6046643564356435, + "terminal_packet": 0.4418805280528052 + }, + "ddos-rstfinflood": { + "_n": 303.0, + "disc_nll_ch2": 0.2158, + "disc_nll_ch3": 0.02210000000000001, + "disc_nll_ch4": 0.9944, + "disc_nll_ch5": 0.987, + "disc_nll_ch6": 0.48750000000000004, + "disc_nll_ch7": 0.7486, + "disc_nll_total": 0.9978, + "terminal_flow": 0.9954999999999998, + "terminal_norm": 0.7464999999999999, + "terminal_packet": 0.4989 + }, + "ddos-slowloris": { + "_n": 303.0, + "disc_nll_ch2": 0.5664039603960397, + "disc_nll_ch3": 0.553090594059406, + "disc_nll_ch4": 0.6680196369636964, + "disc_nll_ch5": 0.8873564356435645, + "disc_nll_ch6": 0.7114486798679868, + "disc_nll_ch7": 0.5210429042904291, + "disc_nll_total": 0.8314511551155116, + "terminal_flow": 0.6171366336633662, + "terminal_norm": 0.6530227722772277, + "terminal_packet": 0.6329524752475248 + }, + "ddos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.10506534653465346, + "disc_nll_ch3": 0.9949831683168316, + "disc_nll_ch4": 0.5385145214521452, + "disc_nll_ch5": 0.6675092409240924, + "disc_nll_ch6": 0.47654620462046204, + "disc_nll_ch7": 0.3121861386138614, + "disc_nll_total": 0.9602069306930692, + "terminal_flow": 0.9499069306930694, + "terminal_norm": 0.7315478547854786, + "terminal_packet": 0.9445693069306931 + }, + "ddos-synonymousip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.06344653465346534, + "disc_nll_ch3": 0.9957108910891088, + "disc_nll_ch4": 0.538947194719472, + "disc_nll_ch5": 0.5434772277227723, + "disc_nll_ch6": 0.5319376237623763, + "disc_nll_ch7": 0.7313402640264026, + "disc_nll_total": 0.9693577557755775, + "terminal_flow": 0.9970917491749176, + "terminal_norm": 0.7354082508250824, + "terminal_packet": 0.39417755775577556 + }, + "ddos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.0007165016501650164, + "disc_nll_ch3": 0.019516501650165035, + "disc_nll_ch4": 0.5223673267326733, + "disc_nll_ch5": 0.552580198019802, + "disc_nll_ch6": 0.39609801980198023, + "disc_nll_ch7": 0.2222392739273928, + "disc_nll_total": 0.0013313531353135316, + "terminal_flow": 0.7249760726072607, + "terminal_norm": 0.6813658415841584, + "terminal_packet": 0.507280198019802 + }, + "ddos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.34222541254125416, + "disc_nll_ch3": 0.33639504950495047, + "disc_nll_ch4": 0.188526402640264, + "disc_nll_ch5": 0.29250709570957095, + "disc_nll_ch6": 0.18884521452145211, + "disc_nll_ch7": 0.34331584158415845, + "disc_nll_total": 0.16567194719471945, + "terminal_flow": 0.838147194719472, + "terminal_norm": 0.6363914191419142, + "terminal_packet": 0.8056300330033004 + }, + "ddos-udp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.49534999999999996, + "disc_nll_ch3": 0.5134427392739274, + "disc_nll_ch4": 0.41408234323432347, + "disc_nll_ch5": 0.4292153465346535, + "disc_nll_ch6": 0.5466143564356435, + "disc_nll_ch7": 0.48772161716171614, + "disc_nll_total": 0.518406600660066, + "terminal_flow": 0.6600285478547856, + "terminal_norm": 0.4839991749174918, + "terminal_packet": 0.5043216171617162 + }, + "dictionarybruteforce": { + "_n": 303.0, + "disc_nll_ch2": 0.4925750825082508, + "disc_nll_ch3": 0.4942577557755776, + "disc_nll_ch4": 0.5211247524752476, + "disc_nll_ch5": 0.5411996699669968, + "disc_nll_ch6": 0.5474019801980198, + "disc_nll_ch7": 0.4256364686468647, + "disc_nll_total": 0.5372894389438945, + "terminal_flow": 0.629183498349835, + "terminal_norm": 0.55011699669967, + "terminal_packet": 0.5906069306930694 + }, + "dns_spoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.4168714521452145, + "disc_nll_ch3": 0.4581371287128713, + "disc_nll_ch4": 0.39244125412541253, + "disc_nll_ch5": 0.3904321782178218, + "disc_nll_ch6": 0.4321412541254125, + "disc_nll_ch7": 0.41027392739273927, + "disc_nll_total": 0.3435902640264027, + "terminal_flow": 0.579197194719472, + "terminal_norm": 0.5758716171617162, + "terminal_packet": 0.5810443894389439 + }, + "dos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.3471953795379538, + "disc_nll_ch3": 0.5830234323432343, + "disc_nll_ch4": 0.5368052805280528, + "disc_nll_ch5": 0.9495815181518151, + "disc_nll_ch6": 0.604980198019802, + "disc_nll_ch7": 0.6147861386138614, + "disc_nll_total": 0.9369633663366337, + "terminal_flow": 0.8390349834983498, + "terminal_norm": 0.8148864686468649, + "terminal_packet": 0.826639603960396 + }, + "dos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6070498349834984, + "disc_nll_ch3": 0.9953762376237624, + "disc_nll_ch4": 0.5460290429042904, + "disc_nll_ch5": 0.9298815181518152, + "disc_nll_ch6": 0.4492858085808581, + "disc_nll_ch7": 0.7052851485148515, + "disc_nll_total": 0.9644722772277228, + "terminal_flow": 0.8780882838283829, + "terminal_norm": 0.7317221122112211, + "terminal_packet": 0.9119016501650166 + }, + "dos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6370143564356436, + "disc_nll_ch3": 0.16756996699669965, + "disc_nll_ch4": 0.5232455445544555, + "disc_nll_ch5": 0.9190600660066006, + "disc_nll_ch6": 0.15313333333333334, + "disc_nll_ch7": 0.6975907590759076, + "disc_nll_total": 0.6898188118811882, + "terminal_flow": 0.7076712871287129, + "terminal_norm": 0.632928712871287, + "terminal_packet": 0.6639592409240924 + }, + "dos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.01683102310231022, + "disc_nll_ch3": 0.24307920792079207, + "disc_nll_ch4": 0.04262211221122117, + "disc_nll_ch5": 0.02497557755775575, + "disc_nll_ch6": 0.060849174917491755, + "disc_nll_ch7": 0.23348910891089109, + "disc_nll_total": 0.014648844884488438, + "terminal_flow": 0.6535412541254124, + "terminal_norm": 0.39445247524752475, + "terminal_packet": 0.4615260726072608 + }, + "mirai-greeth_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5350587458745875, + "disc_nll_ch3": 0.5200222772277228, + "disc_nll_ch4": 0.32539257425742574, + "disc_nll_ch5": 0.37201798679867987, + "disc_nll_ch6": 0.43490660066006603, + "disc_nll_ch7": 0.4375722772277228, + "disc_nll_total": 0.3918136963696369, + "terminal_flow": 0.4247985148514851, + "terminal_norm": 0.3576953795379538, + "terminal_packet": 0.36030891089108913 + }, + "mirai-greip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5874696369636965, + "disc_nll_ch3": 0.6046580858085808, + "disc_nll_ch4": 0.41256353135313534, + "disc_nll_ch5": 0.5313455445544555, + "disc_nll_ch6": 0.4892255775577558, + "disc_nll_ch7": 0.5229227722772276, + "disc_nll_total": 0.5661049504950495, + "terminal_flow": 0.619217491749175, + "terminal_norm": 0.5253681518151815, + "terminal_packet": 0.540512211221122 + }, + "mirai-udpplain": { + "_n": 303.0, + "disc_nll_ch2": 0.5567447194719471, + "disc_nll_ch3": 0.5848879537953795, + "disc_nll_ch4": 0.3692658415841584, + "disc_nll_ch5": 0.5336815181518152, + "disc_nll_ch6": 0.5135787128712872, + "disc_nll_ch7": 0.49223762376237623, + "disc_nll_total": 0.5601462046204622, + "terminal_flow": 0.5760285478547855, + "terminal_norm": 0.48512805280528054, + "terminal_packet": 0.5118009900990099 + }, + "mitm-arpspoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.5439542904290429, + "disc_nll_ch3": 0.4997958745874588, + "disc_nll_ch4": 0.4042836633663366, + "disc_nll_ch5": 0.4384244224422442, + "disc_nll_ch6": 0.36530462046204626, + "disc_nll_ch7": 0.4489767326732674, + "disc_nll_total": 0.462556600660066, + "terminal_flow": 0.6299437293729373, + "terminal_norm": 0.5130145214521452, + "terminal_packet": 0.5082138613861386 + }, + "recon-hostdiscovery": { + "_n": 303.0, + "disc_nll_ch2": 0.13317161716171613, + "disc_nll_ch3": 0.7717105610561056, + "disc_nll_ch4": 0.7047607260726072, + "disc_nll_ch5": 0.8314636963696369, + "disc_nll_ch6": 0.48956023102310237, + "disc_nll_ch7": 0.7920966996699671, + "disc_nll_total": 0.9415204620462045, + "terminal_flow": 0.9478409240924093, + "terminal_norm": 0.7671140264026403, + "terminal_packet": 0.5674943894389438 + }, + "recon-osscan": { + "_n": 303.0, + "disc_nll_ch2": 0.3425042904290429, + "disc_nll_ch3": 0.7824201320132012, + "disc_nll_ch4": 0.6524160066006601, + "disc_nll_ch5": 0.8021775577557755, + "disc_nll_ch6": 0.5092962046204621, + "disc_nll_ch7": 0.6810640264026404, + "disc_nll_total": 0.8361749174917492, + "terminal_flow": 0.7401590759075909, + "terminal_norm": 0.6974633663366336, + "terminal_packet": 0.6511465346534653 + }, + "recon-pingsweep": { + "_n": 303.0, + "disc_nll_ch2": 0.4524935643564357, + "disc_nll_ch3": 0.33564785478547854, + "disc_nll_ch4": 0.47838762376237626, + "disc_nll_ch5": 0.4560767326732673, + "disc_nll_ch6": 0.5489696369636964, + "disc_nll_ch7": 0.5397463696369638, + "disc_nll_total": 0.43652755775577556, + "terminal_flow": 0.542003300330033, + "terminal_norm": 0.530610396039604, + "terminal_packet": 0.5410189768976897 + }, + "recon-portscan": { + "_n": 303.0, + "disc_nll_ch2": 0.28534686468646864, + "disc_nll_ch3": 0.8077189768976898, + "disc_nll_ch4": 0.6703618811881188, + "disc_nll_ch5": 0.8273848184818482, + "disc_nll_ch6": 0.4682424092409241, + "disc_nll_ch7": 0.6994782178217821, + "disc_nll_total": 0.8567409240924092, + "terminal_flow": 0.7797328382838282, + "terminal_norm": 0.7106666666666667, + "terminal_packet": 0.588797689768977 + }, + "sqlinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.4975325082508251, + "disc_nll_ch3": 0.40339587458745874, + "disc_nll_ch4": 0.5437328382838283, + "disc_nll_ch5": 0.5115935643564357, + "disc_nll_ch6": 0.5126694719471947, + "disc_nll_ch7": 0.5127427392739274, + "disc_nll_total": 0.5125836633663367, + "terminal_flow": 0.5910011551155115, + "terminal_norm": 0.555617491749175, + "terminal_packet": 0.562767491749175 + }, + "uploading_attack": { + "_n": 303.0, + "disc_nll_ch2": 0.5009244224422442, + "disc_nll_ch3": 0.5049557755775578, + "disc_nll_ch4": 0.3028866336633663, + "disc_nll_ch5": 0.3170894389438944, + "disc_nll_ch6": 0.4054331683168316, + "disc_nll_ch7": 0.42633696369636964, + "disc_nll_total": 0.35189488448844886, + "terminal_flow": 0.5886716171617161, + "terminal_norm": 0.4443270627062707, + "terminal_packet": 0.442942904290429 + }, + "vulnerabilityscan": { + "_n": 303.0, + "disc_nll_ch2": 0.39803069306930694, + "disc_nll_ch3": 0.5178257425742574, + "disc_nll_ch4": 0.5299298679867988, + "disc_nll_ch5": 0.5710404290429043, + "disc_nll_ch6": 0.43995775577557755, + "disc_nll_ch7": 0.5827394389438944, + "disc_nll_total": 0.5385260726072607, + "terminal_flow": 0.5993051155115512, + "terminal_norm": 0.5730833333333334, + "terminal_packet": 0.5267026402640265 + }, + "xss": { + "_n": 303.0, + "disc_nll_ch2": 0.48943465346534654, + "disc_nll_ch3": 0.47337937293729376, + "disc_nll_ch4": 0.37008349834983495, + "disc_nll_ch5": 0.37370742574257426, + "disc_nll_ch6": 0.4625115511551155, + "disc_nll_ch7": 0.4744836633663366, + "disc_nll_total": 0.4073646864686469, + "terminal_flow": 0.5822003300330033, + "terminal_norm": 0.4705123762376238, + "terminal_packet": 0.46645841584158415 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_ciciot2023.log b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_ciciot2023.log new file mode 100644 index 0000000..4dda5da --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_ciciot2023.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,193,621 target rows +[sample] benign=10,000 attack=9,999 (33 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 3.9s +[eval] attack... +[score] 256/9,999 +[score] 5,376/9,999 +[eval] attack done 3.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_ciciot2023.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_ciciot2023.npz b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_ciciot2023.npz new file mode 100644 index 0000000..77c50e9 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed42_iscxtor2016_to_ciciot2023.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicddos2019.json b/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicddos2019.json new file mode 100644 index 0000000..6d41277 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicddos2019.json @@ -0,0 +1,272 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.13773376498070283, + "auprc": 0.33246020722810277 + }, + "disc_nll_ch3": { + "auroc": 0.2566629037172456, + "auprc": 0.43816485570377955 + }, + "disc_nll_ch4": { + "auroc": 0.44094586126345725, + "auprc": 0.44507643326485746 + }, + "disc_nll_ch5": { + "auroc": 0.3121427280113752, + "auprc": 0.38649650132990054 + }, + "disc_nll_ch6": { + "auroc": 0.46373937639650614, + "auprc": 0.4352579507246834 + }, + "disc_nll_ch7": { + "auroc": 0.8451114056469633, + "auprc": 0.8114691467351702 + }, + "disc_nll_total": { + "auroc": 0.3810986644322568, + "auprc": 0.4732628651475579 + }, + "terminal_flow": { + "auroc": 0.8293319520617508, + "auprc": 0.7210232445576071 + }, + "terminal_norm": { + "auroc": 0.8279692565508835, + "auprc": 0.7722944777194009 + }, + "terminal_packet": { + "auroc": 0.651144246394475, + "auprc": 0.6720430853494497 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "disc_nll_ch2": 0.0456784013605442, + "disc_nll_ch3": 0.006307312925170093, + "disc_nll_ch4": 0.4000396258503401, + "disc_nll_ch5": 0.10203375850340134, + "disc_nll_ch6": 0.4696389455782312, + "disc_nll_ch7": 0.9366820578231292, + "disc_nll_total": 0.3645448979591837, + "terminal_flow": 0.9090392857142857, + "terminal_norm": 0.9552019557823129, + "terminal_packet": 0.9295192176870749 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.04568741496598637, + "disc_nll_ch3": 0.002148129251700712, + "disc_nll_ch4": 0.39922210884353737, + "disc_nll_ch5": 0.08352261904761903, + "disc_nll_ch6": 0.4703768707482993, + "disc_nll_ch7": 0.940506462585034, + "disc_nll_total": 0.368997619047619, + "terminal_flow": 0.9145622448979592, + "terminal_norm": 0.9593284013605441, + "terminal_packet": 0.9545954081632654 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.04561224489795919, + "disc_nll_ch3": 0.00284846938775513, + "disc_nll_ch4": 0.4169576530612245, + "disc_nll_ch5": 0.3063803571428571, + "disc_nll_ch6": 0.47369353741496595, + "disc_nll_ch7": 0.9222522108843536, + "disc_nll_total": 0.356302380952381, + "terminal_flow": 0.8628936224489796, + "terminal_norm": 0.9132841836734695, + "terminal_packet": 0.6628022108843538 + }, + "DrDoS_NTP": { + "_n": 588.0, + "disc_nll_ch2": 0.04605527210884353, + "disc_nll_ch3": 0.35086955782312923, + "disc_nll_ch4": 0.1990062925170068, + "disc_nll_ch5": 0.04296734693877551, + "disc_nll_ch6": 0.2418829931972789, + "disc_nll_ch7": 0.5688734693877551, + "disc_nll_total": 0.05173911564625849, + "terminal_flow": 0.894080612244898, + "terminal_norm": 0.38019387755102046, + "terminal_packet": 0.40805731292517006 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.04497874149659868, + "disc_nll_ch3": 0.29936003401360545, + "disc_nll_ch4": 0.4478464285714286, + "disc_nll_ch5": 0.4830052721088436, + "disc_nll_ch6": 0.47091870748299325, + "disc_nll_ch7": 0.9101113945578231, + "disc_nll_total": 0.3557688775510204, + "terminal_flow": 0.7293037414965987, + "terminal_norm": 0.8150073129251701, + "terminal_packet": 0.4901568027210884 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "disc_nll_ch2": 0.045762585034013585, + "disc_nll_ch3": 0.014989455782312967, + "disc_nll_ch4": 0.4013190476190477, + "disc_nll_ch5": 0.10395867346938777, + "disc_nll_ch6": 0.47178435374149663, + "disc_nll_ch7": 0.943042006802721, + "disc_nll_total": 0.3744079931972789, + "terminal_flow": 0.9022530612244898, + "terminal_norm": 0.9512988095238095, + "terminal_packet": 0.9189518707482995 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "disc_nll_ch2": 0.045170748299319746, + "disc_nll_ch3": 0.1759175170068027, + "disc_nll_ch4": 0.2764841836734694, + "disc_nll_ch5": 0.22587746598639455, + "disc_nll_ch6": 0.4110127551020408, + "disc_nll_ch7": 0.7048736394557823, + "disc_nll_total": 0.19455051020408162, + "terminal_flow": 0.7988042517006801, + "terminal_norm": 0.7359632653061224, + "terminal_packet": 0.42772040816326534 + }, + "DrDoS_UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.04518435374149662, + "disc_nll_ch3": 0.17758860544217686, + "disc_nll_ch4": 0.2726566326530613, + "disc_nll_ch5": 0.23286071428571428, + "disc_nll_ch6": 0.4110920068027211, + "disc_nll_ch7": 0.7011207482993198, + "disc_nll_total": 0.19074727891156465, + "terminal_flow": 0.7957243197278911, + "terminal_norm": 0.737586224489796, + "terminal_packet": 0.412308843537415 + }, + "LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.04670408163265304, + "disc_nll_ch3": 0.0033931972789115993, + "disc_nll_ch4": 0.4022637755102041, + "disc_nll_ch5": 0.08555272108843534, + "disc_nll_ch6": 0.47173979591836734, + "disc_nll_ch7": 0.9415731292517007, + "disc_nll_total": 0.3713037414965986, + "terminal_flow": 0.9153773809523809, + "terminal_norm": 0.9594527210884353, + "terminal_packet": 0.9626494897959184 + }, + "MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.04563656462585034, + "disc_nll_ch3": 0.002317176870748323, + "disc_nll_ch4": 0.4164331632653061, + "disc_nll_ch5": 0.3132568027210884, + "disc_nll_ch6": 0.4732022108843537, + "disc_nll_ch7": 0.9202904761904762, + "disc_nll_total": 0.3549465986394558, + "terminal_flow": 0.8606178571428572, + "terminal_norm": 0.9117809523809524, + "terminal_packet": 0.6459573129251701 + }, + "NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.04506054421768711, + "disc_nll_ch3": 0.27788996598639454, + "disc_nll_ch4": 0.4454751700680272, + "disc_nll_ch5": 0.4701180272108844, + "disc_nll_ch6": 0.46812227891156466, + "disc_nll_ch7": 0.8983647959183674, + "disc_nll_total": 0.34520850340136056, + "terminal_flow": 0.7348926870748299, + "terminal_norm": 0.8187222789115647, + "terminal_packet": 0.4893474489795918 + }, + "Portmap": { + "_n": 588.0, + "disc_nll_ch2": 0.04723894557823134, + "disc_nll_ch3": 0.3068923469387755, + "disc_nll_ch4": 0.44659846938775516, + "disc_nll_ch5": 0.47137891156462586, + "disc_nll_ch6": 0.47003435374149666, + "disc_nll_ch7": 0.8987369047619047, + "disc_nll_total": 0.34668078231292515, + "terminal_flow": 0.734654081632653, + "terminal_norm": 0.8197711734693878, + "terminal_packet": 0.4998224489795919 + }, + "Syn": { + "_n": 588.0, + "disc_nll_ch2": 0.6429061224489796, + "disc_nll_ch3": 0.9915889455782312, + "disc_nll_ch4": 0.8476649659863945, + "disc_nll_ch5": 0.7525108843537416, + "disc_nll_ch6": 0.6163153061224489, + "disc_nll_ch7": 0.987996088435374, + "disc_nll_total": 0.9757675170068026, + "terminal_flow": 0.8746268707482994, + "terminal_norm": 0.9408197278911564, + "terminal_packet": 0.9907081632653062 + }, + "TFTP": { + "_n": 588.0, + "disc_nll_ch2": 0.050435544217687055, + "disc_nll_ch3": 0.19675731292517004, + "disc_nll_ch4": 0.3707197278911565, + "disc_nll_ch5": 0.17853639455782314, + "disc_nll_ch6": 0.40992602040816317, + "disc_nll_ch7": 0.7057253401360544, + "disc_nll_total": 0.1697668367346939, + "terminal_flow": 0.8845964285714286, + "terminal_norm": 0.8861962585034014, + "terminal_packet": 0.5336595238095238 + }, + "UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.045235204081632674, + "disc_nll_ch3": 0.187447619047619, + "disc_nll_ch4": 0.26232329931972787, + "disc_nll_ch5": 0.21677193877551018, + "disc_nll_ch6": 0.40460034013605445, + "disc_nll_ch7": 0.6817964285714284, + "disc_nll_total": 0.17473639455782314, + "terminal_flow": 0.7957765306122448, + "terminal_norm": 0.7269409863945577, + "terminal_packet": 0.4069664965986394 + }, + "UDPLag": { + "_n": 588.0, + "disc_nll_ch2": 0.5348872448979591, + "disc_nll_ch3": 0.8991826530612245, + "disc_nll_ch4": 0.7815799319727892, + "disc_nll_ch5": 0.6629341836734695, + "disc_nll_ch6": 0.5352431972789116, + "disc_nll_ch7": 0.9563937074829931, + "disc_nll_total": 0.8552183673469388, + "terminal_flow": 0.871037755102041, + "terminal_norm": 0.9219110544217688, + "terminal_packet": 0.9320627551020408 + }, + "WebDDoS": { + "_n": 438.0, + "disc_nll_ch2": 0.649892808219178, + "disc_nll_ch3": 0.5400683789954338, + "disc_nll_ch4": 0.8014560502283105, + "disc_nll_ch5": 0.6646978310502283, + "disc_nll_ch6": 0.6654399543378995, + "disc_nll_ch7": 0.7154877853881279, + "disc_nll_total": 0.7125416666666669, + "terminal_flow": 0.5488512557077626, + "terminal_norm": 0.578336301369863, + "terminal_packet": 0.31958504566210044 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicddos2019.log b/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicddos2019.log new file mode 100644 index 0000000..dc16fe3 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicddos2019.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,993,376 target rows +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done 3.8s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicddos2019.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicddos2019.npz new file mode 100644 index 0000000..5776563 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicids2017.json b/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicids2017.json new file mode 100644 index 0000000..7514b79 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicids2017.json @@ -0,0 +1,246 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.7653773774365031, + "auprc": 0.6610315918347411 + }, + "disc_nll_ch3": { + "auroc": 0.8649343916125221, + "auprc": 0.7641882959335763 + }, + "disc_nll_ch4": { + "auroc": 0.8665730212640284, + "auprc": 0.7215478783456724 + }, + "disc_nll_ch5": { + "auroc": 0.6935601594802125, + "auprc": 0.706589558633818 + }, + "disc_nll_ch6": { + "auroc": 0.8674970835794448, + "auprc": 0.7308561048475939 + }, + "disc_nll_ch7": { + "auroc": 0.7288713673951566, + "auprc": 0.6942480347438885 + }, + "disc_nll_total": { + "auroc": 0.919377953337271, + "auprc": 0.8531211983773009 + }, + "terminal_flow": { + "auroc": 0.8935553307737744, + "auprc": 0.7651943548753243 + }, + "terminal_norm": { + "auroc": 0.7892756497341995, + "auprc": 0.74210922791045 + }, + "terminal_packet": { + "auroc": 0.7970304562906083, + "auprc": 0.7288507060249393 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "disc_nll_ch2": 0.9403043543543543, + "disc_nll_ch3": 0.9202057057057056, + "disc_nll_ch4": 0.917292942942943, + "disc_nll_ch5": 0.746285885885886, + "disc_nll_ch6": 0.8428334834834834, + "disc_nll_ch7": 0.4010627627627628, + "disc_nll_total": 0.9353554054054054, + "terminal_flow": 0.7595509759759761, + "terminal_norm": 0.9391274774774774, + "terminal_packet": 0.9585982732732732 + }, + "DDoS": { + "_n": 666.0, + "disc_nll_ch2": 0.951678078078078, + "disc_nll_ch3": 0.8542369369369369, + "disc_nll_ch4": 0.931527027027027, + "disc_nll_ch5": 0.897583033033033, + "disc_nll_ch6": 0.9389897897897898, + "disc_nll_ch7": 0.8463621621621621, + "disc_nll_total": 0.9676557057057058, + "terminal_flow": 0.9707683183183183, + "terminal_norm": 0.9741382882882882, + "terminal_packet": 0.9498872372372372 + }, + "DoS GoldenEye": { + "_n": 666.0, + "disc_nll_ch2": 0.8308449699699699, + "disc_nll_ch3": 0.8206887387387388, + "disc_nll_ch4": 0.9081298798798799, + "disc_nll_ch5": 0.5422632132132132, + "disc_nll_ch6": 0.7728881381381383, + "disc_nll_ch7": 0.7389927927927928, + "disc_nll_total": 0.8661456456456457, + "terminal_flow": 0.9654069069069068, + "terminal_norm": 0.9159285285285285, + "terminal_packet": 0.8733337837837838 + }, + "DoS Hulk": { + "_n": 666.0, + "disc_nll_ch2": 0.8580858858858859, + "disc_nll_ch3": 0.8285400900900901, + "disc_nll_ch4": 0.9253490990990991, + "disc_nll_ch5": 0.813105930930931, + "disc_nll_ch6": 0.8777602102102102, + "disc_nll_ch7": 0.6891414414414416, + "disc_nll_total": 0.9443944444444444, + "terminal_flow": 0.953708108108108, + "terminal_norm": 0.8559322822822822, + "terminal_packet": 0.8119652402402402 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "disc_nll_ch2": 0.7370732732732733, + "disc_nll_ch3": 0.87571006006006, + "disc_nll_ch4": 0.8731145645645645, + "disc_nll_ch5": 0.48620803303303306, + "disc_nll_ch6": 0.8543942942942945, + "disc_nll_ch7": 0.7538674174174174, + "disc_nll_total": 0.8855743243243244, + "terminal_flow": 0.8914558558558558, + "terminal_norm": 0.906598198198198, + "terminal_packet": 0.9133337837837838 + }, + "DoS Slowloris": { + "_n": 666.0, + "disc_nll_ch2": 0.5938012012012011, + "disc_nll_ch3": 0.8371917417417417, + "disc_nll_ch4": 0.7745509009009008, + "disc_nll_ch5": 0.9267579579579579, + "disc_nll_ch6": 0.8295117117117117, + "disc_nll_ch7": 0.9161632132132131, + "disc_nll_total": 0.8067542042042041, + "terminal_flow": 0.8006965465465464, + "terminal_norm": 0.7411641141141141, + "terminal_packet": 0.7436302552552554 + }, + "FTP-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.9466200450450449, + "disc_nll_ch3": 0.8302656156156156, + "disc_nll_ch4": 0.7644445945945947, + "disc_nll_ch5": 0.6386132132132132, + "disc_nll_ch6": 0.9804397897897899, + "disc_nll_ch7": 0.6512406906906907, + "disc_nll_total": 0.9398653153153153, + "terminal_flow": 0.870445045045045, + "terminal_norm": 0.39733798798798803, + "terminal_packet": 0.46531186186186185 + }, + "Heartbleed": { + "_n": 1.0, + "disc_nll_ch2": 0.44689999999999996, + "disc_nll_ch3": 0.6944, + "disc_nll_ch4": 0.6731, + "disc_nll_ch5": 0.16720000000000002, + "disc_nll_ch6": 0.8464, + "disc_nll_ch7": 0.09409999999999996, + "disc_nll_total": 0.6199, + "terminal_flow": 0.9941, + "terminal_norm": 0.5768, + "terminal_packet": 0.39339999999999997 + }, + "Infiltration": { + "_n": 7.0, + "disc_nll_ch2": 0.7675571428571428, + "disc_nll_ch3": 0.7569428571428571, + "disc_nll_ch4": 0.5554, + "disc_nll_ch5": 0.34457142857142853, + "disc_nll_ch6": 0.9885285714285714, + "disc_nll_ch7": 0.29888571428571425, + "disc_nll_total": 0.9162571428571429, + "terminal_flow": 0.9548857142857142, + "terminal_norm": 0.8154428571428571, + "terminal_packet": 0.7858714285714286 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.4027528528528528, + "disc_nll_ch3": 0.995399099099099, + "disc_nll_ch4": 0.9536569069069069, + "disc_nll_ch5": 0.9730330330330331, + "disc_nll_ch6": 0.8409579579579579, + "disc_nll_ch7": 0.9952792792792792, + "disc_nll_total": 0.9952138138138136, + "terminal_flow": 0.9420027027027026, + "terminal_norm": 0.9915499999999999, + "terminal_packet": 0.9820009009009009 + }, + "Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.40945540540540537, + "disc_nll_ch3": 0.9993247747747748, + "disc_nll_ch4": 0.9263624624624625, + "disc_nll_ch5": 0.9939426426426425, + "disc_nll_ch6": 0.8807962462462463, + "disc_nll_ch7": 0.9924948948948947, + "disc_nll_total": 0.9971154654654655, + "terminal_flow": 0.9031519519519519, + "terminal_norm": 0.9914291291291292, + "terminal_packet": 0.9914753753753754 + }, + "SSH-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.9836656156156156, + "disc_nll_ch3": 0.7117768768768769, + "disc_nll_ch4": 0.7346938438438438, + "disc_nll_ch5": 0.00608678678678678, + "disc_nll_ch6": 0.8686641891891892, + "disc_nll_ch7": 0.4039848348348348, + "disc_nll_total": 0.8913641141141141, + "terminal_flow": 0.8630948198198198, + "terminal_norm": 0.21957342342342343, + "terminal_packet": 0.3419016516516517 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "disc_nll_ch2": 0.8062863013698631, + "disc_nll_ch3": 0.700958904109589, + "disc_nll_ch4": 0.5512643835616438, + "disc_nll_ch5": 0.12131232876712328, + "disc_nll_ch6": 0.7793712328767123, + "disc_nll_ch7": 0.03944109589041096, + "disc_nll_total": 0.6696041095890412, + "terminal_flow": 0.9911424657534246, + "terminal_norm": 0.4679260273972603, + "terminal_packet": 0.3346315068493151 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "disc_nll_ch2": 0.8865615384615385, + "disc_nll_ch3": 0.8569846153846155, + "disc_nll_ch4": 0.9600615384615384, + "disc_nll_ch5": 0.3988769230769231, + "disc_nll_ch6": 0.7209692307692308, + "disc_nll_ch7": 0.6337923076923078, + "disc_nll_total": 0.9251923076923078, + "terminal_flow": 0.9492, + "terminal_norm": 0.9200846153846154, + "terminal_packet": 0.8658461538461538 + }, + "Web Attack - XSS": { + "_n": 18.0, + "disc_nll_ch2": 0.51, + "disc_nll_ch3": 0.6993166666666666, + "disc_nll_ch4": 0.604061111111111, + "disc_nll_ch5": 0.1258388888888889, + "disc_nll_ch6": 0.8310222222222222, + "disc_nll_ch7": 0.10063888888888889, + "disc_nll_total": 0.6266222222222222, + "terminal_flow": 0.9932277777777777, + "terminal_norm": 0.5188333333333333, + "terminal_packet": 0.38742777777777776 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicids2017.log b/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicids2017.log new file mode 100644 index 0000000..b285428 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicids2017.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 2,025,564 target rows +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done 2.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicids2017.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicids2017.npz b/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicids2017.npz new file mode 100644 index 0000000..e3d27b6 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed42_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_ciciot2023.json b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_ciciot2023.json new file mode 100644 index 0000000..b678163 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_ciciot2023.json @@ -0,0 +1,480 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "n_benign": 10000, + "n_attack": 9999, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.4623707170717072, + "auprc": 0.5253990960023647 + }, + "disc_nll_ch3": { + "auroc": 0.5835972197219722, + "auprc": 0.596943905941165 + }, + "disc_nll_ch4": { + "auroc": 0.45894187918791884, + "auprc": 0.4749604892192844 + }, + "disc_nll_ch5": { + "auroc": 0.6795915641564156, + "auprc": 0.7265676826724896 + }, + "disc_nll_ch6": { + "auroc": 0.5058578207820782, + "auprc": 0.5532177566637527 + }, + "disc_nll_ch7": { + "auroc": 0.6808032153215321, + "auprc": 0.7394217738090997 + }, + "disc_nll_total": { + "auroc": 0.5900982648264828, + "auprc": 0.6741552474403649 + }, + "terminal_flow": { + "auroc": 0.58387399239924, + "auprc": 0.5930587806684774 + }, + "terminal_norm": { + "auroc": 0.5561699869986998, + "auprc": 0.5571882872045524 + }, + "terminal_packet": { + "auroc": 0.575361896189619, + "auprc": 0.6571882125581762 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 303.0, + "disc_nll_ch2": 0.5471526402640263, + "disc_nll_ch3": 0.5549551155115511, + "disc_nll_ch4": 0.3871206270627063, + "disc_nll_ch5": 0.5008734323432343, + "disc_nll_ch6": 0.5037782178217821, + "disc_nll_ch7": 0.5851605610561055, + "disc_nll_total": 0.485253300330033, + "terminal_flow": 0.5210171617161716, + "terminal_norm": 0.4416118811881188, + "terminal_packet": 0.5346503300330032 + }, + "browserhijacking": { + "_n": 303.0, + "disc_nll_ch2": 0.5339176567656766, + "disc_nll_ch3": 0.5406988448844885, + "disc_nll_ch4": 0.3874983498349835, + "disc_nll_ch5": 0.4450277227722772, + "disc_nll_ch6": 0.4608282178217822, + "disc_nll_ch7": 0.56071600660066, + "disc_nll_total": 0.46807013201320136, + "terminal_flow": 0.5570712871287129, + "terminal_norm": 0.4793957095709571, + "terminal_packet": 0.5288777227722772 + }, + "commandinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.53761699669967, + "disc_nll_ch3": 0.5209783828382839, + "disc_nll_ch4": 0.3515607260726073, + "disc_nll_ch5": 0.4408778877887789, + "disc_nll_ch6": 0.4698820132013201, + "disc_nll_ch7": 0.48837029702970297, + "disc_nll_total": 0.4356689768976898, + "terminal_flow": 0.5272993399339935, + "terminal_norm": 0.4629325082508251, + "terminal_packet": 0.5180085808580859 + }, + "ddos-ack_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.26203283828382834, + "disc_nll_ch3": 0.06376683168316831, + "disc_nll_ch4": 0.4953803630363036, + "disc_nll_ch5": 0.289964191419142, + "disc_nll_ch6": 0.8834513201320133, + "disc_nll_ch7": 0.281523597359736, + "disc_nll_total": 0.4704265676567657, + "terminal_flow": 0.8908117161716171, + "terminal_norm": 0.9017902640264027, + "terminal_packet": 0.2764552805280528 + }, + "ddos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5591676567656767, + "disc_nll_ch3": 0.7343224422442245, + "disc_nll_ch4": 0.5334041254125413, + "disc_nll_ch5": 0.917806600660066, + "disc_nll_ch6": 0.5697273927392739, + "disc_nll_ch7": 0.9259328382838283, + "disc_nll_total": 0.8906915841584158, + "terminal_flow": 0.6381056105610561, + "terminal_norm": 0.6689376237623763, + "terminal_packet": 0.7130361386138613 + }, + "ddos-icmp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.46894273927392743, + "disc_nll_ch3": 0.4886458745874588, + "disc_nll_ch4": 0.459943399339934, + "disc_nll_ch5": 0.5196244224422442, + "disc_nll_ch6": 0.4575980198019802, + "disc_nll_ch7": 0.5439985148514852, + "disc_nll_total": 0.5120186468646865, + "terminal_flow": 0.5002600660066007, + "terminal_norm": 0.45623679867986805, + "terminal_packet": 0.463116501650165 + }, + "ddos-icmp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.4830993399339934, + "disc_nll_ch3": 0.48843316831683165, + "disc_nll_ch4": 0.3924483498349835, + "disc_nll_ch5": 0.5694826732673268, + "disc_nll_ch6": 0.4628572607260726, + "disc_nll_ch7": 0.5716529702970297, + "disc_nll_total": 0.4906397689768977, + "terminal_flow": 0.4959280528052805, + "terminal_norm": 0.45193267326732667, + "terminal_packet": 0.4800156765676568 + }, + "ddos-pshack_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.2573828382838284, + "disc_nll_ch3": 0.6423036303630363, + "disc_nll_ch4": 0.5683148514851486, + "disc_nll_ch5": 0.9485524752475247, + "disc_nll_ch6": 0.9999943894389439, + "disc_nll_ch7": 0.8235986798679868, + "disc_nll_total": 0.9902135313531353, + "terminal_flow": 0.5744590759075907, + "terminal_norm": 0.6383544554455446, + "terminal_packet": 0.8052290429042904 + }, + "ddos-rstfinflood": { + "_n": 303.0, + "disc_nll_ch2": 0.2177, + "disc_nll_ch3": 0.6547000000000001, + "disc_nll_ch4": 0.9863, + "disc_nll_ch5": 0.9997, + "disc_nll_ch6": 0.5082, + "disc_nll_ch7": 0.9999, + "disc_nll_total": 1.0, + "terminal_flow": 0.4669, + "terminal_norm": 0.3248, + "terminal_packet": 0.0011999999999999789 + }, + "ddos-slowloris": { + "_n": 303.0, + "disc_nll_ch2": 0.4675232673267327, + "disc_nll_ch3": 0.543744389438944, + "disc_nll_ch4": 0.5309102310231023, + "disc_nll_ch5": 0.8733600660066008, + "disc_nll_ch6": 0.7535331683168318, + "disc_nll_ch7": 0.7202775577557756, + "disc_nll_total": 0.8483270627062707, + "terminal_flow": 0.33175247524752477, + "terminal_norm": 0.30314009900990097, + "terminal_packet": 0.3848620462046205 + }, + "ddos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.3032221122112212, + "disc_nll_ch3": 0.9086877887788778, + "disc_nll_ch4": 0.49157722772277224, + "disc_nll_ch5": 0.9245557755775579, + "disc_nll_ch6": 0.45294488448844883, + "disc_nll_ch7": 0.7857379537953795, + "disc_nll_total": 0.405996699669967, + "terminal_flow": 0.6679029702970296, + "terminal_norm": 0.8201376237623762, + "terminal_packet": 0.9835006600660066 + }, + "ddos-synonymousip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.3345019801980198, + "disc_nll_ch3": 0.7499069306930692, + "disc_nll_ch4": 0.49277062706270625, + "disc_nll_ch5": 0.9042689768976898, + "disc_nll_ch6": 0.006646864686468648, + "disc_nll_ch7": 0.9883485148514851, + "disc_nll_total": 0.3515323432343235, + "terminal_flow": 0.9957092409240924, + "terminal_norm": 0.8451590759075907, + "terminal_packet": 0.9902470297029704 + }, + "ddos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.23229339933993398, + "disc_nll_ch3": 0.7642630363036303, + "disc_nll_ch4": 0.500213201320132, + "disc_nll_ch5": 0.9028003300330033, + "disc_nll_ch6": 0.49620726072607263, + "disc_nll_ch7": 0.9580405940594059, + "disc_nll_total": 0.28501947194719474, + "terminal_flow": 0.6372790429042905, + "terminal_norm": 0.8135153465346534, + "terminal_packet": 0.9884039603960395 + }, + "ddos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.4353656765676568, + "disc_nll_ch3": 0.3929072607260728, + "disc_nll_ch4": 0.17551518151815182, + "disc_nll_ch5": 0.6318108910891089, + "disc_nll_ch6": 0.45229537953795373, + "disc_nll_ch7": 0.20477887788778876, + "disc_nll_total": 0.391996699669967, + "terminal_flow": 0.8613115511551155, + "terminal_norm": 0.3248019801980198, + "terminal_packet": 0.4324361386138614 + }, + "ddos-udp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.4664476897689769, + "disc_nll_ch3": 0.4722539603960396, + "disc_nll_ch4": 0.3421803630363036, + "disc_nll_ch5": 0.5073995049504951, + "disc_nll_ch6": 0.52221600660066, + "disc_nll_ch7": 0.6305133663366336, + "disc_nll_total": 0.5523242574257425, + "terminal_flow": 0.6681988448844884, + "terminal_norm": 0.5151795379537953, + "terminal_packet": 0.4954252475247525 + }, + "dictionarybruteforce": { + "_n": 303.0, + "disc_nll_ch2": 0.5747412541254125, + "disc_nll_ch3": 0.5668151815181519, + "disc_nll_ch4": 0.4703387788778878, + "disc_nll_ch5": 0.5140138613861386, + "disc_nll_ch6": 0.5552353135313532, + "disc_nll_ch7": 0.63741699669967, + "disc_nll_total": 0.5805331683168317, + "terminal_flow": 0.4839237623762377, + "terminal_norm": 0.4300785478547855, + "terminal_packet": 0.4729265676567656 + }, + "dns_spoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.424296204620462, + "disc_nll_ch3": 0.4348567656765677, + "disc_nll_ch4": 0.4493214521452145, + "disc_nll_ch5": 0.6111473597359736, + "disc_nll_ch6": 0.490776402640264, + "disc_nll_ch7": 0.6822803630363036, + "disc_nll_total": 0.42800577557755776, + "terminal_flow": 0.5180485148514852, + "terminal_norm": 0.5147777227722772, + "terminal_packet": 0.5021770627062707 + }, + "dos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5684475247524752, + "disc_nll_ch3": 0.4969214521452145, + "disc_nll_ch4": 0.5442227722772277, + "disc_nll_ch5": 0.926453795379538, + "disc_nll_ch6": 0.5764468646864687, + "disc_nll_ch7": 0.8907201320132012, + "disc_nll_total": 0.9128676567656767, + "terminal_flow": 0.5923247524752475, + "terminal_norm": 0.6089186468646866, + "terminal_packet": 0.5808264026402641 + }, + "dos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.3997963696369637, + "disc_nll_ch3": 0.8340696369636964, + "disc_nll_ch4": 0.47471782178217825, + "disc_nll_ch5": 0.9551689768976899, + "disc_nll_ch6": 0.3265158415841584, + "disc_nll_ch7": 0.9160458745874588, + "disc_nll_total": 0.6222089108910891, + "terminal_flow": 0.6620036303630362, + "terminal_norm": 0.7126549504950495, + "terminal_packet": 0.956991419141914 + }, + "dos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5092798679867987, + "disc_nll_ch3": 0.7558735973597359, + "disc_nll_ch4": 0.4959755775577558, + "disc_nll_ch5": 0.9591260726072608, + "disc_nll_ch6": 0.4215089108910891, + "disc_nll_ch7": 0.9750141914191419, + "disc_nll_total": 0.723139603960396, + "terminal_flow": 0.6327270627062705, + "terminal_norm": 0.7112171617161716, + "terminal_packet": 0.9299973597359736 + }, + "dos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.32430066006600655, + "disc_nll_ch3": 0.7443874587458745, + "disc_nll_ch4": 0.49364521452145216, + "disc_nll_ch5": 0.9511630363036303, + "disc_nll_ch6": 0.41649471947194716, + "disc_nll_ch7": 0.751285808580858, + "disc_nll_total": 0.06792706270627061, + "terminal_flow": 0.6938118811881188, + "terminal_norm": 0.8931848184818482, + "terminal_packet": 0.9968607260726072 + }, + "mirai-greeth_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6048478547854785, + "disc_nll_ch3": 0.5094432343234323, + "disc_nll_ch4": 0.28625330033003304, + "disc_nll_ch5": 0.46282145214521453, + "disc_nll_ch6": 0.41941963696369633, + "disc_nll_ch7": 0.5088438943894389, + "disc_nll_total": 0.5307828382838283, + "terminal_flow": 0.6610981848184818, + "terminal_norm": 0.5677278877887789, + "terminal_packet": 0.5950115511551155 + }, + "mirai-greip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5551275577557756, + "disc_nll_ch3": 0.5081188118811881, + "disc_nll_ch4": 0.3329831683168317, + "disc_nll_ch5": 0.5631450495049505, + "disc_nll_ch6": 0.4771755775577558, + "disc_nll_ch7": 0.5468462046204621, + "disc_nll_total": 0.5860498349834984, + "terminal_flow": 0.5331133663366336, + "terminal_norm": 0.48926930693069304, + "terminal_packet": 0.5501082508250825 + }, + "mirai-udpplain": { + "_n": 303.0, + "disc_nll_ch2": 0.5206113861386139, + "disc_nll_ch3": 0.5642424092409242, + "disc_nll_ch4": 0.30110742574257426, + "disc_nll_ch5": 0.6040891089108911, + "disc_nll_ch6": 0.4656252475247525, + "disc_nll_ch7": 0.5836681518151815, + "disc_nll_total": 0.5685767326732674, + "terminal_flow": 0.6638618811881188, + "terminal_norm": 0.5478653465346535, + "terminal_packet": 0.5467770627062706 + }, + "mitm-arpspoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.5733508250825082, + "disc_nll_ch3": 0.42755759075907596, + "disc_nll_ch4": 0.3971420792079208, + "disc_nll_ch5": 0.4721552805280528, + "disc_nll_ch6": 0.47253993399339933, + "disc_nll_ch7": 0.5763810231023102, + "disc_nll_total": 0.5188696369636965, + "terminal_flow": 0.5368597359735974, + "terminal_norm": 0.49046320132013205, + "terminal_packet": 0.49373811881188123 + }, + "recon-hostdiscovery": { + "_n": 303.0, + "disc_nll_ch2": 0.12554158415841585, + "disc_nll_ch3": 0.7312877887788779, + "disc_nll_ch4": 0.6155699669966997, + "disc_nll_ch5": 0.8035562706270627, + "disc_nll_ch6": 0.5006320132013201, + "disc_nll_ch7": 0.9013557755775577, + "disc_nll_total": 0.9624151815181519, + "terminal_flow": 0.364526402640264, + "terminal_norm": 0.39465082508250815, + "terminal_packet": 0.12736270627062707 + }, + "recon-osscan": { + "_n": 303.0, + "disc_nll_ch2": 0.608090099009901, + "disc_nll_ch3": 0.806591089108911, + "disc_nll_ch4": 0.4999148514851485, + "disc_nll_ch5": 0.7938864686468646, + "disc_nll_ch6": 0.523637293729373, + "disc_nll_ch7": 0.8645917491749174, + "disc_nll_total": 0.8820821782178218, + "terminal_flow": 0.5779059405940593, + "terminal_norm": 0.5928867986798679, + "terminal_packet": 0.5481201320132013 + }, + "recon-pingsweep": { + "_n": 303.0, + "disc_nll_ch2": 0.6028760726072606, + "disc_nll_ch3": 0.49403382838283827, + "disc_nll_ch4": 0.43863019801980196, + "disc_nll_ch5": 0.5099009900990099, + "disc_nll_ch6": 0.567300495049505, + "disc_nll_ch7": 0.5187608910891089, + "disc_nll_total": 0.6019503300330034, + "terminal_flow": 0.5004194719471947, + "terminal_norm": 0.4864397689768977, + "terminal_packet": 0.5422074257425743 + }, + "recon-portscan": { + "_n": 303.0, + "disc_nll_ch2": 0.5578305280528053, + "disc_nll_ch3": 0.81381699669967, + "disc_nll_ch4": 0.5300623762376238, + "disc_nll_ch5": 0.8315277227722773, + "disc_nll_ch6": 0.5048985148514851, + "disc_nll_ch7": 0.8536198019801979, + "disc_nll_total": 0.8658046204620462, + "terminal_flow": 0.5138575907590758, + "terminal_norm": 0.5467645214521452, + "terminal_packet": 0.5056405940594059 + }, + "sqlinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.5390090759075907, + "disc_nll_ch3": 0.46817277227722764, + "disc_nll_ch4": 0.5136308580858086, + "disc_nll_ch5": 0.5939382838283829, + "disc_nll_ch6": 0.5398513201320132, + "disc_nll_ch7": 0.5418259075907591, + "disc_nll_total": 0.5419377887788779, + "terminal_flow": 0.4364252475247524, + "terminal_norm": 0.43754587458745875, + "terminal_packet": 0.44275841584158415 + }, + "uploading_attack": { + "_n": 303.0, + "disc_nll_ch2": 0.5330724422442245, + "disc_nll_ch3": 0.49408382838283826, + "disc_nll_ch4": 0.3332673267326733, + "disc_nll_ch5": 0.44086138613861386, + "disc_nll_ch6": 0.482646699669967, + "disc_nll_ch7": 0.4527673267326733, + "disc_nll_total": 0.42144026402640267, + "terminal_flow": 0.511090099009901, + "terminal_norm": 0.4639425742574258, + "terminal_packet": 0.5245283828382838 + }, + "vulnerabilityscan": { + "_n": 303.0, + "disc_nll_ch2": 0.5670473597359735, + "disc_nll_ch3": 0.543558910891089, + "disc_nll_ch4": 0.47109570957095714, + "disc_nll_ch5": 0.5855089108910891, + "disc_nll_ch6": 0.4749678217821782, + "disc_nll_ch7": 0.5918115511551155, + "disc_nll_total": 0.588804785478548, + "terminal_flow": 0.5061803630363036, + "terminal_norm": 0.531825907590759, + "terminal_packet": 0.539825412541254 + }, + "xss": { + "_n": 303.0, + "disc_nll_ch2": 0.5636001650165017, + "disc_nll_ch3": 0.5443092409240924, + "disc_nll_ch4": 0.4020655115511551, + "disc_nll_ch5": 0.4719526402640264, + "disc_nll_ch6": 0.47747508250825077, + "disc_nll_ch7": 0.6047201320132014, + "disc_nll_total": 0.4916673267326732, + "terminal_flow": 0.5456574257425743, + "terminal_norm": 0.4854701320132013, + "terminal_packet": 0.5356206270627063 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_ciciot2023.log b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_ciciot2023.log new file mode 100644 index 0000000..ae2c241 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_ciciot2023.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,193,621 target rows +[sample] benign=10,000 attack=9,999 (33 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/9,999 +[score] 5,376/9,999 +[eval] attack done 3.9s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_ciciot2023.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_ciciot2023.npz b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_ciciot2023.npz new file mode 100644 index 0000000..1a4e258 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_ciciot2023.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_iscxtor2016.json b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_iscxtor2016.json new file mode 100644 index 0000000..ebed470 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_iscxtor2016.json @@ -0,0 +1,64 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43", + "target_store": "None", + "n_benign": 10000, + "n_attack": 1888, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.5726181144067796, + "auprc": 0.2111764814889819 + }, + "disc_nll_ch3": { + "auroc": 0.34325572033898305, + "auprc": 0.13900498340252287 + }, + "disc_nll_ch4": { + "auroc": 0.38250254237288134, + "auprc": 0.16203454535528505 + }, + "disc_nll_ch5": { + "auroc": 0.3801769597457627, + "auprc": 0.14462637997951072 + }, + "disc_nll_ch6": { + "auroc": 0.5222193591101695, + "auprc": 0.15831860590984004 + }, + "disc_nll_ch7": { + "auroc": 0.5357695709745762, + "auprc": 0.18440955255937788 + }, + "disc_nll_total": { + "auroc": 0.5676984110169491, + "auprc": 0.19536809369125513 + }, + "terminal_flow": { + "auroc": 0.7523563559322034, + "auprc": 0.3153369681197231 + }, + "terminal_norm": { + "auroc": 0.6476632680084746, + "auprc": 0.2915518096045159 + }, + "terminal_packet": { + "auroc": 0.5946523305084745, + "auprc": 0.22078486394826533 + } + }, + "per_class": { + "tor": { + "_n": 1888.0, + "disc_nll_ch2": 0.5726181144067796, + "disc_nll_ch3": 0.34325572033898305, + "disc_nll_ch4": 0.38250254237288134, + "disc_nll_ch5": 0.3801769597457627, + "disc_nll_ch6": 0.5222193591101695, + "disc_nll_ch7": 0.5357695709745762, + "disc_nll_total": 0.5676984110169491, + "terminal_flow": 0.7523563559322034, + "terminal_norm": 0.6476632680084746, + "terminal_packet": 0.5946523305084745 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_iscxtor2016.log b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_iscxtor2016.log new file mode 100644 index 0000000..1bf6230 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_iscxtor2016.log @@ -0,0 +1,13 @@ +[model] T=64 flow_dim=20 +[data] 103,079 target rows +[sample] benign=10,000 attack=1,888 (1 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/1,888 +[eval] attack done 0.7s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_iscxtor2016.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_iscxtor2016.npz b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_iscxtor2016.npz new file mode 100644 index 0000000..759059f Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicddos2019_to_iscxtor2016.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_cicddos2019.json b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_cicddos2019.json new file mode 100644 index 0000000..5cc25b5 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_cicddos2019.json @@ -0,0 +1,272 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.44585262543164744, + "auprc": 0.4390583943360762 + }, + "disc_nll_ch3": { + "auroc": 0.12549388076376192, + "auprc": 0.36097355084143534 + }, + "disc_nll_ch4": { + "auroc": 0.16202423826934798, + "auprc": 0.3401937531199616 + }, + "disc_nll_ch5": { + "auroc": 0.2800944444444444, + "auprc": 0.3776148309122828 + }, + "disc_nll_ch6": { + "auroc": 0.5790656814950234, + "auprc": 0.5008700307246956 + }, + "disc_nll_ch7": { + "auroc": 0.4492334653666464, + "auprc": 0.4372696150250285 + }, + "disc_nll_total": { + "auroc": 0.2841145135080235, + "auprc": 0.3750643103556518 + }, + "terminal_flow": { + "auroc": 0.9240544738980296, + "auprc": 0.908018970399303 + }, + "terminal_norm": { + "auroc": 0.8598080083282551, + "auprc": 0.8501169787378154 + }, + "terminal_packet": { + "auroc": 0.6352372232378631, + "auprc": 0.5501437518896912 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "disc_nll_ch2": 0.6006807823129252, + "disc_nll_ch3": 0.0004848639455781984, + "disc_nll_ch4": 0.1459858843537415, + "disc_nll_ch5": 0.2733788265306123, + "disc_nll_ch6": 0.6842178571428571, + "disc_nll_ch7": 0.42151641156462594, + "disc_nll_total": 0.3483417517006802, + "terminal_flow": 0.9939175170068028, + "terminal_norm": 0.9939582482993197, + "terminal_packet": 0.8122339285714286 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.6225238095238095, + "disc_nll_ch3": 0.00029999999999996696, + "disc_nll_ch4": 0.14972176870748302, + "disc_nll_ch5": 0.2802778911564626, + "disc_nll_ch6": 0.6885425170068027, + "disc_nll_ch7": 0.4209503401360545, + "disc_nll_total": 0.3640154761904762, + "terminal_flow": 0.998421768707483, + "terminal_norm": 0.9998277210884353, + "terminal_packet": 0.8334690476190476 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.339197619047619, + "disc_nll_ch3": 0.0003032312925169734, + "disc_nll_ch4": 0.04053401360544217, + "disc_nll_ch5": 0.17877210884353742, + "disc_nll_ch6": 0.676013775510204, + "disc_nll_ch7": 0.4158712585034014, + "disc_nll_total": 0.13351513605442178, + "terminal_flow": 0.9679289115646259, + "terminal_norm": 0.9595882653061225, + "terminal_packet": 0.5699916666666666 + }, + "DrDoS_NTP": { + "_n": 588.0, + "disc_nll_ch2": 0.6659782312925171, + "disc_nll_ch3": 0.011613435374149658, + "disc_nll_ch4": 0.03482670068027211, + "disc_nll_ch5": 0.27949676870748297, + "disc_nll_ch6": 0.492962074829932, + "disc_nll_ch7": 0.11339982993197277, + "disc_nll_total": 0.3473204081632653, + "terminal_flow": 0.9657006802721089, + "terminal_norm": 0.5553418367346937, + "terminal_packet": 0.47387619047619045 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.25990986394557825, + "disc_nll_ch3": 0.0006452380952381317, + "disc_nll_ch4": 0.02696479591836732, + "disc_nll_ch5": 0.08368996598639455, + "disc_nll_ch6": 0.485515306122449, + "disc_nll_ch7": 0.4108664965986395, + "disc_nll_total": 0.00477517006802721, + "terminal_flow": 0.8982734693877552, + "terminal_norm": 0.7751627551020408, + "terminal_packet": 0.4815685374149661 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "disc_nll_ch2": 0.6058801020408163, + "disc_nll_ch3": 0.00031377551020405215, + "disc_nll_ch4": 0.13995008503401363, + "disc_nll_ch5": 0.269924149659864, + "disc_nll_ch6": 0.6789721088435374, + "disc_nll_ch7": 0.42045663265306127, + "disc_nll_total": 0.3474251700680272, + "terminal_flow": 0.9933132653061223, + "terminal_norm": 0.9891960884353741, + "terminal_packet": 0.7977331632653061 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "disc_nll_ch2": 0.45387874149659857, + "disc_nll_ch3": 0.0008930272108843417, + "disc_nll_ch4": 0.05143758503401362, + "disc_nll_ch5": 0.1922326530612245, + "disc_nll_ch6": 0.5767681972789116, + "disc_nll_ch7": 0.38716700680272104, + "disc_nll_total": 0.1953156462585034, + "terminal_flow": 0.9331785714285714, + "terminal_norm": 0.8304510204081633, + "terminal_packet": 0.5266316326530612 + }, + "DrDoS_UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.44565867346938776, + "disc_nll_ch3": 0.0008222789115646196, + "disc_nll_ch4": 0.05366173469387756, + "disc_nll_ch5": 0.18878979591836736, + "disc_nll_ch6": 0.5776559523809524, + "disc_nll_ch7": 0.3856374149659864, + "disc_nll_total": 0.18675816326530612, + "terminal_flow": 0.9313215986394558, + "terminal_norm": 0.8352084183673469, + "terminal_packet": 0.5212824829931972 + }, + "LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.6236535714285715, + "disc_nll_ch3": 0.0017289115646258173, + "disc_nll_ch4": 0.1421358843537415, + "disc_nll_ch5": 0.2809617346938776, + "disc_nll_ch6": 0.6883341836734693, + "disc_nll_ch7": 0.42146292517006806, + "disc_nll_total": 0.36452091836734696, + "terminal_flow": 0.9977049319727892, + "terminal_norm": 0.9993807823129252, + "terminal_packet": 0.8406205782312925 + }, + "MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.33270051020408165, + "disc_nll_ch3": 0.00030340136054418426, + "disc_nll_ch4": 0.03931768707482993, + "disc_nll_ch5": 0.17670969387755103, + "disc_nll_ch6": 0.6757729591836734, + "disc_nll_ch7": 0.4157023809523809, + "disc_nll_total": 0.12354727891156463, + "terminal_flow": 0.965746768707483, + "terminal_norm": 0.9587760204081633, + "terminal_packet": 0.5656003401360544 + }, + "NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.25955952380952385, + "disc_nll_ch3": 0.0006879251700680631, + "disc_nll_ch4": 0.02664039115646256, + "disc_nll_ch5": 0.08401836734693877, + "disc_nll_ch6": 0.483016156462585, + "disc_nll_ch7": 0.4106375850340136, + "disc_nll_total": 0.003784523809523805, + "terminal_flow": 0.8995761904761905, + "terminal_norm": 0.7787999999999999, + "terminal_packet": 0.4831496598639456 + }, + "Portmap": { + "_n": 588.0, + "disc_nll_ch2": 0.26145850340136056, + "disc_nll_ch3": 0.0035829931972789454, + "disc_nll_ch4": 0.028760884353741467, + "disc_nll_ch5": 0.08683027210884355, + "disc_nll_ch6": 0.48252482993197277, + "disc_nll_ch7": 0.4117624149659864, + "disc_nll_total": 0.006692176870748299, + "terminal_flow": 0.8985173469387755, + "terminal_norm": 0.7791091836734695, + "terminal_packet": 0.4846188775510205 + }, + "Syn": { + "_n": 588.0, + "disc_nll_ch2": 0.3705738095238095, + "disc_nll_ch3": 0.9315494897959182, + "disc_nll_ch4": 0.6201828231292518, + "disc_nll_ch5": 0.8436612244897959, + "disc_nll_ch6": 0.40859115646258504, + "disc_nll_ch7": 0.7659180272108844, + "disc_nll_total": 0.6933489795918367, + "terminal_flow": 0.8044076530612245, + "terminal_norm": 0.8455253401360543, + "terminal_packet": 0.8311047619047619 + }, + "TFTP": { + "_n": 588.0, + "disc_nll_ch2": 0.5019644557823129, + "disc_nll_ch3": 0.006949999999999961, + "disc_nll_ch4": 0.044495408163265325, + "disc_nll_ch5": 0.21700085034013608, + "disc_nll_ch6": 0.6519418367346939, + "disc_nll_ch7": 0.406744387755102, + "disc_nll_total": 0.24895595238095242, + "terminal_flow": 0.9708778911564626, + "terminal_norm": 0.9095010204081633, + "terminal_packet": 0.5932098639455782 + }, + "UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.4547232993197279, + "disc_nll_ch3": 0.0008819727891156396, + "disc_nll_ch4": 0.053659523809523824, + "disc_nll_ch5": 0.19206734693877553, + "disc_nll_ch6": 0.5710017006802721, + "disc_nll_ch7": 0.38427738095238095, + "disc_nll_total": 0.19517040816326528, + "terminal_flow": 0.9328335034013605, + "terminal_norm": 0.8277758503401359, + "terminal_packet": 0.5211986394557823 + }, + "UDPLag": { + "_n": 588.0, + "disc_nll_ch2": 0.3689137755102041, + "disc_nll_ch3": 0.8305974489795919, + "disc_nll_ch4": 0.5675928571428572, + "disc_nll_ch5": 0.763200680272109, + "disc_nll_ch6": 0.4061266156462585, + "disc_nll_ch7": 0.7375144557823129, + "disc_nll_total": 0.6319998299319728, + "terminal_flow": 0.8635409863945578, + "terminal_norm": 0.8674624149659862, + "terminal_packet": 0.8046867346938775 + }, + "WebDDoS": { + "_n": 438.0, + "disc_nll_ch2": 0.40072796803652966, + "disc_nll_ch3": 0.41579417808219177, + "disc_nll_ch4": 0.7346124429223744, + "disc_nll_ch5": 0.40158595890410964, + "disc_nll_ch6": 0.6288626712328766, + "disc_nll_ch7": 0.7953889269406392, + "disc_nll_total": 0.7544409817351598, + "terminal_flow": 0.614764497716895, + "terminal_norm": 0.6609393835616438, + "terminal_packet": 0.6658715753424659 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_cicddos2019.log b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_cicddos2019.log new file mode 100644 index 0000000..8453bc9 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_cicddos2019.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,993,376 target rows +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.4s +[eval] attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done 3.9s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_cicddos2019.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_cicddos2019.npz new file mode 100644 index 0000000..0457699 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_ciciot2023.json b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_ciciot2023.json new file mode 100644 index 0000000..d18aeae --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_ciciot2023.json @@ -0,0 +1,480 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "n_benign": 10000, + "n_attack": 9999, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.5469726222622262, + "auprc": 0.5020027537702961 + }, + "disc_nll_ch3": { + "auroc": 0.47454115911591155, + "auprc": 0.535360483442048 + }, + "disc_nll_ch4": { + "auroc": 0.5413694769476947, + "auprc": 0.5461733354062066 + }, + "disc_nll_ch5": { + "auroc": 0.6035020502050206, + "auprc": 0.6539371590420983 + }, + "disc_nll_ch6": { + "auroc": 0.4709184468446845, + "auprc": 0.5129271789179826 + }, + "disc_nll_ch7": { + "auroc": 0.6065214121412141, + "auprc": 0.5876852077496216 + }, + "disc_nll_total": { + "auroc": 0.6123206920692069, + "auprc": 0.6620753443857075 + }, + "terminal_flow": { + "auroc": 0.6499047754775478, + "auprc": 0.6728897355499324 + }, + "terminal_norm": { + "auroc": 0.6354891939193918, + "auprc": 0.6285350532106467 + }, + "terminal_packet": { + "auroc": 0.6654050755075508, + "auprc": 0.641041867925481 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 303.0, + "disc_nll_ch2": 0.6258465346534654, + "disc_nll_ch3": 0.3262891089108911, + "disc_nll_ch4": 0.41864059405940596, + "disc_nll_ch5": 0.4853910891089109, + "disc_nll_ch6": 0.4930745874587459, + "disc_nll_ch7": 0.45126782178217817, + "disc_nll_total": 0.4618024752475247, + "terminal_flow": 0.5492519801980198, + "terminal_norm": 0.5714962046204621, + "terminal_packet": 0.614343399339934 + }, + "browserhijacking": { + "_n": 303.0, + "disc_nll_ch2": 0.5857455445544555, + "disc_nll_ch3": 0.3232193069306931, + "disc_nll_ch4": 0.3944437293729373, + "disc_nll_ch5": 0.49112326732673267, + "disc_nll_ch6": 0.46779438943894386, + "disc_nll_ch7": 0.4805909240924093, + "disc_nll_total": 0.461163201320132, + "terminal_flow": 0.5011922442244224, + "terminal_norm": 0.4318181518151816, + "terminal_packet": 0.49564933993399335 + }, + "commandinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.5862232673267327, + "disc_nll_ch3": 0.3013211221122112, + "disc_nll_ch4": 0.36781930693069304, + "disc_nll_ch5": 0.4303702970297031, + "disc_nll_ch6": 0.48379059405940594, + "disc_nll_ch7": 0.45714356435643566, + "disc_nll_total": 0.407140099009901, + "terminal_flow": 0.5181612211221122, + "terminal_norm": 0.5459097359735973, + "terminal_packet": 0.5965554455445544 + }, + "ddos-ack_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.297076402640264, + "disc_nll_ch3": 0.03391171617161716, + "disc_nll_ch4": 0.5528470297029703, + "disc_nll_ch5": 0.8018183168316833, + "disc_nll_ch6": 0.7018305280528053, + "disc_nll_ch7": 0.8459384488448844, + "disc_nll_total": 0.8295674917491749, + "terminal_flow": 0.984850330033003, + "terminal_norm": 0.9889514851485148, + "terminal_packet": 0.9802592409240923 + }, + "ddos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6424861386138613, + "disc_nll_ch3": 0.6301237623762376, + "disc_nll_ch4": 0.6701092409240924, + "disc_nll_ch5": 0.8743465346534653, + "disc_nll_ch6": 0.5512917491749175, + "disc_nll_ch7": 0.702089603960396, + "disc_nll_total": 0.9069348184818482, + "terminal_flow": 0.655923597359736, + "terminal_norm": 0.7048125412541254, + "terminal_packet": 0.7370318481848185 + }, + "ddos-icmp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5250354785478548, + "disc_nll_ch3": 0.4760191419141914, + "disc_nll_ch4": 0.474703300330033, + "disc_nll_ch5": 0.6053646864686468, + "disc_nll_ch6": 0.5435386138613861, + "disc_nll_ch7": 0.5030930693069307, + "disc_nll_total": 0.53926600660066, + "terminal_flow": 0.4892803630363036, + "terminal_norm": 0.47453976897689765, + "terminal_packet": 0.48106848184818485 + }, + "ddos-icmp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.5411514851485149, + "disc_nll_ch3": 0.3302075907590759, + "disc_nll_ch4": 0.4079047854785479, + "disc_nll_ch5": 0.5397039603960395, + "disc_nll_ch6": 0.49907029702970296, + "disc_nll_ch7": 0.49963613861386136, + "disc_nll_total": 0.4781386138613861, + "terminal_flow": 0.5368420792079208, + "terminal_norm": 0.5416795379537953, + "terminal_packet": 0.5731277227722773 + }, + "ddos-pshack_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5660929042904291, + "disc_nll_ch3": 0.8018016501650165, + "disc_nll_ch4": 0.6921749174917492, + "disc_nll_ch5": 0.3725046204620462, + "disc_nll_ch6": 0.99993399339934, + "disc_nll_ch7": 0.7510963696369637, + "disc_nll_total": 0.9954085808580858, + "terminal_flow": 0.7540062706270627, + "terminal_norm": 0.7223927392739274, + "terminal_packet": 0.735935808580858 + }, + "ddos-rstfinflood": { + "_n": 303.0, + "disc_nll_ch2": 0.20099999999999996, + "disc_nll_ch3": 0.7537, + "disc_nll_ch4": 0.9998, + "disc_nll_ch5": 0.9999, + "disc_nll_ch6": 0.5038, + "disc_nll_ch7": 0.7383, + "disc_nll_total": 0.9991, + "terminal_flow": 0.9779, + "terminal_norm": 0.9941, + "terminal_packet": 0.9687 + }, + "ddos-slowloris": { + "_n": 303.0, + "disc_nll_ch2": 0.5772968646864687, + "disc_nll_ch3": 0.5160605610561055, + "disc_nll_ch4": 0.6134856435643564, + "disc_nll_ch5": 0.8868280528052805, + "disc_nll_ch6": 0.744594389438944, + "disc_nll_ch7": 0.5503419141914192, + "disc_nll_total": 0.8290478547854786, + "terminal_flow": 0.5582318481848185, + "terminal_norm": 0.5856960396039603, + "terminal_packet": 0.6440478547854785 + }, + "ddos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6932339933993399, + "disc_nll_ch3": 0.789907590759076, + "disc_nll_ch4": 0.7395270627062707, + "disc_nll_ch5": 0.7791574257425742, + "disc_nll_ch6": 0.03564224422442243, + "disc_nll_ch7": 0.766729702970297, + "disc_nll_total": 0.6911188118811882, + "terminal_flow": 0.7783079207920791, + "terminal_norm": 0.6935851485148514, + "terminal_packet": 0.7524940594059405 + }, + "ddos-synonymousip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.7822435643564356, + "disc_nll_ch3": 0.9953415841584158, + "disc_nll_ch4": 0.7396834983498349, + "disc_nll_ch5": 0.331206600660066, + "disc_nll_ch6": 0.4343818481848185, + "disc_nll_ch7": 0.9934392739273927, + "disc_nll_total": 0.9878353135313532, + "terminal_flow": 0.9967, + "terminal_norm": 0.7421504950495049, + "terminal_packet": 0.7118663366336633 + }, + "ddos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.585109900990099, + "disc_nll_ch3": 0.8005211221122113, + "disc_nll_ch4": 0.732843894389439, + "disc_nll_ch5": 0.4148308580858086, + "disc_nll_ch6": 0.00670693069306929, + "disc_nll_ch7": 0.7468924092409241, + "disc_nll_total": 0.5108105610561056, + "terminal_flow": 0.7131488448844885, + "terminal_norm": 0.6900943894389439, + "terminal_packet": 0.7658082508250824 + }, + "ddos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.659564686468647, + "disc_nll_ch3": 0.1384346534653465, + "disc_nll_ch4": 0.2356069306930693, + "disc_nll_ch5": 0.4152049504950494, + "disc_nll_ch6": 0.511137293729373, + "disc_nll_ch7": 0.33143663366336634, + "disc_nll_total": 0.4767798679867986, + "terminal_flow": 0.8375356435643564, + "terminal_norm": 0.6314414191419141, + "terminal_packet": 0.6422188118811881 + }, + "ddos-udp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.5965770627062706, + "disc_nll_ch3": 0.35164405940594057, + "disc_nll_ch4": 0.4214691419141914, + "disc_nll_ch5": 0.4646727722772277, + "disc_nll_ch6": 0.5621151815181518, + "disc_nll_ch7": 0.5376301980198019, + "disc_nll_total": 0.5908120462046205, + "terminal_flow": 0.6715792079207922, + "terminal_norm": 0.5843201320132013, + "terminal_packet": 0.5874311881188118 + }, + "dictionarybruteforce": { + "_n": 303.0, + "disc_nll_ch2": 0.6046854785478548, + "disc_nll_ch3": 0.43146930693069313, + "disc_nll_ch4": 0.5226400990099009, + "disc_nll_ch5": 0.5396504950495049, + "disc_nll_ch6": 0.531757095709571, + "disc_nll_ch7": 0.4849349834983498, + "disc_nll_total": 0.5473496699669967, + "terminal_flow": 0.5428514851485149, + "terminal_norm": 0.530426897689769, + "terminal_packet": 0.5838940594059406 + }, + "dns_spoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.47084273927392734, + "disc_nll_ch3": 0.2751853135313531, + "disc_nll_ch4": 0.35328960396039605, + "disc_nll_ch5": 0.39872788778877893, + "disc_nll_ch6": 0.45274306930693076, + "disc_nll_ch7": 0.4764656765676568, + "disc_nll_total": 0.37834867986798676, + "terminal_flow": 0.5935656765676567, + "terminal_norm": 0.5773481848184818, + "terminal_packet": 0.5466734323432344 + }, + "dos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5178927392739274, + "disc_nll_ch3": 0.4552907590759076, + "disc_nll_ch4": 0.5013722772277227, + "disc_nll_ch5": 0.9278567656765676, + "disc_nll_ch6": 0.5414947194719472, + "disc_nll_ch7": 0.610106600660066, + "disc_nll_total": 0.9192140264026403, + "terminal_flow": 0.6708920792079208, + "terminal_norm": 0.7653082508250826, + "terminal_packet": 0.761903300330033 + }, + "dos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.7290419141914193, + "disc_nll_ch3": 0.7573118811881188, + "disc_nll_ch4": 0.7545267326732672, + "disc_nll_ch5": 0.9402699669966996, + "disc_nll_ch6": 0.3448151815181518, + "disc_nll_ch7": 0.8331138613861386, + "disc_nll_total": 0.8272894389438944, + "terminal_flow": 0.7490881188118812, + "terminal_norm": 0.6742656765676567, + "terminal_packet": 0.7108270627062707 + }, + "dos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.7161815181518152, + "disc_nll_ch3": 0.7786376237623762, + "disc_nll_ch4": 0.7334392739273927, + "disc_nll_ch5": 0.910136303630363, + "disc_nll_ch6": 0.04078184818481848, + "disc_nll_ch7": 0.7600775577557756, + "disc_nll_total": 0.783738613861386, + "terminal_flow": 0.6658290429042906, + "terminal_norm": 0.6712719471947194, + "terminal_packet": 0.7608384488448845 + }, + "dos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.27044752475247524, + "disc_nll_ch3": 0.08678217821782176, + "disc_nll_ch4": 0.7252594059405941, + "disc_nll_ch5": 0.34414026402640263, + "disc_nll_ch6": 0.3167580858085809, + "disc_nll_ch7": 0.6983910891089109, + "disc_nll_total": 0.04013861386138616, + "terminal_flow": 0.7398178217821781, + "terminal_norm": 0.6654772277227723, + "terminal_packet": 0.9297112211221121 + }, + "mirai-greeth_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5624734323432343, + "disc_nll_ch3": 0.32658481848184817, + "disc_nll_ch4": 0.3940437293729373, + "disc_nll_ch5": 0.5335387788778878, + "disc_nll_ch6": 0.4241211221122112, + "disc_nll_ch7": 0.4994224422442245, + "disc_nll_total": 0.4307212871287129, + "terminal_flow": 0.43445412541254125, + "terminal_norm": 0.3718853135313531, + "terminal_packet": 0.3825511551155116 + }, + "mirai-greip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6083442244224423, + "disc_nll_ch3": 0.34877640264026405, + "disc_nll_ch4": 0.42980264026402637, + "disc_nll_ch5": 0.5938211221122113, + "disc_nll_ch6": 0.5089801980198019, + "disc_nll_ch7": 0.5477577557755775, + "disc_nll_total": 0.5591297029702971, + "terminal_flow": 0.5444750825082508, + "terminal_norm": 0.5739877887788779, + "terminal_packet": 0.6164688118811881 + }, + "mirai-udpplain": { + "_n": 303.0, + "disc_nll_ch2": 0.5560349834983498, + "disc_nll_ch3": 0.3356440594059406, + "disc_nll_ch4": 0.44184009900990096, + "disc_nll_ch5": 0.6228196369636962, + "disc_nll_ch6": 0.4870292079207921, + "disc_nll_ch7": 0.5512410891089109, + "disc_nll_total": 0.5404288778877888, + "terminal_flow": 0.5809249174917492, + "terminal_norm": 0.5060778877887788, + "terminal_packet": 0.537090594059406 + }, + "mitm-arpspoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.5673024752475248, + "disc_nll_ch3": 0.27668333333333334, + "disc_nll_ch4": 0.31922623762376234, + "disc_nll_ch5": 0.4750528052805281, + "disc_nll_ch6": 0.47831138613861385, + "disc_nll_ch7": 0.49403217821782175, + "disc_nll_total": 0.4471465346534653, + "terminal_flow": 0.4760158415841584, + "terminal_norm": 0.5147876237623762, + "terminal_packet": 0.5588150165016502 + }, + "recon-hostdiscovery": { + "_n": 303.0, + "disc_nll_ch2": 0.24084554455445545, + "disc_nll_ch3": 0.7287095709570957, + "disc_nll_ch4": 0.5963366336633664, + "disc_nll_ch5": 0.7179787128712871, + "disc_nll_ch6": 0.5094452145214521, + "disc_nll_ch7": 0.7878293729372936, + "disc_nll_total": 0.7043247524752476, + "terminal_flow": 0.9264663366336634, + "terminal_norm": 0.945339108910891, + "terminal_packet": 0.9044059405940593 + }, + "recon-osscan": { + "_n": 303.0, + "disc_nll_ch2": 0.5211808580858086, + "disc_nll_ch3": 0.700929207920792, + "disc_nll_ch4": 0.6563633663366335, + "disc_nll_ch5": 0.7573113861386138, + "disc_nll_ch6": 0.44867178217821785, + "disc_nll_ch7": 0.6828564356435644, + "disc_nll_total": 0.755276897689769, + "terminal_flow": 0.6606140264026402, + "terminal_norm": 0.6994224422442245, + "terminal_packet": 0.6698785478547855 + }, + "recon-pingsweep": { + "_n": 303.0, + "disc_nll_ch2": 0.5439442244224422, + "disc_nll_ch3": 0.3668311881188119, + "disc_nll_ch4": 0.5308691419141913, + "disc_nll_ch5": 0.5077612211221122, + "disc_nll_ch6": 0.5135386138613861, + "disc_nll_ch7": 0.5204447194719471, + "disc_nll_total": 0.5039506600660066, + "terminal_flow": 0.5475278877887789, + "terminal_norm": 0.5897590759075908, + "terminal_packet": 0.6718090759075909 + }, + "recon-portscan": { + "_n": 303.0, + "disc_nll_ch2": 0.4565800330033003, + "disc_nll_ch3": 0.7318440594059406, + "disc_nll_ch4": 0.6582404290429043, + "disc_nll_ch5": 0.7634468646864687, + "disc_nll_ch6": 0.45030610561056106, + "disc_nll_ch7": 0.706507590759076, + "disc_nll_total": 0.7515501650165015, + "terminal_flow": 0.6785448844884487, + "terminal_norm": 0.7166209570957096, + "terminal_packet": 0.643940594059406 + }, + "sqlinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.528262706270627, + "disc_nll_ch3": 0.4111308580858086, + "disc_nll_ch4": 0.5080201320132014, + "disc_nll_ch5": 0.4873475247524752, + "disc_nll_ch6": 0.5462747524752476, + "disc_nll_ch7": 0.5213490099009902, + "disc_nll_total": 0.5076445544554455, + "terminal_flow": 0.5040722772277227, + "terminal_norm": 0.5206051155115511, + "terminal_packet": 0.5587150165016501 + }, + "uploading_attack": { + "_n": 303.0, + "disc_nll_ch2": 0.6101148514851485, + "disc_nll_ch3": 0.27853828382838286, + "disc_nll_ch4": 0.3367387788778878, + "disc_nll_ch5": 0.4408559405940594, + "disc_nll_ch6": 0.47589125412541255, + "disc_nll_ch7": 0.4571366336633663, + "disc_nll_total": 0.3722409240924092, + "terminal_flow": 0.5087902640264026, + "terminal_norm": 0.5967194719471947, + "terminal_packet": 0.6471270627062706 + }, + "vulnerabilityscan": { + "_n": 303.0, + "disc_nll_ch2": 0.4775914191419142, + "disc_nll_ch3": 0.4750976897689769, + "disc_nll_ch4": 0.4944168316831683, + "disc_nll_ch5": 0.5800183168316833, + "disc_nll_ch6": 0.45921056105610564, + "disc_nll_ch7": 0.5524219471947195, + "disc_nll_total": 0.5093529702970298, + "terminal_flow": 0.5241737623762377, + "terminal_norm": 0.5723018151815181, + "terminal_packet": 0.5667869636963696 + }, + "xss": { + "_n": 303.0, + "disc_nll_ch2": 0.6036460396039605, + "disc_nll_ch3": 0.3259087458745875, + "disc_nll_ch4": 0.4477082508250826, + "disc_nll_ch5": 0.4824102310231023, + "disc_nll_ch6": 0.4714759075907591, + "disc_nll_ch7": 0.4754915841584158, + "disc_nll_total": 0.46381072607260726, + "terminal_flow": 0.5758424092409241, + "terminal_norm": 0.5765508250825083, + "terminal_packet": 0.6203933993399341 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_ciciot2023.log b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_ciciot2023.log new file mode 100644 index 0000000..7eda4c3 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_ciciot2023.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,193,621 target rows +[sample] benign=10,000 attack=9,999 (33 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.2s +[eval] attack... +[score] 256/9,999 +[score] 5,376/9,999 +[eval] attack done 3.9s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_ciciot2023.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_ciciot2023.npz b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_ciciot2023.npz new file mode 100644 index 0000000..4dd1abd Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_ciciot2023.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_iscxtor2016.json b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_iscxtor2016.json new file mode 100644 index 0000000..3a7b5c1 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_iscxtor2016.json @@ -0,0 +1,64 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed43", + "target_store": "None", + "n_benign": 10000, + "n_attack": 1888, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.5615287076271187, + "auprc": 0.2106844788301806 + }, + "disc_nll_ch3": { + "auroc": 0.4402895656779661, + "auprc": 0.24878517636461328 + }, + "disc_nll_ch4": { + "auroc": 0.32857603283898307, + "auprc": 0.16476078060700372 + }, + "disc_nll_ch5": { + "auroc": 0.41814353813559324, + "auprc": 0.1589325517108789 + }, + "disc_nll_ch6": { + "auroc": 0.48580391949152546, + "auprc": 0.20889522252640708 + }, + "disc_nll_ch7": { + "auroc": 0.5634114406779661, + "auprc": 0.3083518568657454 + }, + "disc_nll_total": { + "auroc": 0.4764768802966102, + "auprc": 0.2730491465321408 + }, + "terminal_flow": { + "auroc": 0.5390384798728813, + "auprc": 0.22194716793067537 + }, + "terminal_norm": { + "auroc": 0.5082230402542373, + "auprc": 0.2684042754306063 + }, + "terminal_packet": { + "auroc": 0.45809372351694916, + "auprc": 0.29082267996204414 + } + }, + "per_class": { + "tor": { + "_n": 1888.0, + "disc_nll_ch2": 0.5615287076271187, + "disc_nll_ch3": 0.4402895656779661, + "disc_nll_ch4": 0.32857603283898307, + "disc_nll_ch5": 0.41814353813559324, + "disc_nll_ch6": 0.48580391949152546, + "disc_nll_ch7": 0.5634114406779661, + "disc_nll_total": 0.4764768802966102, + "terminal_flow": 0.5390384798728813, + "terminal_norm": 0.5082230402542373, + "terminal_packet": 0.45809372351694916 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_iscxtor2016.log b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_iscxtor2016.log new file mode 100644 index 0000000..4180c22 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_iscxtor2016.log @@ -0,0 +1,13 @@ +[model] T=64 flow_dim=20 +[data] 103,079 target rows +[sample] benign=10,000 attack=1,888 (1 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/1,888 +[eval] attack done 0.7s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_iscxtor2016.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_iscxtor2016.npz b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_iscxtor2016.npz new file mode 100644 index 0000000..5b1fc65 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed43_cicids2017_to_iscxtor2016.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_ciciot2023_to_iscxtor2016.json b/artifacts/route_comparison/cross/route_ac_combo_seed43_ciciot2023_to_iscxtor2016.json new file mode 100644 index 0000000..8dec2bf --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_ciciot2023_to_iscxtor2016.json @@ -0,0 +1,64 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43", + "target_store": "None", + "n_benign": 10000, + "n_attack": 1888, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.43991755826271184, + "auprc": 0.1456727955490129 + }, + "disc_nll_ch3": { + "auroc": 0.34333320974576276, + "auprc": 0.13982209284691977 + }, + "disc_nll_ch4": { + "auroc": 0.31294729872881355, + "auprc": 0.10957434909805083 + }, + "disc_nll_ch5": { + "auroc": 0.49896030190677965, + "auprc": 0.15253689455319908 + }, + "disc_nll_ch6": { + "auroc": 0.43328209745762714, + "auprc": 0.14266155201904354 + }, + "disc_nll_ch7": { + "auroc": 0.5155092690677967, + "auprc": 0.2192353548304104 + }, + "disc_nll_total": { + "auroc": 0.33267690677966105, + "auprc": 0.12949503185547262 + }, + "terminal_flow": { + "auroc": 0.5056820180084746, + "auprc": 0.24311781065588625 + }, + "terminal_norm": { + "auroc": 0.46859290254237285, + "auprc": 0.18584298478428354 + }, + "terminal_packet": { + "auroc": 0.47788429555084744, + "auprc": 0.2718980157487295 + } + }, + "per_class": { + "tor": { + "_n": 1888.0, + "disc_nll_ch2": 0.43991755826271184, + "disc_nll_ch3": 0.34333320974576276, + "disc_nll_ch4": 0.31294729872881355, + "disc_nll_ch5": 0.49896030190677965, + "disc_nll_ch6": 0.43328209745762714, + "disc_nll_ch7": 0.5155092690677967, + "disc_nll_total": 0.33267690677966105, + "terminal_flow": 0.5056820180084746, + "terminal_norm": 0.46859290254237285, + "terminal_packet": 0.47788429555084744 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_ciciot2023_to_iscxtor2016.log b/artifacts/route_comparison/cross/route_ac_combo_seed43_ciciot2023_to_iscxtor2016.log new file mode 100644 index 0000000..55ba710 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_ciciot2023_to_iscxtor2016.log @@ -0,0 +1,13 @@ +[model] T=64 flow_dim=20 +[data] 103,079 target rows +[sample] benign=10,000 attack=1,888 (1 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.2s +[eval] attack... +[score] 256/1,888 +[eval] attack done 0.7s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed43_ciciot2023_to_iscxtor2016.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_ciciot2023_to_iscxtor2016.npz b/artifacts/route_comparison/cross/route_ac_combo_seed43_ciciot2023_to_iscxtor2016.npz new file mode 100644 index 0000000..1cb945e Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed43_ciciot2023_to_iscxtor2016.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_ddos2019_to_cicids2017.json b/artifacts/route_comparison/cross/route_ac_combo_seed43_ddos2019_to_cicids2017.json new file mode 100644 index 0000000..bdba9cd --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_ddos2019_to_cicids2017.json @@ -0,0 +1,246 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.7499305818074424, + "auprc": 0.6878415746995847 + }, + "disc_nll_ch3": { + "auroc": 0.8293170407560543, + "auprc": 0.7474561368203755 + }, + "disc_nll_ch4": { + "auroc": 0.8285178233904312, + "auprc": 0.6663332133558272 + }, + "disc_nll_ch5": { + "auroc": 0.80411566007088, + "auprc": 0.775199543241617 + }, + "disc_nll_ch6": { + "auroc": 0.833077790903721, + "auprc": 0.6998668702641484 + }, + "disc_nll_ch7": { + "auroc": 0.8623501919669226, + "auprc": 0.8182585922627682 + }, + "disc_nll_total": { + "auroc": 0.890601491435322, + "auprc": 0.8216474746941096 + }, + "terminal_flow": { + "auroc": 0.49901664943886587, + "auprc": 0.42187650411798205 + }, + "terminal_norm": { + "auroc": 0.5141328189604253, + "auprc": 0.3773119715015667 + }, + "terminal_packet": { + "auroc": 0.5588769713526285, + "auprc": 0.40250676797968254 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "disc_nll_ch2": 0.9709596096096096, + "disc_nll_ch3": 0.7677711711711712, + "disc_nll_ch4": 0.7802995495495495, + "disc_nll_ch5": 0.7879003003003001, + "disc_nll_ch6": 0.7707740240240241, + "disc_nll_ch7": 0.8980621621621622, + "disc_nll_total": 0.9124908408408409, + "terminal_flow": 0.22945885885885886, + "terminal_norm": 0.4614241741741742, + "terminal_packet": 0.6183590090090091 + }, + "DDoS": { + "_n": 666.0, + "disc_nll_ch2": 0.8867105105105105, + "disc_nll_ch3": 0.9181127627627628, + "disc_nll_ch4": 0.9422298798798798, + "disc_nll_ch5": 0.9503375375375376, + "disc_nll_ch6": 0.9099457957957958, + "disc_nll_ch7": 0.9618058558558559, + "disc_nll_total": 0.9630222222222221, + "terminal_flow": 0.8486124624624624, + "terminal_norm": 0.7454159159159159, + "terminal_packet": 0.7734976726726727 + }, + "DoS GoldenEye": { + "_n": 666.0, + "disc_nll_ch2": 0.8807114114114115, + "disc_nll_ch3": 0.835654954954955, + "disc_nll_ch4": 0.8099219219219219, + "disc_nll_ch5": 0.838529954954955, + "disc_nll_ch6": 0.7722064564564565, + "disc_nll_ch7": 0.8629250750750751, + "disc_nll_total": 0.896695045045045, + "terminal_flow": 0.8957532282282284, + "terminal_norm": 0.6976908408408409, + "terminal_packet": 0.6989414414414414 + }, + "DoS Hulk": { + "_n": 666.0, + "disc_nll_ch2": 0.7992921921921923, + "disc_nll_ch3": 0.8615028528528528, + "disc_nll_ch4": 0.9435656156156156, + "disc_nll_ch5": 0.8947470720720722, + "disc_nll_ch6": 0.8666747747747748, + "disc_nll_ch7": 0.8316939939939939, + "disc_nll_total": 0.9290554054054054, + "terminal_flow": 0.7258578078078077, + "terminal_norm": 0.5893908408408408, + "terminal_packet": 0.6306141141141142 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "disc_nll_ch2": 0.6686626126126126, + "disc_nll_ch3": 0.7861923423423424, + "disc_nll_ch4": 0.85120990990991, + "disc_nll_ch5": 0.7686135885885886, + "disc_nll_ch6": 0.8098906906906908, + "disc_nll_ch7": 0.8535025525525526, + "disc_nll_total": 0.7884650150150151, + "terminal_flow": 0.6389662912912912, + "terminal_norm": 0.71176996996997, + "terminal_packet": 0.751090015015015 + }, + "DoS Slowloris": { + "_n": 666.0, + "disc_nll_ch2": 0.6248543543543543, + "disc_nll_ch3": 0.6943052552552553, + "disc_nll_ch4": 0.718096996996997, + "disc_nll_ch5": 0.9236984984984983, + "disc_nll_ch6": 0.9700950450450451, + "disc_nll_ch7": 0.6643274774774774, + "disc_nll_total": 0.8335942942942942, + "terminal_flow": 0.6048625375375375, + "terminal_norm": 0.533752927927928, + "terminal_packet": 0.5736145645645646 + }, + "FTP-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.6628154654654655, + "disc_nll_ch3": 0.80500990990991, + "disc_nll_ch4": 0.8024177177177177, + "disc_nll_ch5": 0.9483621621621621, + "disc_nll_ch6": 0.9910911411411413, + "disc_nll_ch7": 0.8854773273273273, + "disc_nll_total": 0.8921306306306305, + "terminal_flow": 0.311212012012012, + "terminal_norm": 0.23189399399399396, + "terminal_packet": 0.357989039039039 + }, + "Heartbleed": { + "_n": 1.0, + "disc_nll_ch2": 0.43189999999999995, + "disc_nll_ch3": 0.04149999999999998, + "disc_nll_ch4": 0.006199999999999983, + "disc_nll_ch5": 0.0020999999999999908, + "disc_nll_ch6": 0.7335999999999999, + "disc_nll_ch7": 0.6866, + "disc_nll_total": 0.4222, + "terminal_flow": 0.998, + "terminal_norm": 0.22719999999999996, + "terminal_packet": 0.25739999999999996 + }, + "Infiltration": { + "_n": 7.0, + "disc_nll_ch2": 0.47308571428571433, + "disc_nll_ch3": 0.6593571428571429, + "disc_nll_ch4": 0.3789857142857143, + "disc_nll_ch5": 0.2899857142857143, + "disc_nll_ch6": 0.8923714285714286, + "disc_nll_ch7": 0.7484285714285714, + "disc_nll_total": 0.6391857142857142, + "terminal_flow": 0.8462714285714286, + "terminal_norm": 0.38681428571428567, + "terminal_packet": 0.4793142857142857 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.3731355855855856, + "disc_nll_ch3": 0.9892340840840841, + "disc_nll_ch4": 0.9093864864864865, + "disc_nll_ch5": 0.9645235735735735, + "disc_nll_ch6": 0.6844255255255256, + "disc_nll_ch7": 0.9881755255255255, + "disc_nll_total": 0.9850672672672673, + "terminal_flow": 0.2186154654654655, + "terminal_norm": 0.44623663663663665, + "terminal_packet": 0.36158145645645645 + }, + "Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.9880072072072071, + "disc_nll_ch3": 0.9992063063063061, + "disc_nll_ch4": 0.9408978978978979, + "disc_nll_ch5": 0.993893993993994, + "disc_nll_ch6": 0.6920840840840841, + "disc_nll_ch7": 0.9996996996996997, + "disc_nll_total": 0.9995288288288289, + "terminal_flow": 0.17346591591591592, + "terminal_norm": 0.6131063063063064, + "terminal_packet": 0.6961054054054054 + }, + "SSH-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.6776959459459461, + "disc_nll_ch3": 0.7348384384384385, + "disc_nll_ch4": 0.7039612612612612, + "disc_nll_ch5": 0.08509504504504503, + "disc_nll_ch6": 0.8663010510510509, + "disc_nll_ch7": 0.7037405405405405, + "disc_nll_total": 0.7639223723723724, + "terminal_flow": 0.2654545045045045, + "terminal_norm": 0.14723273273273274, + "terminal_packet": 0.16270585585585584 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "disc_nll_ch2": 0.5094520547945206, + "disc_nll_ch3": 0.1262876712328767, + "disc_nll_ch4": 0.0106876712328767, + "disc_nll_ch5": 0.000546575342465754, + "disc_nll_ch6": 0.7866917808219178, + "disc_nll_ch7": 0.6670013698630137, + "disc_nll_total": 0.4765643835616439, + "terminal_flow": 0.9908616438356164, + "terminal_norm": 0.23055890410958904, + "terminal_packet": 0.27801506849315066 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "disc_nll_ch2": 0.9615461538461538, + "disc_nll_ch3": 0.8737307692307693, + "disc_nll_ch4": 0.8890846153846154, + "disc_nll_ch5": 0.9001538461538462, + "disc_nll_ch6": 0.7784846153846153, + "disc_nll_ch7": 0.9715846153846154, + "disc_nll_total": 0.9404923076923077, + "terminal_flow": 0.8118615384615385, + "terminal_norm": 0.6846307692307693, + "terminal_packet": 0.6569076923076923 + }, + "Web Attack - XSS": { + "_n": 18.0, + "disc_nll_ch2": 0.4567555555555556, + "disc_nll_ch3": 0.10794444444444445, + "disc_nll_ch4": 9.999999999998899e-05, + "disc_nll_ch5": 0.0, + "disc_nll_ch6": 0.9428000000000001, + "disc_nll_ch7": 0.6711666666666666, + "disc_nll_total": 0.5131055555555555, + "terminal_flow": 0.9981777777777778, + "terminal_norm": 0.2528111111111111, + "terminal_packet": 0.35285 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_ddos2019_to_cicids2017.log b/artifacts/route_comparison/cross/route_ac_combo_seed43_ddos2019_to_cicids2017.log new file mode 100644 index 0000000..3e294a1 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_ddos2019_to_cicids2017.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 2,025,564 target rows +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.4s +[eval] attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done 2.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed43_ddos2019_to_cicids2017.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_ddos2019_to_cicids2017.npz b/artifacts/route_comparison/cross/route_ac_combo_seed43_ddos2019_to_cicids2017.npz new file mode 100644 index 0000000..0358dd7 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed43_ddos2019_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicddos2019.json b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicddos2019.json new file mode 100644 index 0000000..21127d3 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicddos2019.json @@ -0,0 +1,272 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.17945758683729432, + "auprc": 0.3866634265285615 + }, + "disc_nll_ch3": { + "auroc": 0.13720618525289457, + "auprc": 0.34906010647331565 + }, + "disc_nll_ch4": { + "auroc": 0.11376815965874465, + "auprc": 0.33181800398532213 + }, + "disc_nll_ch5": { + "auroc": 0.31690497664025996, + "auprc": 0.38515023276616034 + }, + "disc_nll_ch6": { + "auroc": 0.5574170069063579, + "auprc": 0.49019117933540646 + }, + "disc_nll_ch7": { + "auroc": 0.17580466179159052, + "auprc": 0.3776187633171776 + }, + "disc_nll_total": { + "auroc": 0.1605249238269348, + "auprc": 0.35230503892246334 + }, + "terminal_flow": { + "auroc": 0.7593947440585009, + "auprc": 0.707299889189783 + }, + "terminal_norm": { + "auroc": 0.769226508226691, + "auprc": 0.696108481314522 + }, + "terminal_packet": { + "auroc": 0.6300721562055657, + "auprc": 0.5516565940861384 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "disc_nll_ch2": 0.0003422619047618739, + "disc_nll_ch3": 0.009695493197278884, + "disc_nll_ch4": 0.014527636054421738, + "disc_nll_ch5": 0.3056140306122449, + "disc_nll_ch6": 0.6285921768707483, + "disc_nll_ch7": 0.046460969387755124, + "disc_nll_total": 0.0017340986394557742, + "terminal_flow": 0.9431058673469388, + "terminal_norm": 0.9295980442176872, + "terminal_packet": 0.7794085884353741 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.0011081632653060912, + "disc_nll_ch3": 0.0093426870748299, + "disc_nll_ch4": 0.01340119047619044, + "disc_nll_ch5": 0.322487925170068, + "disc_nll_ch6": 0.6303835034013605, + "disc_nll_ch7": 0.0390387755102041, + "disc_nll_total": 0.0006887755102040743, + "terminal_flow": 0.9605996598639457, + "terminal_norm": 0.9383931972789117, + "terminal_packet": 0.7904054421768707 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.0003869047619047285, + "disc_nll_ch3": 0.013191156462585037, + "disc_nll_ch4": 0.019464795918367344, + "disc_nll_ch5": 0.1256125850340136, + "disc_nll_ch6": 0.6256700680272109, + "disc_nll_ch7": 0.03944778911564626, + "disc_nll_total": 1.3435374149658952e-05, + "terminal_flow": 0.8167855442176871, + "terminal_norm": 0.8420524659863946, + "terminal_packet": 0.6468782312925169 + }, + "DrDoS_NTP": { + "_n": 588.0, + "disc_nll_ch2": 0.3974011904761905, + "disc_nll_ch3": 0.03262840136054423, + "disc_nll_ch4": 0.025719897959183675, + "disc_nll_ch5": 0.5200323129251702, + "disc_nll_ch6": 0.6262624149659863, + "disc_nll_ch7": 0.005755102040816339, + "disc_nll_total": 0.23431309523809518, + "terminal_flow": 0.7173125850340135, + "terminal_norm": 0.364297619047619, + "terminal_packet": 0.42043537414965987 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.0010190476190475783, + "disc_nll_ch3": 0.018957993197278915, + "disc_nll_ch4": 0.025707653061224474, + "disc_nll_ch5": 0.0892894557823129, + "disc_nll_ch6": 0.6160972789115646, + "disc_nll_ch7": 0.04232125850340134, + "disc_nll_total": 8.588435374148715e-05, + "terminal_flow": 0.6123818027210886, + "terminal_norm": 0.7704047619047618, + "terminal_packet": 0.6316032312925169 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "disc_nll_ch2": 0.00030204081632649734, + "disc_nll_ch3": 0.009982312925170045, + "disc_nll_ch4": 0.014147619047619017, + "disc_nll_ch5": 0.32885340136054425, + "disc_nll_ch6": 0.6296767006802722, + "disc_nll_ch7": 0.029783673469387748, + "disc_nll_total": 2.2278911564623395e-05, + "terminal_flow": 0.9460130952380952, + "terminal_norm": 0.9223448979591836, + "terminal_packet": 0.7566465986394557 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "disc_nll_ch2": 0.12596972789115646, + "disc_nll_ch3": 0.01564421768707482, + "disc_nll_ch4": 0.01255255102040816, + "disc_nll_ch5": 0.2924200680272109, + "disc_nll_ch6": 0.6260704081632653, + "disc_nll_ch7": 0.021257312925170076, + "disc_nll_total": 0.08192551020408162, + "terminal_flow": 0.6379845238095239, + "terminal_norm": 0.6260168367346939, + "terminal_packet": 0.3895702380952381 + }, + "DrDoS_UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.09638996598639454, + "disc_nll_ch3": 0.015303571428571422, + "disc_nll_ch4": 0.012531462585034014, + "disc_nll_ch5": 0.2857498299319728, + "disc_nll_ch6": 0.6258639455782313, + "disc_nll_ch7": 0.02133911564625851, + "disc_nll_total": 0.05837704081632651, + "terminal_flow": 0.6291642857142857, + "terminal_norm": 0.6253887755102041, + "terminal_packet": 0.383289455782313 + }, + "LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.0019362244897958853, + "disc_nll_ch3": 0.010414965986394525, + "disc_nll_ch4": 0.015295918367346903, + "disc_nll_ch5": 0.31169710884353746, + "disc_nll_ch6": 0.630316156462585, + "disc_nll_ch7": 0.04133418367346942, + "disc_nll_total": 0.001497789115646249, + "terminal_flow": 0.9637493197278912, + "terminal_norm": 0.9463360544217688, + "terminal_packet": 0.8069853741496598 + }, + "MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.00039914965986391216, + "disc_nll_ch3": 0.013433333333333335, + "disc_nll_ch4": 0.01927125850340136, + "disc_nll_ch5": 0.1273158163265306, + "disc_nll_ch6": 0.6254867346938775, + "disc_nll_ch7": 0.03652414965986395, + "disc_nll_total": 1.27551020408153e-05, + "terminal_flow": 0.7960666666666666, + "terminal_norm": 0.8317100340136055, + "terminal_packet": 0.6330511904761904 + }, + "NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.001437585034013567, + "disc_nll_ch3": 0.02012874149659865, + "disc_nll_ch4": 0.025344897959183654, + "disc_nll_ch5": 0.0894267006802721, + "disc_nll_ch6": 0.6159641156462585, + "disc_nll_ch7": 0.039884353741496584, + "disc_nll_total": 7.993197278910684e-05, + "terminal_flow": 0.6113132653061224, + "terminal_norm": 0.757133843537415, + "terminal_packet": 0.6240799319727891 + }, + "Portmap": { + "_n": 588.0, + "disc_nll_ch2": 0.004825680272108805, + "disc_nll_ch3": 0.020564455782312925, + "disc_nll_ch4": 0.028113775510204067, + "disc_nll_ch5": 0.09163333333333332, + "disc_nll_ch6": 0.6156416666666666, + "disc_nll_ch7": 0.045015816326530594, + "disc_nll_total": 0.0029263605442176777, + "terminal_flow": 0.6287355442176871, + "terminal_norm": 0.7822414965986394, + "terminal_packet": 0.6464284013605441 + }, + "Syn": { + "_n": 588.0, + "disc_nll_ch2": 0.9518034013605443, + "disc_nll_ch3": 0.8305608843537414, + "disc_nll_ch4": 0.604787925170068, + "disc_nll_ch5": 0.8026221088435375, + "disc_nll_ch6": 0.14169098639455782, + "disc_nll_ch7": 0.9055078231292517, + "disc_nll_total": 0.8480353741496599, + "terminal_flow": 0.7635466836734693, + "terminal_norm": 0.8576862244897959, + "terminal_packet": 0.854370918367347 + }, + "TFTP": { + "_n": 588.0, + "disc_nll_ch2": 0.07466088435374149, + "disc_nll_ch3": 0.015437244897959182, + "disc_nll_ch4": 0.014121938775510191, + "disc_nll_ch5": 0.17715340136054425, + "disc_nll_ch6": 0.6239993197278911, + "disc_nll_ch7": 0.1715387755102041, + "disc_nll_total": 0.04346190476190477, + "terminal_flow": 0.7897292517006803, + "terminal_norm": 0.6965841836734694, + "terminal_packet": 0.501738775510204 + }, + "UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.10889948979591835, + "disc_nll_ch3": 0.015267517006802714, + "disc_nll_ch4": 0.011716156462585031, + "disc_nll_ch5": 0.29550289115646255, + "disc_nll_ch6": 0.6260858843537416, + "disc_nll_ch7": 0.020330782312925174, + "disc_nll_total": 0.06770731292517006, + "terminal_flow": 0.6234923469387754, + "terminal_norm": 0.6099287414965986, + "terminal_packet": 0.3660183673469388 + }, + "UDPLag": { + "_n": 588.0, + "disc_nll_ch2": 0.8641602040816326, + "disc_nll_ch3": 0.780195918367347, + "disc_nll_ch4": 0.5375397959183673, + "disc_nll_ch5": 0.7190260204081633, + "disc_nll_ch6": 0.2104698979591837, + "disc_nll_ch7": 0.8273017006802723, + "disc_nll_total": 0.7734908163265306, + "terminal_flow": 0.812284693877551, + "terminal_norm": 0.8524710884353741, + "terminal_packet": 0.8153429421768708 + }, + "WebDDoS": { + "_n": 438.0, + "disc_nll_ch2": 0.5020245433789954, + "disc_nll_ch3": 0.6266021689497717, + "disc_nll_ch4": 0.6857204337899544, + "disc_nll_ch5": 0.5666608447488584, + "disc_nll_ch6": 0.31631130136986296, + "disc_nll_ch7": 0.8202325342465753, + "disc_nll_total": 0.7700398401826484, + "terminal_flow": 0.6225313926940639, + "terminal_norm": 0.708863698630137, + "terminal_packet": 0.6769261415525114 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicddos2019.log b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicddos2019.log new file mode 100644 index 0000000..ca4f856 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicddos2019.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,993,376 target rows +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 3.9s +[eval] attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done 3.4s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicddos2019.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicddos2019.npz new file mode 100644 index 0000000..441b75c Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicids2017.json b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicids2017.json new file mode 100644 index 0000000..40258d5 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicids2017.json @@ -0,0 +1,246 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.7207063201417601, + "auprc": 0.6231147144255613 + }, + "disc_nll_ch3": { + "auroc": 0.4455555079740106, + "auprc": 0.5184161908267886 + }, + "disc_nll_ch4": { + "auroc": 0.8106349379799173, + "auprc": 0.6724358308102187 + }, + "disc_nll_ch5": { + "auroc": 0.7910595688127584, + "auprc": 0.7737231074690746 + }, + "disc_nll_ch6": { + "auroc": 0.6857765652687537, + "auprc": 0.588481313234549 + }, + "disc_nll_ch7": { + "auroc": 0.4725571544595393, + "auprc": 0.560954588493858 + }, + "disc_nll_total": { + "auroc": 0.8635503174837568, + "auprc": 0.776777422224441 + }, + "terminal_flow": { + "auroc": 0.6603417971057295, + "auprc": 0.6492150910095016 + }, + "terminal_norm": { + "auroc": 0.713115069403426, + "auprc": 0.5951757363878366 + }, + "terminal_packet": { + "auroc": 0.7049188496751329, + "auprc": 0.557760893641079 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "disc_nll_ch2": 0.37988153153153154, + "disc_nll_ch3": 0.18254594594594595, + "disc_nll_ch4": 0.8987376876876876, + "disc_nll_ch5": 0.8662593843843843, + "disc_nll_ch6": 0.7284638138138139, + "disc_nll_ch7": 0.13603941441441442, + "disc_nll_total": 0.6044605105105104, + "terminal_flow": 0.232534984984985, + "terminal_norm": 0.4058500750750751, + "terminal_packet": 0.5394367867867869 + }, + "DDoS": { + "_n": 666.0, + "disc_nll_ch2": 0.4893564564564565, + "disc_nll_ch3": 0.305389039039039, + "disc_nll_ch4": 0.972475075075075, + "disc_nll_ch5": 0.9262743243243243, + "disc_nll_ch6": 0.7910944444444445, + "disc_nll_ch7": 0.13691606606606604, + "disc_nll_total": 0.8361382882882883, + "terminal_flow": 0.9539566066066066, + "terminal_norm": 0.9113065315315316, + "terminal_packet": 0.8979257507507508 + }, + "DoS GoldenEye": { + "_n": 666.0, + "disc_nll_ch2": 0.689706156156156, + "disc_nll_ch3": 0.36495300300300304, + "disc_nll_ch4": 0.7888642642642643, + "disc_nll_ch5": 0.6850686186186187, + "disc_nll_ch6": 0.7678995495495495, + "disc_nll_ch7": 0.23491501501501502, + "disc_nll_total": 0.7635276276276276, + "terminal_flow": 0.878547897897898, + "terminal_norm": 0.8729798798798798, + "terminal_packet": 0.8702965465465465 + }, + "DoS Hulk": { + "_n": 666.0, + "disc_nll_ch2": 0.6689586336336337, + "disc_nll_ch3": 0.33752627627627624, + "disc_nll_ch4": 0.9683837837837838, + "disc_nll_ch5": 0.9198279279279278, + "disc_nll_ch6": 0.8054114114114116, + "disc_nll_ch7": 0.24541531531531532, + "disc_nll_total": 0.8824349849849851, + "terminal_flow": 0.9224438438438438, + "terminal_norm": 0.8839077327327326, + "terminal_packet": 0.8747057057057057 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "disc_nll_ch2": 0.534903003003003, + "disc_nll_ch3": 0.5056294294294295, + "disc_nll_ch4": 0.8495288288288289, + "disc_nll_ch5": 0.8669090840840842, + "disc_nll_ch6": 0.898186786786787, + "disc_nll_ch7": 0.5145839339339339, + "disc_nll_total": 0.8396024024024024, + "terminal_flow": 0.9500714714714714, + "terminal_norm": 0.9259267267267267, + "terminal_packet": 0.9123587837837839 + }, + "DoS Slowloris": { + "_n": 666.0, + "disc_nll_ch2": 0.7447775525525526, + "disc_nll_ch3": 0.8465729729729728, + "disc_nll_ch4": 0.7651585585585586, + "disc_nll_ch5": 0.8400648648648649, + "disc_nll_ch6": 0.9349668168168167, + "disc_nll_ch7": 0.9181767267267267, + "disc_nll_total": 0.9707608858858859, + "terminal_flow": 0.8247819069069069, + "terminal_norm": 0.8170974474474475, + "terminal_packet": 0.831518168168168 + }, + "FTP-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.9362506006006007, + "disc_nll_ch3": 0.014205705705705701, + "disc_nll_ch4": 0.7158887387387386, + "disc_nll_ch5": 0.8834776276276276, + "disc_nll_ch6": 0.9564361861861862, + "disc_nll_ch7": 0.6108468468468469, + "disc_nll_total": 0.945709984984985, + "terminal_flow": 0.21958971471471475, + "terminal_norm": 0.4663405405405405, + "terminal_packet": 0.654887012012012 + }, + "Heartbleed": { + "_n": 1.0, + "disc_nll_ch2": 0.36419999999999997, + "disc_nll_ch3": 0.11650000000000005, + "disc_nll_ch4": 0.01649999999999996, + "disc_nll_ch5": 0.006000000000000005, + "disc_nll_ch6": 0.7571, + "disc_nll_ch7": 0.011099999999999999, + "disc_nll_total": 0.35640000000000005, + "terminal_flow": 0.9632, + "terminal_norm": 0.8634000000000001, + "terminal_packet": 0.8721 + }, + "Infiltration": { + "_n": 7.0, + "disc_nll_ch2": 0.6927, + "disc_nll_ch3": 0.19291428571428568, + "disc_nll_ch4": 0.17001428571428573, + "disc_nll_ch5": 0.29089999999999994, + "disc_nll_ch6": 0.8619428571428571, + "disc_nll_ch7": 0.15447142857142857, + "disc_nll_total": 0.7956142857142856, + "terminal_flow": 0.7107857142857144, + "terminal_norm": 0.5361428571428571, + "terminal_packet": 0.6677857142857142 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.95781996996997, + "disc_nll_ch3": 0.9840373873873873, + "disc_nll_ch4": 0.8422740240240241, + "disc_nll_ch5": 0.9544150150150151, + "disc_nll_ch6": 0.0750587087087087, + "disc_nll_ch7": 0.9903504504504506, + "disc_nll_total": 0.9880521021021023, + "terminal_flow": 0.9422095345345345, + "terminal_norm": 0.8999995495495495, + "terminal_packet": 0.39564046546546544 + }, + "Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.9082297297297297, + "disc_nll_ch3": 0.9772025525525525, + "disc_nll_ch4": 0.7104244744744743, + "disc_nll_ch5": 0.9957693693693693, + "disc_nll_ch6": 0.007917267267267263, + "disc_nll_ch7": 0.9852846846846848, + "disc_nll_total": 0.9912788288288289, + "terminal_flow": 0.5320465465465465, + "terminal_norm": 0.8782261261261262, + "terminal_packet": 0.7087786036036036 + }, + "SSH-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.8732276276276276, + "disc_nll_ch3": 0.0016456456456456457, + "disc_nll_ch4": 0.7062771771771771, + "disc_nll_ch5": 0.08567897897897898, + "disc_nll_ch6": 0.8497285285285285, + "disc_nll_ch7": 0.0266478978978979, + "disc_nll_total": 0.811042117117117, + "terminal_flow": 0.11422882882882883, + "terminal_norm": 0.14408918918918917, + "terminal_packet": 0.40452117117117115 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "disc_nll_ch2": 0.9383205479452055, + "disc_nll_ch3": 0.02289315068493151, + "disc_nll_ch4": 0.057632876712328765, + "disc_nll_ch5": 0.0020150684931506775, + "disc_nll_ch6": 0.9654, + "disc_nll_ch7": 0.014560273972602735, + "disc_nll_total": 0.9147232876712329, + "terminal_flow": 0.8828890410958904, + "terminal_norm": 0.13572739726027397, + "terminal_packet": 0.3563821917808219 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "disc_nll_ch2": 0.4280846153846154, + "disc_nll_ch3": 0.2515846153846154, + "disc_nll_ch4": 0.7965538461538462, + "disc_nll_ch5": 0.8494615384615384, + "disc_nll_ch6": 0.7687538461538462, + "disc_nll_ch7": 0.11766923076923078, + "disc_nll_total": 0.6424769230769231, + "terminal_flow": 0.6643, + "terminal_norm": 0.8482615384615385, + "terminal_packet": 0.8528846153846154 + }, + "Web Attack - XSS": { + "_n": 18.0, + "disc_nll_ch2": 0.9664166666666667, + "disc_nll_ch3": 0.04265, + "disc_nll_ch4": 0.036355555555555565, + "disc_nll_ch5": 0.0004833333333332986, + "disc_nll_ch6": 0.9956277777777778, + "disc_nll_ch7": 0.012255555555555544, + "disc_nll_total": 0.9626055555555555, + "terminal_flow": 0.9397333333333334, + "terminal_norm": 0.25840555555555556, + "terminal_packet": 0.5041388888888889 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicids2017.log b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicids2017.log new file mode 100644 index 0000000..68b453e --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicids2017.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 2,025,564 target rows +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.2s +[eval] attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done 2.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicids2017.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicids2017.npz b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicids2017.npz new file mode 100644 index 0000000..3de0882 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_ciciot2023.json b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_ciciot2023.json new file mode 100644 index 0000000..b02e9f8 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_ciciot2023.json @@ -0,0 +1,480 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "n_benign": 10000, + "n_attack": 9999, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.43294934493449344, + "auprc": 0.4494140568628693 + }, + "disc_nll_ch3": { + "auroc": 0.44107152215221523, + "auprc": 0.5700110893433319 + }, + "disc_nll_ch4": { + "auroc": 0.46874655465546555, + "auprc": 0.5091595400027642 + }, + "disc_nll_ch5": { + "auroc": 0.5595816631663166, + "auprc": 0.6316927357913946 + }, + "disc_nll_ch6": { + "auroc": 0.5661363336333634, + "auprc": 0.5575107826625623 + }, + "disc_nll_ch7": { + "auroc": 0.6055662616261626, + "auprc": 0.6307144141453619 + }, + "disc_nll_total": { + "auroc": 0.6263633113311331, + "auprc": 0.6920034666765197 + }, + "terminal_flow": { + "auroc": 0.6839108760876088, + "auprc": 0.6709668814993863 + }, + "terminal_norm": { + "auroc": 0.6213622862286229, + "auprc": 0.5810357503082532 + }, + "terminal_packet": { + "auroc": 0.6308291629162917, + "auprc": 0.6510852099160404 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 303.0, + "disc_nll_ch2": 0.523649504950495, + "disc_nll_ch3": 0.36997508250825084, + "disc_nll_ch4": 0.3767783828382838, + "disc_nll_ch5": 0.3396397689768977, + "disc_nll_ch6": 0.6298153465346534, + "disc_nll_ch7": 0.5031666666666667, + "disc_nll_total": 0.4743622112211221, + "terminal_flow": 0.5968193069306931, + "terminal_norm": 0.526523102310231, + "terminal_packet": 0.5348782178217821 + }, + "browserhijacking": { + "_n": 303.0, + "disc_nll_ch2": 0.49111765676567654, + "disc_nll_ch3": 0.3908643564356436, + "disc_nll_ch4": 0.3417719471947195, + "disc_nll_ch5": 0.31915280528052803, + "disc_nll_ch6": 0.5726602310231023, + "disc_nll_ch7": 0.4681980198019801, + "disc_nll_total": 0.48512359735973604, + "terminal_flow": 0.5588338283828382, + "terminal_norm": 0.49659075907590755, + "terminal_packet": 0.5009981848184819 + }, + "commandinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.5045739273927393, + "disc_nll_ch3": 0.36222194719471945, + "disc_nll_ch4": 0.32707491749174916, + "disc_nll_ch5": 0.27458316831683166, + "disc_nll_ch6": 0.6049792079207921, + "disc_nll_ch7": 0.46096369636963697, + "disc_nll_total": 0.45110544554455445, + "terminal_flow": 0.6037290429042904, + "terminal_norm": 0.5069653465346534, + "terminal_packet": 0.47989636963696364 + }, + "ddos-ack_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.04218465346534653, + "disc_nll_ch3": 0.07092425742574258, + "disc_nll_ch4": 0.15750379537953796, + "disc_nll_ch5": 0.6375684818481848, + "disc_nll_ch6": 0.705756600660066, + "disc_nll_ch7": 0.8494516501650164, + "disc_nll_total": 0.7871209570957095, + "terminal_flow": 0.9413836633663367, + "terminal_norm": 0.927946699669967, + "terminal_packet": 0.5711315181518152 + }, + "ddos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5468651815181518, + "disc_nll_ch3": 0.7440247524752475, + "disc_nll_ch4": 0.630292409240924, + "disc_nll_ch5": 0.9227679867986799, + "disc_nll_ch6": 0.6571313531353136, + "disc_nll_ch7": 0.8383706270627063, + "disc_nll_total": 0.9223717821782179, + "terminal_flow": 0.7566186468646865, + "terminal_norm": 0.7401437293729373, + "terminal_packet": 0.9014503300330033 + }, + "ddos-icmp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5857255775577557, + "disc_nll_ch3": 0.49129521452145214, + "disc_nll_ch4": 0.4496160066006601, + "disc_nll_ch5": 0.4781404290429043, + "disc_nll_ch6": 0.49603976897689767, + "disc_nll_ch7": 0.5209029702970297, + "disc_nll_total": 0.5985826732673267, + "terminal_flow": 0.6071805280528053, + "terminal_norm": 0.5403466996699671, + "terminal_packet": 0.5570118811881188 + }, + "ddos-icmp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.5157293729372937, + "disc_nll_ch3": 0.3795793729372937, + "disc_nll_ch4": 0.41854570957095716, + "disc_nll_ch5": 0.40629851485148516, + "disc_nll_ch6": 0.5647481848184818, + "disc_nll_ch7": 0.5166344884488449, + "disc_nll_total": 0.5449369636963696, + "terminal_flow": 0.6299260726072607, + "terminal_norm": 0.5630534653465347, + "terminal_packet": 0.5736333333333334 + }, + "ddos-pshack_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.12222871287128712, + "disc_nll_ch3": 0.016244884488448855, + "disc_nll_ch4": 0.5499409240924092, + "disc_nll_ch5": 0.5789095709570957, + "disc_nll_ch6": 0.99923300330033, + "disc_nll_ch7": 0.952429702970297, + "disc_nll_total": 0.9972927392739274, + "terminal_flow": 0.7686775577557756, + "terminal_norm": 0.7291009900990099, + "terminal_packet": 0.8698326732673267 + }, + "ddos-rstfinflood": { + "_n": 303.0, + "disc_nll_ch2": 0.4355, + "disc_nll_ch3": 0.2832, + "disc_nll_ch4": 0.9939, + "disc_nll_ch5": 0.987, + "disc_nll_ch6": 0.0020999999999999908, + "disc_nll_ch7": 0.9596, + "disc_nll_total": 0.9968999999999999, + "terminal_flow": 0.7800999999999999, + "terminal_norm": 0.746, + "terminal_packet": 0.4709 + }, + "ddos-slowloris": { + "_n": 303.0, + "disc_nll_ch2": 0.5546778877887789, + "disc_nll_ch3": 0.5135212871287128, + "disc_nll_ch4": 0.629076402640264, + "disc_nll_ch5": 0.8788633663366336, + "disc_nll_ch6": 0.6913925742574258, + "disc_nll_ch7": 0.5407272277227723, + "disc_nll_total": 0.8416986798679867, + "terminal_flow": 0.5409252475247526, + "terminal_norm": 0.6434752475247525, + "terminal_packet": 0.6769912541254125 + }, + "ddos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.11671782178217824, + "disc_nll_ch3": 0.9920775577557757, + "disc_nll_ch4": 0.5435389438943894, + "disc_nll_ch5": 0.6617884488448844, + "disc_nll_ch6": 0.4587752475247525, + "disc_nll_ch7": 0.32703597359735975, + "disc_nll_total": 0.9589442244224423, + "terminal_flow": 0.942805610561056, + "terminal_norm": 0.7357023102310232, + "terminal_packet": 0.9751382838283829 + }, + "ddos-synonymousip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6986415841584157, + "disc_nll_ch3": 0.9948174917491748, + "disc_nll_ch4": 0.525170297029703, + "disc_nll_ch5": 0.5038485148514852, + "disc_nll_ch6": 0.6210257425742574, + "disc_nll_ch7": 0.7501445544554456, + "disc_nll_total": 0.9735706270627063, + "terminal_flow": 0.9973, + "terminal_norm": 0.7318224422442243, + "terminal_packet": 0.41698283828382837 + }, + "ddos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.005098019801980198, + "disc_nll_ch3": 0.013891749174917485, + "disc_nll_ch4": 0.5220795379537954, + "disc_nll_ch5": 0.7596, + "disc_nll_ch6": 0.6531844884488449, + "disc_nll_ch7": 0.22511287128712873, + "disc_nll_total": 0.012433663366336622, + "terminal_flow": 0.7251364686468647, + "terminal_norm": 0.7284930693069307, + "terminal_packet": 0.9517102310231023 + }, + "ddos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.19324323432343235, + "disc_nll_ch3": 0.1484217821782178, + "disc_nll_ch4": 0.2479986798679868, + "disc_nll_ch5": 0.5224016501650165, + "disc_nll_ch6": 0.7152188118811881, + "disc_nll_ch7": 0.37595511551155114, + "disc_nll_total": 0.1927234323432343, + "terminal_flow": 0.8408333333333333, + "terminal_norm": 0.6287521452145214, + "terminal_packet": 0.6658376237623762 + }, + "ddos-udp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.39960297029702974, + "disc_nll_ch3": 0.3795250825082508, + "disc_nll_ch4": 0.4227958745874587, + "disc_nll_ch5": 0.4717389438943894, + "disc_nll_ch6": 0.6550557755775577, + "disc_nll_ch7": 0.5828486798679868, + "disc_nll_total": 0.4999047854785479, + "terminal_flow": 0.6591252475247524, + "terminal_norm": 0.5539552805280528, + "terminal_packet": 0.5917199669966997 + }, + "dictionarybruteforce": { + "_n": 303.0, + "disc_nll_ch2": 0.46898795379537955, + "disc_nll_ch3": 0.47381419141914194, + "disc_nll_ch4": 0.49776072607260724, + "disc_nll_ch5": 0.5198481848184818, + "disc_nll_ch6": 0.5873084158415842, + "disc_nll_ch7": 0.4237651815181519, + "disc_nll_total": 0.5723295379537954, + "terminal_flow": 0.6284064356435644, + "terminal_norm": 0.5782044554455446, + "terminal_packet": 0.6098369636963695 + }, + "dns_spoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.2998661716171617, + "disc_nll_ch3": 0.3914361386138614, + "disc_nll_ch4": 0.3885585808580858, + "disc_nll_ch5": 0.3284676567656766, + "disc_nll_ch6": 0.5954171617161717, + "disc_nll_ch7": 0.47151567656765675, + "disc_nll_total": 0.34859917491749176, + "terminal_flow": 0.5621833333333333, + "terminal_norm": 0.5816734323432343, + "terminal_packet": 0.6035595709570957 + }, + "dos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.42431782178217814, + "disc_nll_ch3": 0.541170297029703, + "disc_nll_ch4": 0.5551194719471947, + "disc_nll_ch5": 0.9365950495049505, + "disc_nll_ch6": 0.6199889438943894, + "disc_nll_ch7": 0.6973534653465346, + "disc_nll_total": 0.9412326732673266, + "terminal_flow": 0.75423300330033, + "terminal_norm": 0.7424283828382839, + "terminal_packet": 0.8455468646864686 + }, + "dos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.636853795379538, + "disc_nll_ch3": 0.9922511551155115, + "disc_nll_ch4": 0.6369518151815181, + "disc_nll_ch5": 0.9342009900990098, + "disc_nll_ch6": 0.5319597359735974, + "disc_nll_ch7": 0.8430425742574257, + "disc_nll_total": 0.9603577557755774, + "terminal_flow": 0.8805128712871286, + "terminal_norm": 0.7293217821782177, + "terminal_packet": 0.9466511551155115 + }, + "dos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6643495049504952, + "disc_nll_ch3": 0.08165874587458746, + "disc_nll_ch4": 0.5276122112211221, + "disc_nll_ch5": 0.9475749174917492, + "disc_nll_ch6": 0.6262219471947194, + "disc_nll_ch7": 0.8335188118811881, + "disc_nll_total": 0.7338026402640264, + "terminal_flow": 0.7118871287128713, + "terminal_norm": 0.7234366336633663, + "terminal_packet": 0.9109115511551156 + }, + "dos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.04007722772277231, + "disc_nll_ch3": 0.03219405940594058, + "disc_nll_ch4": 0.07196699669966997, + "disc_nll_ch5": 0.019884818481848147, + "disc_nll_ch6": 0.65056600660066, + "disc_nll_ch7": 0.33805049504950485, + "disc_nll_total": 0.020152805280528048, + "terminal_flow": 0.5736716171617162, + "terminal_norm": 0.410306600660066, + "terminal_packet": 0.4725808580858085 + }, + "mirai-greeth_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.4097336633663366, + "disc_nll_ch3": 0.4173262376237624, + "disc_nll_ch4": 0.33310643564356435, + "disc_nll_ch5": 0.33289224422442243, + "disc_nll_ch6": 0.6112813531353135, + "disc_nll_ch7": 0.5419599009900989, + "disc_nll_total": 0.40896303630363035, + "terminal_flow": 0.44253465346534654, + "terminal_norm": 0.37948135313531356, + "terminal_packet": 0.39682904290429044 + }, + "mirai-greip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5722574257425742, + "disc_nll_ch3": 0.444352805280528, + "disc_nll_ch4": 0.3836495049504951, + "disc_nll_ch5": 0.4153891089108911, + "disc_nll_ch6": 0.6464089108910891, + "disc_nll_ch7": 0.5978856435643565, + "disc_nll_total": 0.6357349834983498, + "terminal_flow": 0.6201293729372936, + "terminal_norm": 0.5485937293729373, + "terminal_packet": 0.5680887788778878 + }, + "mirai-udpplain": { + "_n": 303.0, + "disc_nll_ch2": 0.45213646864686474, + "disc_nll_ch3": 0.46060973597359733, + "disc_nll_ch4": 0.37788300330033, + "disc_nll_ch5": 0.4421650165016502, + "disc_nll_ch6": 0.637864191419142, + "disc_nll_ch7": 0.6464420792079208, + "disc_nll_total": 0.553302805280528, + "terminal_flow": 0.572894389438944, + "terminal_norm": 0.50608399339934, + "terminal_packet": 0.5582915841584157 + }, + "mitm-arpspoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.5208460396039605, + "disc_nll_ch3": 0.37829983498349834, + "disc_nll_ch4": 0.34123135313531355, + "disc_nll_ch5": 0.3368333333333333, + "disc_nll_ch6": 0.5667719471947195, + "disc_nll_ch7": 0.44987260726072603, + "disc_nll_total": 0.5118552805280527, + "terminal_flow": 0.6248965346534653, + "terminal_norm": 0.5354367986798679, + "terminal_packet": 0.5265938943894389 + }, + "recon-hostdiscovery": { + "_n": 303.0, + "disc_nll_ch2": 0.3684429042904291, + "disc_nll_ch3": 0.787592409240924, + "disc_nll_ch4": 0.6646561056105611, + "disc_nll_ch5": 0.8307745874587459, + "disc_nll_ch6": 0.18847112211221123, + "disc_nll_ch7": 0.9132686468646865, + "disc_nll_total": 0.9420534653465346, + "terminal_flow": 0.785409900990099, + "terminal_norm": 0.7716313531353135, + "terminal_packet": 0.5857026402640264 + }, + "recon-osscan": { + "_n": 303.0, + "disc_nll_ch2": 0.5572014851485149, + "disc_nll_ch3": 0.7601346534653466, + "disc_nll_ch4": 0.6467792079207921, + "disc_nll_ch5": 0.7995726072607261, + "disc_nll_ch6": 0.4152305280528053, + "disc_nll_ch7": 0.8189422442244224, + "disc_nll_total": 0.8495158415841584, + "terminal_flow": 0.7018986798679868, + "terminal_norm": 0.7062754125412541, + "terminal_packet": 0.6984930693069307 + }, + "recon-pingsweep": { + "_n": 303.0, + "disc_nll_ch2": 0.5150813531353136, + "disc_nll_ch3": 0.28107244224422445, + "disc_nll_ch4": 0.5384404290429042, + "disc_nll_ch5": 0.48897937293729377, + "disc_nll_ch6": 0.5586620462046205, + "disc_nll_ch7": 0.5845097359735973, + "disc_nll_total": 0.5189608910891089, + "terminal_flow": 0.5886648514851485, + "terminal_norm": 0.5873537953795379, + "terminal_packet": 0.5890701320132014 + }, + "recon-portscan": { + "_n": 303.0, + "disc_nll_ch2": 0.5443402640264027, + "disc_nll_ch3": 0.7863556105610562, + "disc_nll_ch4": 0.6480348184818481, + "disc_nll_ch5": 0.8188585808580858, + "disc_nll_ch6": 0.3050034653465346, + "disc_nll_ch7": 0.8312186468646865, + "disc_nll_total": 0.8684216171617162, + "terminal_flow": 0.7239191419141914, + "terminal_norm": 0.713516501650165, + "terminal_packet": 0.649176897689769 + }, + "sqlinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.5882846534653464, + "disc_nll_ch3": 0.365492904290429, + "disc_nll_ch4": 0.5329765676567657, + "disc_nll_ch5": 0.4759255775577558, + "disc_nll_ch6": 0.4750123762376237, + "disc_nll_ch7": 0.536439603960396, + "disc_nll_total": 0.5566655115511552, + "terminal_flow": 0.6111828382838284, + "terminal_norm": 0.5706608910891089, + "terminal_packet": 0.5685810231023103 + }, + "uploading_attack": { + "_n": 303.0, + "disc_nll_ch2": 0.5118755775577558, + "disc_nll_ch3": 0.3508442244224423, + "disc_nll_ch4": 0.28705627062706274, + "disc_nll_ch5": 0.22830049504950498, + "disc_nll_ch6": 0.6222287128712871, + "disc_nll_ch7": 0.44609108910891093, + "disc_nll_total": 0.44468349834983495, + "terminal_flow": 0.6212613861386139, + "terminal_norm": 0.5011897689768977, + "terminal_packet": 0.47603250825082505 + }, + "vulnerabilityscan": { + "_n": 303.0, + "disc_nll_ch2": 0.503070297029703, + "disc_nll_ch3": 0.47659257425742574, + "disc_nll_ch4": 0.5302156765676568, + "disc_nll_ch5": 0.5510138613861386, + "disc_nll_ch6": 0.4241884488448845, + "disc_nll_ch7": 0.6109009900990099, + "disc_nll_total": 0.5984042904290429, + "terminal_flow": 0.6086313531353135, + "terminal_norm": 0.5939051155115511, + "terminal_packet": 0.5653250825082508 + }, + "xss": { + "_n": 303.0, + "disc_nll_ch2": 0.47404966996699666, + "disc_nll_ch3": 0.38357739273927394, + "disc_nll_ch4": 0.370553300330033, + "disc_nll_ch5": 0.31661683168316834, + "disc_nll_ch6": 0.5927973597359736, + "disc_nll_ch7": 0.5273669966996699, + "disc_nll_total": 0.46788168316831685, + "terminal_flow": 0.6073468646864686, + "terminal_norm": 0.5265841584158415, + "terminal_packet": 0.5079780528052805 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_ciciot2023.log b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_ciciot2023.log new file mode 100644 index 0000000..e750f37 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_ciciot2023.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,193,621 target rows +[sample] benign=10,000 attack=9,999 (33 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.1s +[eval] attack... +[score] 256/9,999 +[score] 5,376/9,999 +[eval] attack done 3.5s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_ciciot2023.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_ciciot2023.npz b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_ciciot2023.npz new file mode 100644 index 0000000..7b3bd99 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed43_iscxtor2016_to_ciciot2023.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicddos2019.json b/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicddos2019.json new file mode 100644 index 0000000..22c2484 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicddos2019.json @@ -0,0 +1,272 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.111552239488117, + "auprc": 0.326786128461244 + }, + "disc_nll_ch3": { + "auroc": 0.16530650010156409, + "auprc": 0.413412213201838 + }, + "disc_nll_ch4": { + "auroc": 0.4907478519195613, + "auprc": 0.49265652618387773 + }, + "disc_nll_ch5": { + "auroc": 0.5572507007921998, + "auprc": 0.48105160160447025 + }, + "disc_nll_ch6": { + "auroc": 0.665261400568759, + "auprc": 0.5652968688029535 + }, + "disc_nll_ch7": { + "auroc": 0.8410078102782856, + "auprc": 0.8095710441872058 + }, + "disc_nll_total": { + "auroc": 0.3920459983749746, + "auprc": 0.4823396871061258 + }, + "terminal_flow": { + "auroc": 0.8401946323380053, + "auprc": 0.7282261763511255 + }, + "terminal_norm": { + "auroc": 0.8528543774121472, + "auprc": 0.7875406641765689 + }, + "terminal_packet": { + "auroc": 0.7889882541133455, + "auprc": 0.7534359092747465 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "disc_nll_ch2": 0.04300527210884352, + "disc_nll_ch3": 0.02626564625850342, + "disc_nll_ch4": 0.4241445578231292, + "disc_nll_ch5": 0.5357775510204082, + "disc_nll_ch6": 0.7331921768707483, + "disc_nll_ch7": 0.9253774659863946, + "disc_nll_total": 0.37620535714285713, + "terminal_flow": 0.9090501700680271, + "terminal_norm": 0.9556438775510203, + "terminal_packet": 0.9630524659863946 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.043115986394557805, + "disc_nll_ch3": 0.02510153061224491, + "disc_nll_ch4": 0.42341190476190477, + "disc_nll_ch5": 0.5337738095238096, + "disc_nll_ch6": 0.7424981292517008, + "disc_nll_ch7": 0.9279732993197279, + "disc_nll_total": 0.37951564625850337, + "terminal_flow": 0.9134785714285714, + "terminal_norm": 0.9588848639455783, + "terminal_packet": 0.9748435374149659 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.04463690476190476, + "disc_nll_ch3": 0.0464001700680272, + "disc_nll_ch4": 0.42937125850340135, + "disc_nll_ch5": 0.5473312925170069, + "disc_nll_ch6": 0.7694704081632653, + "disc_nll_ch7": 0.9108329931972788, + "disc_nll_total": 0.3696930272108843, + "terminal_flow": 0.8723918367346938, + "terminal_norm": 0.9236124149659863, + "terminal_packet": 0.8233552721088435 + }, + "DrDoS_NTP": { + "_n": 588.0, + "disc_nll_ch2": 0.04664438775510204, + "disc_nll_ch3": 0.09685144557823128, + "disc_nll_ch4": 0.37726122448979593, + "disc_nll_ch5": 0.4720513605442176, + "disc_nll_ch6": 0.40823571428571426, + "disc_nll_ch7": 0.5370906462585033, + "disc_nll_total": 0.039624149659863925, + "terminal_flow": 0.9000284013605442, + "terminal_norm": 0.5562824829931974, + "terminal_packet": 0.5780268707482994 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.04624285714285715, + "disc_nll_ch3": 0.02246751700680271, + "disc_nll_ch4": 0.47342295918367344, + "disc_nll_ch5": 0.5746404761904761, + "disc_nll_ch6": 0.7523028911564625, + "disc_nll_ch7": 0.9187719387755102, + "disc_nll_total": 0.42127959183673463, + "terminal_flow": 0.7615705782312925, + "terminal_norm": 0.8380858843537415, + "terminal_packet": 0.771492006802721 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "disc_nll_ch2": 0.0435688775510204, + "disc_nll_ch3": 0.02449948979591835, + "disc_nll_ch4": 0.4266147959183674, + "disc_nll_ch5": 0.5361224489795918, + "disc_nll_ch6": 0.7518115646258503, + "disc_nll_ch7": 0.9289982993197279, + "disc_nll_total": 0.3866430272108844, + "terminal_flow": 0.9047397959183674, + "terminal_norm": 0.9518986394557822, + "terminal_packet": 0.9644382653061225 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "disc_nll_ch2": 0.035883503401360546, + "disc_nll_ch3": 0.03746071428571428, + "disc_nll_ch4": 0.3954867346938776, + "disc_nll_ch5": 0.4705781462585034, + "disc_nll_ch6": 0.5836976190476192, + "disc_nll_ch7": 0.7102030612244898, + "disc_nll_total": 0.20048299319727889, + "terminal_flow": 0.813105612244898, + "terminal_norm": 0.7709636054421769, + "terminal_packet": 0.6160360544217687 + }, + "DrDoS_UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.038137414965986396, + "disc_nll_ch3": 0.03522908163265304, + "disc_nll_ch4": 0.39462653061224495, + "disc_nll_ch5": 0.4764768707482993, + "disc_nll_ch6": 0.5812753401360543, + "disc_nll_ch7": 0.7066045918367346, + "disc_nll_total": 0.19906649659863948, + "terminal_flow": 0.8109365646258504, + "terminal_norm": 0.7748219387755102, + "terminal_packet": 0.6086656462585034 + }, + "LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.04410034013605439, + "disc_nll_ch3": 0.026947448979591858, + "disc_nll_ch4": 0.42456819727891154, + "disc_nll_ch5": 0.5348938775510205, + "disc_nll_ch6": 0.7602164965986394, + "disc_nll_ch7": 0.9298974489795919, + "disc_nll_total": 0.3828719387755103, + "terminal_flow": 0.9135134353741496, + "terminal_norm": 0.9590835034013606, + "terminal_packet": 0.9763178571428571 + }, + "MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.04465918367346938, + "disc_nll_ch3": 0.04461853741496597, + "disc_nll_ch4": 0.42901921768707485, + "disc_nll_ch5": 0.5474933673469388, + "disc_nll_ch6": 0.7581037414965985, + "disc_nll_ch7": 0.9086248299319728, + "disc_nll_total": 0.3679972789115646, + "terminal_flow": 0.8701243197278913, + "terminal_norm": 0.9215130952380952, + "terminal_packet": 0.8196036564625852 + }, + "NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.04620833333333334, + "disc_nll_ch3": 0.021808503401360535, + "disc_nll_ch4": 0.4673338435374149, + "disc_nll_ch5": 0.5693068027210885, + "disc_nll_ch6": 0.7271057823129252, + "disc_nll_ch7": 0.9051042517006803, + "disc_nll_total": 0.4054938775510204, + "terminal_flow": 0.7662799319727891, + "terminal_norm": 0.8409709183673468, + "terminal_packet": 0.7688930272108843 + }, + "Portmap": { + "_n": 588.0, + "disc_nll_ch2": 0.047856802721088436, + "disc_nll_ch3": 0.025440986394557812, + "disc_nll_ch4": 0.4725374149659864, + "disc_nll_ch5": 0.5732209183673469, + "disc_nll_ch6": 0.7460943877551022, + "disc_nll_ch7": 0.9061760204081633, + "disc_nll_total": 0.4135471088435374, + "terminal_flow": 0.7663527210884353, + "terminal_norm": 0.841816156462585, + "terminal_packet": 0.7736086734693878 + }, + "Syn": { + "_n": 588.0, + "disc_nll_ch2": 0.5429309523809523, + "disc_nll_ch3": 0.9850136054421769, + "disc_nll_ch4": 0.8992287414965986, + "disc_nll_ch5": 0.7964948979591837, + "disc_nll_ch6": 0.6243705782312925, + "disc_nll_ch7": 0.9875591836734694, + "disc_nll_total": 0.9526972789115646, + "terminal_flow": 0.8757615646258504, + "terminal_norm": 0.9496207482993198, + "terminal_packet": 0.9810821428571428 + }, + "TFTP": { + "_n": 588.0, + "disc_nll_ch2": 0.0471736394557823, + "disc_nll_ch3": 0.09411972789115647, + "disc_nll_ch4": 0.39871173469387755, + "disc_nll_ch5": 0.5071326530612246, + "disc_nll_ch6": 0.5654637755102041, + "disc_nll_ch7": 0.6808018707482993, + "disc_nll_total": 0.17672227891156458, + "terminal_flow": 0.8877284013605442, + "terminal_norm": 0.891484013605442, + "terminal_packet": 0.6636537414965986 + }, + "UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.0367484693877551, + "disc_nll_ch3": 0.03685442176870748, + "disc_nll_ch4": 0.39126122448979594, + "disc_nll_ch5": 0.46651428571428577, + "disc_nll_ch6": 0.5604869047619048, + "disc_nll_ch7": 0.6878646258503402, + "disc_nll_total": 0.18230527210884354, + "terminal_flow": 0.81043231292517, + "terminal_norm": 0.7652982993197278, + "terminal_packet": 0.5958431972789116 + }, + "UDPLag": { + "_n": 588.0, + "disc_nll_ch2": 0.4427948979591837, + "disc_nll_ch3": 0.8759809523809524, + "disc_nll_ch4": 0.8306763605442176, + "disc_nll_ch5": 0.7173066326530613, + "disc_nll_ch6": 0.5804705782312926, + "disc_nll_ch7": 0.9403107142857143, + "disc_nll_total": 0.8269030612244899, + "terminal_flow": 0.8695265306122448, + "terminal_norm": 0.9311236394557822, + "terminal_packet": 0.9435275510204082 + }, + "WebDDoS": { + "_n": 438.0, + "disc_nll_ch2": 0.36813504566210054, + "disc_nll_ch3": 0.46043984018264844, + "disc_nll_ch4": 0.7515740867579909, + "disc_nll_ch5": 0.633631392694064, + "disc_nll_ch6": 0.6644375570776256, + "disc_nll_ch7": 0.7657407534246575, + "disc_nll_total": 0.6493800228310503, + "terminal_flow": 0.5691418949771689, + "terminal_norm": 0.6039155251141552, + "terminal_packet": 0.5223371004566211 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicddos2019.log b/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicddos2019.log new file mode 100644 index 0000000..4eb68bd --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicddos2019.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,993,376 target rows +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done 3.8s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicddos2019.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicddos2019.npz new file mode 100644 index 0000000..ee4a843 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicids2017.json b/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicids2017.json new file mode 100644 index 0000000..e8d9d95 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicids2017.json @@ -0,0 +1,246 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.7319876993502659, + "auprc": 0.5839395850640773 + }, + "disc_nll_ch3": { + "auroc": 0.8777404607206144, + "auprc": 0.8012005956297678 + }, + "disc_nll_ch4": { + "auroc": 0.8812256792675722, + "auprc": 0.771038028982091 + }, + "disc_nll_ch5": { + "auroc": 0.6776632531010042, + "auprc": 0.6841836088799343 + }, + "disc_nll_ch6": { + "auroc": 0.8502238703484938, + "auprc": 0.7006920574422836 + }, + "disc_nll_ch7": { + "auroc": 0.6212852037802717, + "auprc": 0.609940414442239 + }, + "disc_nll_total": { + "auroc": 0.9089951934435911, + "auprc": 0.8349060207420391 + }, + "terminal_flow": { + "auroc": 0.8573811650915534, + "auprc": 0.7392660818938637 + }, + "terminal_norm": { + "auroc": 0.7857713969285292, + "auprc": 0.7318281681414991 + }, + "terminal_packet": { + "auroc": 0.8262952155936207, + "auprc": 0.74181608827412 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "disc_nll_ch2": 0.955156906906907, + "disc_nll_ch3": 0.9280786786786787, + "disc_nll_ch4": 0.9014936936936938, + "disc_nll_ch5": 0.6390463963963964, + "disc_nll_ch6": 0.8839115615615615, + "disc_nll_ch7": 0.41006036036036037, + "disc_nll_total": 0.9319653153153152, + "terminal_flow": 0.5086233483483484, + "terminal_norm": 0.9248445945945947, + "terminal_packet": 0.9507562312312312 + }, + "DDoS": { + "_n": 666.0, + "disc_nll_ch2": 0.814686936936937, + "disc_nll_ch3": 0.9046438438438438, + "disc_nll_ch4": 0.9401834834834835, + "disc_nll_ch5": 0.850756981981982, + "disc_nll_ch6": 0.9307243243243244, + "disc_nll_ch7": 0.5020496996996997, + "disc_nll_total": 0.9528297297297298, + "terminal_flow": 0.9724069069069069, + "terminal_norm": 0.9598687687687688, + "terminal_packet": 0.9128291291291291 + }, + "DoS GoldenEye": { + "_n": 666.0, + "disc_nll_ch2": 0.8269471471471472, + "disc_nll_ch3": 0.8729813813813816, + "disc_nll_ch4": 0.9191471471471472, + "disc_nll_ch5": 0.5282968468468469, + "disc_nll_ch6": 0.711752852852853, + "disc_nll_ch7": 0.55201006006006, + "disc_nll_total": 0.8787454204204205, + "terminal_flow": 0.9647382882882883, + "terminal_norm": 0.8926704204204207, + "terminal_packet": 0.8601165165165165 + }, + "DoS Hulk": { + "_n": 666.0, + "disc_nll_ch2": 0.7740365615615614, + "disc_nll_ch3": 0.9041016516516516, + "disc_nll_ch4": 0.9269993993993996, + "disc_nll_ch5": 0.7942692192192193, + "disc_nll_ch6": 0.8456467717717718, + "disc_nll_ch7": 0.4538423423423423, + "disc_nll_total": 0.9221151651651651, + "terminal_flow": 0.955503003003003, + "terminal_norm": 0.8320447447447447, + "terminal_packet": 0.8215849849849851 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "disc_nll_ch2": 0.7639184684684683, + "disc_nll_ch3": 0.9211852852852853, + "disc_nll_ch4": 0.867727927927928, + "disc_nll_ch5": 0.47626696696696696, + "disc_nll_ch6": 0.89111996996997, + "disc_nll_ch7": 0.6990848348348349, + "disc_nll_total": 0.8911938438438437, + "terminal_flow": 0.832287987987988, + "terminal_norm": 0.9115136636636637, + "terminal_packet": 0.9161063063063063 + }, + "DoS Slowloris": { + "_n": 666.0, + "disc_nll_ch2": 0.6904615615615616, + "disc_nll_ch3": 0.7955264264264265, + "disc_nll_ch4": 0.7828864864864865, + "disc_nll_ch5": 0.9005295795795796, + "disc_nll_ch6": 0.7520262762762763, + "disc_nll_ch7": 0.8847058558558558, + "disc_nll_total": 0.7820834834834833, + "terminal_flow": 0.7701406906906906, + "terminal_norm": 0.7686573573573574, + "terminal_packet": 0.8250396396396396 + }, + "FTP-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.9010075075075076, + "disc_nll_ch3": 0.8349214714714716, + "disc_nll_ch4": 0.816892042042042, + "disc_nll_ch5": 0.6520147147147147, + "disc_nll_ch6": 0.9660093093093094, + "disc_nll_ch7": 0.6215855855855856, + "disc_nll_total": 0.9264325825825825, + "terminal_flow": 0.8535535285285284, + "terminal_norm": 0.473156006006006, + "terminal_packet": 0.7570667417417417 + }, + "Heartbleed": { + "_n": 1.0, + "disc_nll_ch2": 0.6044, + "disc_nll_ch3": 0.6849999999999999, + "disc_nll_ch4": 0.4314, + "disc_nll_ch5": 0.33620000000000005, + "disc_nll_ch6": 0.7961, + "disc_nll_ch7": 0.13419999999999999, + "disc_nll_total": 0.6073, + "terminal_flow": 0.994, + "terminal_norm": 0.4931, + "terminal_packet": 0.29869999999999997 + }, + "Infiltration": { + "_n": 7.0, + "disc_nll_ch2": 0.8967142857142857, + "disc_nll_ch3": 0.7291571428571428, + "disc_nll_ch4": 0.5014142857142857, + "disc_nll_ch5": 0.3214285714285714, + "disc_nll_ch6": 0.9814857142857143, + "disc_nll_ch7": 0.20882857142857142, + "disc_nll_total": 0.9071714285714285, + "terminal_flow": 0.9199714285714286, + "terminal_norm": 0.8118571428571428, + "terminal_packet": 0.8029285714285714 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.42585540540540534, + "disc_nll_ch3": 0.9961665165165166, + "disc_nll_ch4": 0.9781548048048048, + "disc_nll_ch5": 0.9698677177177177, + "disc_nll_ch6": 0.8550735735735736, + "disc_nll_ch7": 0.9955324324324324, + "disc_nll_total": 0.9955375375375375, + "terminal_flow": 0.9487543543543544, + "terminal_norm": 0.9920310810810811, + "terminal_packet": 0.9761504504504505 + }, + "Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.22984594594594596, + "disc_nll_ch3": 0.9995028528528529, + "disc_nll_ch4": 0.9620237237237236, + "disc_nll_ch5": 0.9923734234234234, + "disc_nll_ch6": 0.8526683183183185, + "disc_nll_ch7": 0.9920277777777778, + "disc_nll_total": 0.9962713213213212, + "terminal_flow": 0.9243281531531531, + "terminal_norm": 0.9934539039039039, + "terminal_packet": 0.9944130630630631 + }, + "SSH-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.91924481981982, + "disc_nll_ch3": 0.6447196696696696, + "disc_nll_ch4": 0.7835638138138138, + "disc_nll_ch5": 0.04167402402402402, + "disc_nll_ch6": 0.8149734234234235, + "disc_nll_ch7": 0.19242237237237236, + "disc_nll_total": 0.8356806306306308, + "terminal_flow": 0.8225301801801802, + "terminal_norm": 0.15117732732732733, + "terminal_packet": 0.30739564564564564 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "disc_nll_ch2": 0.8591972602739727, + "disc_nll_ch3": 0.7088260273972603, + "disc_nll_ch4": 0.41422739726027397, + "disc_nll_ch5": 0.29952328767123293, + "disc_nll_ch6": 0.8349958904109589, + "disc_nll_ch7": 0.021076712328767122, + "disc_nll_total": 0.7252835616438356, + "terminal_flow": 0.9907972602739725, + "terminal_norm": 0.4634890410958904, + "terminal_packet": 0.41184109589041096 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "disc_nll_ch2": 0.8973538461538462, + "disc_nll_ch3": 0.902946153846154, + "disc_nll_ch4": 0.9629692307692307, + "disc_nll_ch5": 0.33942307692307694, + "disc_nll_ch6": 0.5913153846153847, + "disc_nll_ch7": 0.45187692307692306, + "disc_nll_total": 0.9359615384615385, + "terminal_flow": 0.9493, + "terminal_norm": 0.9080076923076924, + "terminal_packet": 0.8721846153846153 + }, + "Web Attack - XSS": { + "_n": 18.0, + "disc_nll_ch2": 0.732161111111111, + "disc_nll_ch3": 0.7094111111111111, + "disc_nll_ch4": 0.4166388888888889, + "disc_nll_ch5": 0.07987777777777777, + "disc_nll_ch6": 0.9892277777777778, + "disc_nll_ch7": 0.017911111111111128, + "disc_nll_total": 0.8046277777777778, + "terminal_flow": 0.9929611111111112, + "terminal_norm": 0.4675944444444444, + "terminal_packet": 0.34764999999999996 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicids2017.log b/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicids2017.log new file mode 100644 index 0000000..fbac171 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicids2017.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 2,025,564 target rows +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 3.9s +[eval] attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done 2.4s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicids2017.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicids2017.npz b/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicids2017.npz new file mode 100644 index 0000000..425bad3 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed43_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_ciciot2023.json b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_ciciot2023.json new file mode 100644 index 0000000..ce9e2e5 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_ciciot2023.json @@ -0,0 +1,480 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "n_benign": 10000, + "n_attack": 9999, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.4451123162316232, + "auprc": 0.5049927232203056 + }, + "disc_nll_ch3": { + "auroc": 0.5925496199619962, + "auprc": 0.6031153675014793 + }, + "disc_nll_ch4": { + "auroc": 0.48061317131713166, + "auprc": 0.48871011765967276 + }, + "disc_nll_ch5": { + "auroc": 0.7167594209420942, + "auprc": 0.7616092663744604 + }, + "disc_nll_ch6": { + "auroc": 0.4721520752075207, + "auprc": 0.5243521398294766 + }, + "disc_nll_ch7": { + "auroc": 0.6639970297029703, + "auprc": 0.703715156329214 + }, + "disc_nll_total": { + "auroc": 0.5723195319531953, + "auprc": 0.672968893842165 + }, + "terminal_flow": { + "auroc": 0.6366196869686969, + "auprc": 0.6443644698546005 + }, + "terminal_norm": { + "auroc": 0.5847101360136013, + "auprc": 0.5822115885893581 + }, + "terminal_packet": { + "auroc": 0.6004206220622063, + "auprc": 0.6574520346394832 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 303.0, + "disc_nll_ch2": 0.525866501650165, + "disc_nll_ch3": 0.5499929042904291, + "disc_nll_ch4": 0.41934125412541257, + "disc_nll_ch5": 0.5410841584158416, + "disc_nll_ch6": 0.4842140264026402, + "disc_nll_ch7": 0.5553575907590759, + "disc_nll_total": 0.4827117161716171, + "terminal_flow": 0.5781473597359736, + "terminal_norm": 0.459103300330033, + "terminal_packet": 0.5689793729372936 + }, + "browserhijacking": { + "_n": 303.0, + "disc_nll_ch2": 0.5309356435643565, + "disc_nll_ch3": 0.5625894389438943, + "disc_nll_ch4": 0.4136110561056106, + "disc_nll_ch5": 0.47690742574257416, + "disc_nll_ch6": 0.4515120462046205, + "disc_nll_ch7": 0.544806600660066, + "disc_nll_total": 0.47832722772277225, + "terminal_flow": 0.6025668316831684, + "terminal_norm": 0.5152448844884489, + "terminal_packet": 0.5621041254125413 + }, + "commandinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.5351003300330033, + "disc_nll_ch3": 0.527437293729373, + "disc_nll_ch4": 0.38200066006600664, + "disc_nll_ch5": 0.4814676567656766, + "disc_nll_ch6": 0.45277409240924094, + "disc_nll_ch7": 0.5031491749174917, + "disc_nll_total": 0.45013597359735974, + "terminal_flow": 0.5653782178217822, + "terminal_norm": 0.4861234323432343, + "terminal_packet": 0.5494760726072607 + }, + "ddos-ack_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.27857508250825086, + "disc_nll_ch3": 0.07499719471947194, + "disc_nll_ch4": 0.130653300330033, + "disc_nll_ch5": 0.2619427392739274, + "disc_nll_ch6": 0.6841476897689769, + "disc_nll_ch7": 0.4791902640264027, + "disc_nll_total": 0.28424867986798685, + "terminal_flow": 0.8867935643564356, + "terminal_norm": 0.9041077557755774, + "terminal_packet": 0.3528608910891089 + }, + "ddos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5596326732673267, + "disc_nll_ch3": 0.680636303630363, + "disc_nll_ch4": 0.5587036303630364, + "disc_nll_ch5": 0.9480580858085809, + "disc_nll_ch6": 0.5160653465346535, + "disc_nll_ch7": 0.9181625412541256, + "disc_nll_total": 0.9114823432343235, + "terminal_flow": 0.6917196369636963, + "terminal_norm": 0.7092136963696369, + "terminal_packet": 0.7990470297029703 + }, + "ddos-icmp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.4535486798679868, + "disc_nll_ch3": 0.5113260726072608, + "disc_nll_ch4": 0.5061478547854785, + "disc_nll_ch5": 0.5874221122112211, + "disc_nll_ch6": 0.4511704620462046, + "disc_nll_ch7": 0.5536252475247525, + "disc_nll_total": 0.5071460396039603, + "terminal_flow": 0.5107348184818482, + "terminal_norm": 0.4783407590759076, + "terminal_packet": 0.5010189768976898 + }, + "ddos-icmp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.4814303630363036, + "disc_nll_ch3": 0.4834344884488449, + "disc_nll_ch4": 0.4391782178217822, + "disc_nll_ch5": 0.6280160066006601, + "disc_nll_ch6": 0.4624234323432343, + "disc_nll_ch7": 0.5681409240924092, + "disc_nll_total": 0.49683300330033, + "terminal_flow": 0.5258920792079208, + "terminal_norm": 0.4834369636963696, + "terminal_packet": 0.5090584158415841 + }, + "ddos-pshack_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.18962838283828387, + "disc_nll_ch3": 0.8181059405940594, + "disc_nll_ch4": 0.5434458745874587, + "disc_nll_ch5": 0.9402848184818482, + "disc_nll_ch6": 0.9999914191419143, + "disc_nll_ch7": 0.8257501650165018, + "disc_nll_total": 0.9901531353135312, + "terminal_flow": 0.6852488448844883, + "terminal_norm": 0.6273165016501651, + "terminal_packet": 0.7492712871287128 + }, + "ddos-rstfinflood": { + "_n": 303.0, + "disc_nll_ch2": 0.21240000000000003, + "disc_nll_ch3": 0.7163999999999999, + "disc_nll_ch4": 0.9882, + "disc_nll_ch5": 0.9996, + "disc_nll_ch6": 0.4969, + "disc_nll_ch7": 1.0, + "disc_nll_total": 1.0, + "terminal_flow": 0.4484, + "terminal_norm": 0.5206, + "terminal_packet": 0.014800000000000035 + }, + "ddos-slowloris": { + "_n": 303.0, + "disc_nll_ch2": 0.4559196369636963, + "disc_nll_ch3": 0.5752721122112212, + "disc_nll_ch4": 0.5430559405940594, + "disc_nll_ch5": 0.8903630363036303, + "disc_nll_ch6": 0.7321562706270628, + "disc_nll_ch7": 0.7061392739273928, + "disc_nll_total": 0.8595161716171617, + "terminal_flow": 0.3817128712871287, + "terminal_norm": 0.3267379537953795, + "terminal_packet": 0.4807726072607261 + }, + "ddos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.23045676567656764, + "disc_nll_ch3": 0.8057171617161716, + "disc_nll_ch4": 0.49272706270627065, + "disc_nll_ch5": 0.9568313531353135, + "disc_nll_ch6": 0.32422442244224425, + "disc_nll_ch7": 0.7198435643564357, + "disc_nll_total": 0.2619224422442244, + "terminal_flow": 0.890361386138614, + "terminal_norm": 0.8373336633663366, + "terminal_packet": 0.962148184818482 + }, + "ddos-synonymousip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.30876336633663365, + "disc_nll_ch3": 0.751213201320132, + "disc_nll_ch4": 0.5012155115511552, + "disc_nll_ch5": 0.9616551155115511, + "disc_nll_ch6": 0.009831353135313529, + "disc_nll_ch7": 0.7261135313531353, + "disc_nll_total": 0.11075775577557757, + "terminal_flow": 0.9959930693069307, + "terminal_norm": 0.9108603960396039, + "terminal_packet": 0.9966425742574258 + }, + "ddos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.03078580858085807, + "disc_nll_ch3": 0.8688531353135314, + "disc_nll_ch4": 0.4969452145214521, + "disc_nll_ch5": 0.9437511551155116, + "disc_nll_ch6": 0.41941188118811884, + "disc_nll_ch7": 0.7985910891089109, + "disc_nll_total": 0.2797828382838284, + "terminal_flow": 0.8530902640264026, + "terminal_norm": 0.758476897689769, + "terminal_packet": 0.9213557755775577 + }, + "ddos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.4219402640264026, + "disc_nll_ch3": 0.3720600660066007, + "disc_nll_ch4": 0.4539069306930693, + "disc_nll_ch5": 0.8261689768976896, + "disc_nll_ch6": 0.38878283828382837, + "disc_nll_ch7": 0.3488719471947195, + "disc_nll_total": 0.2469082508250825, + "terminal_flow": 0.8798757425742574, + "terminal_norm": 0.367089108910891, + "terminal_packet": 0.4826089108910891 + }, + "ddos-udp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.4820255775577558, + "disc_nll_ch3": 0.4620749174917492, + "disc_nll_ch4": 0.3752214521452145, + "disc_nll_ch5": 0.5234943894389439, + "disc_nll_ch6": 0.5027090759075907, + "disc_nll_ch7": 0.6258800330033003, + "disc_nll_total": 0.5457760726072607, + "terminal_flow": 0.7060419141914192, + "terminal_norm": 0.49704834983498347, + "terminal_packet": 0.4619338283828383 + }, + "dictionarybruteforce": { + "_n": 303.0, + "disc_nll_ch2": 0.5576778877887789, + "disc_nll_ch3": 0.586790099009901, + "disc_nll_ch4": 0.5077499999999999, + "disc_nll_ch5": 0.5336087458745875, + "disc_nll_ch6": 0.5310749174917492, + "disc_nll_ch7": 0.6271424092409241, + "disc_nll_total": 0.5862174917491749, + "terminal_flow": 0.5233641914191419, + "terminal_norm": 0.4496326732673268, + "terminal_packet": 0.5259628712871287 + }, + "dns_spoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.431866501650165, + "disc_nll_ch3": 0.4290419141914191, + "disc_nll_ch4": 0.44313019801980197, + "disc_nll_ch5": 0.6493514851485148, + "disc_nll_ch6": 0.48942194719471943, + "disc_nll_ch7": 0.6545024752475247, + "disc_nll_total": 0.45020280528052803, + "terminal_flow": 0.5653877887788779, + "terminal_norm": 0.5339547854785479, + "terminal_packet": 0.5067138613861386 + }, + "dos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5735653465346535, + "disc_nll_ch3": 0.4827023102310231, + "disc_nll_ch4": 0.5234270627062707, + "disc_nll_ch5": 0.9427435643564356, + "disc_nll_ch6": 0.53353399339934, + "disc_nll_ch7": 0.8798950495049505, + "disc_nll_total": 0.9273511551155115, + "terminal_flow": 0.5998534653465346, + "terminal_norm": 0.6784008250825083, + "terminal_packet": 0.6767422442244225 + }, + "dos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.42487590759075905, + "disc_nll_ch3": 0.8469577557755776, + "disc_nll_ch4": 0.49808382838283827, + "disc_nll_ch5": 0.9727567656765678, + "disc_nll_ch6": 0.25081518151815185, + "disc_nll_ch7": 0.9055353135313532, + "disc_nll_total": 0.6570151815181519, + "terminal_flow": 0.6818062706270628, + "terminal_norm": 0.7237323432343234, + "terminal_packet": 0.9702566006600659 + }, + "dos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5084188118811881, + "disc_nll_ch3": 0.821459405940594, + "disc_nll_ch4": 0.5033346534653466, + "disc_nll_ch5": 0.9718079207920791, + "disc_nll_ch6": 0.3655726072607261, + "disc_nll_ch7": 0.9243788778877887, + "disc_nll_total": 0.7713353135313531, + "terminal_flow": 0.6774528052805281, + "terminal_norm": 0.6626689768976898, + "terminal_packet": 0.8978277227722773 + }, + "dos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.2645557755775578, + "disc_nll_ch3": 0.7437138613861386, + "disc_nll_ch4": 0.49605841584158417, + "disc_nll_ch5": 0.9566062706270627, + "disc_nll_ch6": 0.37046039603960396, + "disc_nll_ch7": 0.6190376237623763, + "disc_nll_total": 0.06084950495049506, + "terminal_flow": 0.9318749174917492, + "terminal_norm": 0.9023348184818482, + "terminal_packet": 0.9960141914191418 + }, + "mirai-greeth_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5990651815181518, + "disc_nll_ch3": 0.5048067656765677, + "disc_nll_ch4": 0.31975115511551155, + "disc_nll_ch5": 0.4940475247524754, + "disc_nll_ch6": 0.4234374587458745, + "disc_nll_ch7": 0.5292214521452145, + "disc_nll_total": 0.5418696369636964, + "terminal_flow": 0.6817595709570957, + "terminal_norm": 0.5749902640264026, + "terminal_packet": 0.49160066006600656 + }, + "mirai-greip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5348785478547854, + "disc_nll_ch3": 0.4871491749174917, + "disc_nll_ch4": 0.38794422442244225, + "disc_nll_ch5": 0.6203300330033004, + "disc_nll_ch6": 0.4653480198019802, + "disc_nll_ch7": 0.558309900990099, + "disc_nll_total": 0.571581188118812, + "terminal_flow": 0.5729501650165016, + "terminal_norm": 0.5352168316831684, + "terminal_packet": 0.6164201320132013 + }, + "mirai-udpplain": { + "_n": 303.0, + "disc_nll_ch2": 0.5746747524752475, + "disc_nll_ch3": 0.5392290429042904, + "disc_nll_ch4": 0.36292524752475247, + "disc_nll_ch5": 0.650576402640264, + "disc_nll_ch6": 0.45514108910891093, + "disc_nll_ch7": 0.5537196369636965, + "disc_nll_total": 0.6228275577557756, + "terminal_flow": 0.70098399339934, + "terminal_norm": 0.5612153465346534, + "terminal_packet": 0.5401275577557756 + }, + "mitm-arpspoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.5270684818481848, + "disc_nll_ch3": 0.43439290429042904, + "disc_nll_ch4": 0.42994273927392745, + "disc_nll_ch5": 0.5144199669966997, + "disc_nll_ch6": 0.4409986798679868, + "disc_nll_ch7": 0.5775443894389438, + "disc_nll_total": 0.48680313531353137, + "terminal_flow": 0.563789603960396, + "terminal_norm": 0.5096391089108911, + "terminal_packet": 0.5578120462046204 + }, + "recon-hostdiscovery": { + "_n": 303.0, + "disc_nll_ch2": 0.13964653465346535, + "disc_nll_ch3": 0.7277006600660068, + "disc_nll_ch4": 0.6969808580858086, + "disc_nll_ch5": 0.9214293729372939, + "disc_nll_ch6": 0.4707475247524753, + "disc_nll_ch7": 0.8131531353135314, + "disc_nll_total": 0.9701907590759077, + "terminal_flow": 0.4778227722772277, + "terminal_norm": 0.5487118811881188, + "terminal_packet": 0.29874059405940595 + }, + "recon-osscan": { + "_n": 303.0, + "disc_nll_ch2": 0.5983112211221122, + "disc_nll_ch3": 0.8023973597359737, + "disc_nll_ch4": 0.5778577557755775, + "disc_nll_ch5": 0.8432722772277228, + "disc_nll_ch6": 0.45261056105610564, + "disc_nll_ch7": 0.8353650165016502, + "disc_nll_total": 0.8794953795379538, + "terminal_flow": 0.622317491749175, + "terminal_norm": 0.6518011551155116, + "terminal_packet": 0.6090570957095709 + }, + "recon-pingsweep": { + "_n": 303.0, + "disc_nll_ch2": 0.568590594059406, + "disc_nll_ch3": 0.49486864686468646, + "disc_nll_ch4": 0.4637216171617162, + "disc_nll_ch5": 0.530663696369637, + "disc_nll_ch6": 0.5702592409240925, + "disc_nll_ch7": 0.5309721122112212, + "disc_nll_total": 0.5678333333333333, + "terminal_flow": 0.516383498349835, + "terminal_norm": 0.48564240924092406, + "terminal_packet": 0.5152288778877888 + }, + "recon-portscan": { + "_n": 303.0, + "disc_nll_ch2": 0.5363136963696369, + "disc_nll_ch3": 0.8125915841584159, + "disc_nll_ch4": 0.599963201320132, + "disc_nll_ch5": 0.8725990099009902, + "disc_nll_ch6": 0.4477397689768977, + "disc_nll_ch7": 0.8198435643564357, + "disc_nll_total": 0.8634488448844886, + "terminal_flow": 0.563316501650165, + "terminal_norm": 0.6216717821782177, + "terminal_packet": 0.5778803630363036 + }, + "sqlinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.5036453795379539, + "disc_nll_ch3": 0.46284983498349835, + "disc_nll_ch4": 0.544322607260726, + "disc_nll_ch5": 0.5694752475247524, + "disc_nll_ch6": 0.5370112211221122, + "disc_nll_ch7": 0.5247414191419142, + "disc_nll_total": 0.4920846534653466, + "terminal_flow": 0.45251518151815184, + "terminal_norm": 0.439206600660066, + "terminal_packet": 0.46096320132013197 + }, + "uploading_attack": { + "_n": 303.0, + "disc_nll_ch2": 0.5296828382838283, + "disc_nll_ch3": 0.50496600660066, + "disc_nll_ch4": 0.355400495049505, + "disc_nll_ch5": 0.47938399339933996, + "disc_nll_ch6": 0.46282029702970295, + "disc_nll_ch7": 0.5134125412541254, + "disc_nll_total": 0.43563366336633663, + "terminal_flow": 0.566015511551155, + "terminal_norm": 0.4823759075907591, + "terminal_packet": 0.545806600660066 + }, + "vulnerabilityscan": { + "_n": 303.0, + "disc_nll_ch2": 0.5478202970297029, + "disc_nll_ch3": 0.5463628712871286, + "disc_nll_ch4": 0.4871980198019802, + "disc_nll_ch5": 0.6291968646864686, + "disc_nll_ch6": 0.4642089108910891, + "disc_nll_ch7": 0.5968242574257425, + "disc_nll_total": 0.5702993399339934, + "terminal_flow": 0.516220792079208, + "terminal_norm": 0.5525313531353135, + "terminal_packet": 0.5548226072607261 + }, + "xss": { + "_n": 303.0, + "disc_nll_ch2": 0.571039603960396, + "disc_nll_ch3": 0.5660470297029703, + "disc_nll_ch4": 0.41808861386138607, + "disc_nll_ch5": 0.5337447194719471, + "disc_nll_ch6": 0.4735023102310231, + "disc_nll_ch7": 0.5746808580858086, + "disc_nll_total": 0.5258039603960396, + "terminal_flow": 0.5926785478547854, + "terminal_norm": 0.5006737623762377, + "terminal_packet": 0.5598252475247525 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_ciciot2023.log b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_ciciot2023.log new file mode 100644 index 0000000..f5c7bc2 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_ciciot2023.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,193,621 target rows +[sample] benign=10,000 attack=9,999 (33 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/9,999 +[score] 5,376/9,999 +[eval] attack done 3.9s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_ciciot2023.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_ciciot2023.npz b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_ciciot2023.npz new file mode 100644 index 0000000..d58a372 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_ciciot2023.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_iscxtor2016.json b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_iscxtor2016.json new file mode 100644 index 0000000..aac5b83 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_iscxtor2016.json @@ -0,0 +1,64 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44", + "target_store": "None", + "n_benign": 10000, + "n_attack": 1888, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.6017867319915254, + "auprc": 0.2034772605297569 + }, + "disc_nll_ch3": { + "auroc": 0.33177195444915253, + "auprc": 0.14627406176341268 + }, + "disc_nll_ch4": { + "auroc": 0.3335382150423729, + "auprc": 0.14710930350312185 + }, + "disc_nll_ch5": { + "auroc": 0.32142097457627117, + "auprc": 0.11930434159098612 + }, + "disc_nll_ch6": { + "auroc": 0.555410063559322, + "auprc": 0.17044533080370555 + }, + "disc_nll_ch7": { + "auroc": 0.5797735434322034, + "auprc": 0.21605084713686298 + }, + "disc_nll_total": { + "auroc": 0.5727455243644068, + "auprc": 0.1939817546160625 + }, + "terminal_flow": { + "auroc": 0.7491326006355932, + "auprc": 0.3399375995880328 + }, + "terminal_norm": { + "auroc": 0.6608413930084746, + "auprc": 0.36725606615249556 + }, + "terminal_packet": { + "auroc": 0.6689226430084745, + "auprc": 0.31470554921548277 + } + }, + "per_class": { + "tor": { + "_n": 1888.0, + "disc_nll_ch2": 0.6017867319915254, + "disc_nll_ch3": 0.33177195444915253, + "disc_nll_ch4": 0.3335382150423729, + "disc_nll_ch5": 0.32142097457627117, + "disc_nll_ch6": 0.555410063559322, + "disc_nll_ch7": 0.5797735434322034, + "disc_nll_total": 0.5727455243644068, + "terminal_flow": 0.7491326006355932, + "terminal_norm": 0.6608413930084746, + "terminal_packet": 0.6689226430084745 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_iscxtor2016.log b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_iscxtor2016.log new file mode 100644 index 0000000..e9240c7 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_iscxtor2016.log @@ -0,0 +1,13 @@ +[model] T=64 flow_dim=20 +[data] 103,079 target rows +[sample] benign=10,000 attack=1,888 (1 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.2s +[eval] attack... +[score] 256/1,888 +[eval] attack done 0.7s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_iscxtor2016.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_iscxtor2016.npz b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_iscxtor2016.npz new file mode 100644 index 0000000..0295bd9 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicddos2019_to_iscxtor2016.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_cicddos2019.json b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_cicddos2019.json new file mode 100644 index 0000000..429f829 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_cicddos2019.json @@ -0,0 +1,272 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.2798157170424538, + "auprc": 0.3736776502253623 + }, + "disc_nll_ch3": { + "auroc": 0.36832012492382693, + "auprc": 0.44457679303740977 + }, + "disc_nll_ch4": { + "auroc": 0.5271894068657323, + "auprc": 0.46569313973453436 + }, + "disc_nll_ch5": { + "auroc": 0.6127483191143612, + "auprc": 0.5340381576782528 + }, + "disc_nll_ch6": { + "auroc": 0.5839055504773513, + "auprc": 0.49852384855382537 + }, + "disc_nll_ch7": { + "auroc": 0.12684880662197845, + "auprc": 0.3396572416203669 + }, + "disc_nll_total": { + "auroc": 0.16146277676213694, + "auprc": 0.33971692677662174 + }, + "terminal_flow": { + "auroc": 0.9198392240503757, + "auprc": 0.9012116584770041 + }, + "terminal_norm": { + "auroc": 0.8674866087751371, + "auprc": 0.8571842778537522 + }, + "terminal_packet": { + "auroc": 0.6099891580337193, + "auprc": 0.5241901927342616 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "disc_nll_ch2": 0.13208248299319725, + "disc_nll_ch3": 0.5228964285714287, + "disc_nll_ch4": 0.5754369897959184, + "disc_nll_ch5": 0.7624145408163265, + "disc_nll_ch6": 0.6500215986394557, + "disc_nll_ch7": 0.007834523809523796, + "disc_nll_total": 0.0031835884353741844, + "terminal_flow": 0.9937276360544218, + "terminal_norm": 0.994367006802721, + "terminal_packet": 0.7674045068027212 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.13077278911564627, + "disc_nll_ch3": 0.5376654761904762, + "disc_nll_ch4": 0.5825028911564626, + "disc_nll_ch5": 0.7746442176870748, + "disc_nll_ch6": 0.6549613945578232, + "disc_nll_ch7": 0.00621309523809522, + "disc_nll_total": 0.0017612244897959597, + "terminal_flow": 0.9987877551020408, + "terminal_norm": 0.9998316326530612, + "terminal_packet": 0.7820481292517008 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.14644761904761905, + "disc_nll_ch3": 0.35239719387755103, + "disc_nll_ch4": 0.5325710884353742, + "disc_nll_ch5": 0.6896821428571428, + "disc_nll_ch6": 0.6084743197278912, + "disc_nll_ch7": 0.005571938775510233, + "disc_nll_total": 0.0008812925170067958, + "terminal_flow": 0.9551892857142857, + "terminal_norm": 0.9580605442176869, + "terminal_packet": 0.5650916666666664 + }, + "DrDoS_NTP": { + "_n": 588.0, + "disc_nll_ch2": 0.4716933673469388, + "disc_nll_ch3": 0.06997006802721088, + "disc_nll_ch4": 0.5280198979591837, + "disc_nll_ch5": 0.7420517006802723, + "disc_nll_ch6": 0.5705630952380952, + "disc_nll_ch7": 0.005017006802721087, + "disc_nll_total": 0.0741234693877551, + "terminal_flow": 0.9560318027210885, + "terminal_norm": 0.5504083333333333, + "terminal_packet": 0.44549234693877554 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.1872593537414966, + "disc_nll_ch3": 0.14440714285714287, + "disc_nll_ch4": 0.3810113945578231, + "disc_nll_ch5": 0.338846768707483, + "disc_nll_ch6": 0.5456692176870748, + "disc_nll_ch7": 0.006003231292517003, + "disc_nll_total": 5.8163265306119825e-05, + "terminal_flow": 0.8856124149659863, + "terminal_norm": 0.7920795918367347, + "terminal_packet": 0.44928911564625856 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "disc_nll_ch2": 0.1327482993197279, + "disc_nll_ch3": 0.5197295918367346, + "disc_nll_ch4": 0.5728452380952381, + "disc_nll_ch5": 0.7538882653061225, + "disc_nll_ch6": 0.6498404761904761, + "disc_nll_ch7": 0.006184863945578216, + "disc_nll_total": 0.0014768707482993458, + "terminal_flow": 0.9932416666666667, + "terminal_norm": 0.9900843537414965, + "terminal_packet": 0.7636423469387755 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "disc_nll_ch2": 0.4039965986394558, + "disc_nll_ch3": 0.17693231292517006, + "disc_nll_ch4": 0.5245773809523809, + "disc_nll_ch5": 0.6330428571428571, + "disc_nll_ch6": 0.5972044217687075, + "disc_nll_ch7": 0.004092176870748291, + "disc_nll_total": 0.16665561224489794, + "terminal_flow": 0.9229521258503403, + "terminal_norm": 0.8472481292517007, + "terminal_packet": 0.5239789965986393 + }, + "DrDoS_UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.4110302721088436, + "disc_nll_ch3": 0.17008282312925171, + "disc_nll_ch4": 0.5226661564625851, + "disc_nll_ch5": 0.6266345238095238, + "disc_nll_ch6": 0.5961418367346939, + "disc_nll_ch7": 0.0040467687074829855, + "disc_nll_total": 0.16946275510204084, + "terminal_flow": 0.9211520408163265, + "terminal_norm": 0.8520465986394558, + "terminal_packet": 0.5191068877551019 + }, + "LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.1314173469387755, + "disc_nll_ch3": 0.5381663265306122, + "disc_nll_ch4": 0.5826188775510204, + "disc_nll_ch5": 0.7749292517006803, + "disc_nll_ch6": 0.6545969387755102, + "disc_nll_ch7": 0.0074923469387754875, + "disc_nll_total": 0.0029204081632653463, + "terminal_flow": 0.9980025510204081, + "terminal_norm": 0.9994625850340136, + "terminal_packet": 0.7823591836734695 + }, + "MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.14792091836734694, + "disc_nll_ch3": 0.3469695578231292, + "disc_nll_ch4": 0.5319955782312925, + "disc_nll_ch5": 0.6838292517006803, + "disc_nll_ch6": 0.607046768707483, + "disc_nll_ch7": 0.005521598639455809, + "disc_nll_total": 0.0002484693877550941, + "terminal_flow": 0.9525469387755102, + "terminal_norm": 0.9577746598639456, + "terminal_packet": 0.5626344387755102 + }, + "NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.18843758503401362, + "disc_nll_ch3": 0.14303954081632653, + "disc_nll_ch4": 0.384487925170068, + "disc_nll_ch5": 0.3366108843537415, + "disc_nll_ch6": 0.5427522108843538, + "disc_nll_ch7": 0.0059188775510204085, + "disc_nll_total": 0.00010255102040815896, + "terminal_flow": 0.8892974489795918, + "terminal_norm": 0.7959719387755102, + "terminal_packet": 0.4515624149659864 + }, + "Portmap": { + "_n": 588.0, + "disc_nll_ch2": 0.19016921768707482, + "disc_nll_ch3": 0.1449537414965986, + "disc_nll_ch4": 0.3809952380952381, + "disc_nll_ch5": 0.3380984693877551, + "disc_nll_ch6": 0.5429447278911564, + "disc_nll_ch7": 0.008455952380952378, + "disc_nll_total": 0.002760884353741493, + "terminal_flow": 0.8873501700680273, + "terminal_norm": 0.7957372448979593, + "terminal_packet": 0.4537855442176871 + }, + "Syn": { + "_n": 588.0, + "disc_nll_ch2": 0.47615510204081635, + "disc_nll_ch3": 0.933618537414966, + "disc_nll_ch4": 0.5823848639455782, + "disc_nll_ch5": 0.5936462585034014, + "disc_nll_ch6": 0.42599557823129247, + "disc_nll_ch7": 0.7557547619047619, + "disc_nll_total": 0.6962227891156463, + "terminal_flow": 0.8190246598639455, + "terminal_norm": 0.8453760204081632, + "terminal_packet": 0.7983493197278912 + }, + "TFTP": { + "_n": 588.0, + "disc_nll_ch2": 0.3833991496598639, + "disc_nll_ch3": 0.21347295918367348, + "disc_nll_ch4": 0.525915306122449, + "disc_nll_ch5": 0.7210404761904762, + "disc_nll_ch6": 0.6223178571428571, + "disc_nll_ch7": 0.009728571428571418, + "disc_nll_total": 0.19315051020408167, + "terminal_flow": 0.9720115646258504, + "terminal_norm": 0.9322799319727891, + "terminal_packet": 0.6176193027210884 + }, + "UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.4240239795918367, + "disc_nll_ch3": 0.16646156462585032, + "disc_nll_ch4": 0.5228151360544219, + "disc_nll_ch5": 0.6348707482993198, + "disc_nll_ch6": 0.595711224489796, + "disc_nll_ch7": 0.00390595238095237, + "disc_nll_total": 0.18060578231292515, + "terminal_flow": 0.9214576530612246, + "terminal_norm": 0.8450238095238095, + "terminal_packet": 0.5200774659863946 + }, + "UDPLag": { + "_n": 588.0, + "disc_nll_ch2": 0.4588916666666667, + "disc_nll_ch3": 0.8592913265306122, + "disc_nll_ch4": 0.5864469387755102, + "disc_nll_ch5": 0.5719214285714285, + "disc_nll_ch6": 0.44446224489795916, + "disc_nll_ch7": 0.678845068027211, + "disc_nll_total": 0.6279959183673469, + "terminal_flow": 0.8695305272108844, + "terminal_norm": 0.8682375850340136, + "terminal_packet": 0.7755511904761906 + }, + "WebDDoS": { + "_n": 438.0, + "disc_nll_ch2": 0.3611768264840183, + "disc_nll_ch3": 0.439561301369863, + "disc_nll_ch4": 0.685250799086758, + "disc_nll_ch5": 0.3816043378995434, + "disc_nll_ch6": 0.6292606164383562, + "disc_nll_ch7": 0.8101560502283106, + "disc_nll_total": 0.7814055936073059, + "terminal_flow": 0.6265256849315067, + "terminal_norm": 0.6738973744292238, + "terminal_packet": 0.5856014840182648 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_cicddos2019.log b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_cicddos2019.log new file mode 100644 index 0000000..217b7ef --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_cicddos2019.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,993,376 target rows +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.4s +[eval] attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done 3.8s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_cicddos2019.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_cicddos2019.npz new file mode 100644 index 0000000..d70fbc9 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_ciciot2023.json b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_ciciot2023.json new file mode 100644 index 0000000..46018d2 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_ciciot2023.json @@ -0,0 +1,480 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "n_benign": 10000, + "n_attack": 9999, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.5304158465846585, + "auprc": 0.4898417826002671 + }, + "disc_nll_ch3": { + "auroc": 0.4995263176317632, + "auprc": 0.5794054009175561 + }, + "disc_nll_ch4": { + "auroc": 0.5890261726172616, + "auprc": 0.5926585800011416 + }, + "disc_nll_ch5": { + "auroc": 0.6695392939293929, + "auprc": 0.6997642089136182 + }, + "disc_nll_ch6": { + "auroc": 0.5064609460946095, + "auprc": 0.5364044133515081 + }, + "disc_nll_ch7": { + "auroc": 0.5685216221622162, + "auprc": 0.5398765783431845 + }, + "disc_nll_total": { + "auroc": 0.5910114761476147, + "auprc": 0.64881477984395 + }, + "terminal_flow": { + "auroc": 0.655053200320032, + "auprc": 0.6742457057212861 + }, + "terminal_norm": { + "auroc": 0.6461488248824883, + "auprc": 0.6359105017997977 + }, + "terminal_packet": { + "auroc": 0.6575017951795179, + "auprc": 0.6348901474786421 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 303.0, + "disc_nll_ch2": 0.6079179867986798, + "disc_nll_ch3": 0.32389488448844883, + "disc_nll_ch4": 0.516759405940594, + "disc_nll_ch5": 0.5627031353135314, + "disc_nll_ch6": 0.5445950495049505, + "disc_nll_ch7": 0.40969273927392735, + "disc_nll_total": 0.4389221122112211, + "terminal_flow": 0.5637212871287128, + "terminal_norm": 0.5932414191419141, + "terminal_packet": 0.6212513201320132 + }, + "browserhijacking": { + "_n": 303.0, + "disc_nll_ch2": 0.5540813531353136, + "disc_nll_ch3": 0.3275105610561056, + "disc_nll_ch4": 0.47704389438943895, + "disc_nll_ch5": 0.5389539603960396, + "disc_nll_ch6": 0.48713564356435646, + "disc_nll_ch7": 0.4559800330033003, + "disc_nll_total": 0.4183717821782178, + "terminal_flow": 0.49651402640264025, + "terminal_norm": 0.4427344884488449, + "terminal_packet": 0.5026450495049506 + }, + "commandinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.5767810231023103, + "disc_nll_ch3": 0.31566138613861383, + "disc_nll_ch4": 0.46980313531353135, + "disc_nll_ch5": 0.5012455445544555, + "disc_nll_ch6": 0.510893399339934, + "disc_nll_ch7": 0.4230783828382838, + "disc_nll_total": 0.39194504950495046, + "terminal_flow": 0.5259656765676568, + "terminal_norm": 0.561656600660066, + "terminal_packet": 0.6003178217821783 + }, + "ddos-ack_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.24082062706270624, + "disc_nll_ch3": 0.4333780528052805, + "disc_nll_ch4": 0.5826387788778878, + "disc_nll_ch5": 0.7988691419141914, + "disc_nll_ch6": 0.6886793729372938, + "disc_nll_ch7": 0.8530222772277228, + "disc_nll_total": 0.9631645214521452, + "terminal_flow": 0.9867589108910891, + "terminal_norm": 0.9892016501650165, + "terminal_packet": 0.9359671617161714 + }, + "ddos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6158894389438943, + "disc_nll_ch3": 0.6330079207920791, + "disc_nll_ch4": 0.6662590759075907, + "disc_nll_ch5": 0.9173627062706271, + "disc_nll_ch6": 0.37240264026402636, + "disc_nll_ch7": 0.6884600660066007, + "disc_nll_total": 0.8326973597359735, + "terminal_flow": 0.6684407590759076, + "terminal_norm": 0.7129638613861387, + "terminal_packet": 0.6960638613861386 + }, + "ddos-icmp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5075597359735974, + "disc_nll_ch3": 0.48401567656765676, + "disc_nll_ch4": 0.49199125412541256, + "disc_nll_ch5": 0.5606062706270628, + "disc_nll_ch6": 0.545174092409241, + "disc_nll_ch7": 0.517890594059406, + "disc_nll_total": 0.514619801980198, + "terminal_flow": 0.48438366336633665, + "terminal_norm": 0.4690003300330033, + "terminal_packet": 0.5079447194719472 + }, + "ddos-icmp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.5400214521452145, + "disc_nll_ch3": 0.3247310231023102, + "disc_nll_ch4": 0.44646699669967, + "disc_nll_ch5": 0.5431831683168317, + "disc_nll_ch6": 0.5105415841584159, + "disc_nll_ch7": 0.47396699669966996, + "disc_nll_total": 0.4457112211221122, + "terminal_flow": 0.543893399339934, + "terminal_norm": 0.5617889438943895, + "terminal_packet": 0.5665570957095709 + }, + "ddos-pshack_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6025861386138613, + "disc_nll_ch3": 0.9458257425742574, + "disc_nll_ch4": 0.6401036303630363, + "disc_nll_ch5": 0.6460049504950496, + "disc_nll_ch6": 0.9998706270627062, + "disc_nll_ch7": 0.7695910891089109, + "disc_nll_total": 0.9961537953795379, + "terminal_flow": 0.763364686468647, + "terminal_norm": 0.7392739273927393, + "terminal_packet": 0.7756755775577556 + }, + "ddos-rstfinflood": { + "_n": 303.0, + "disc_nll_ch2": 0.20209999999999995, + "disc_nll_ch3": 0.5078, + "disc_nll_ch4": 0.9999, + "disc_nll_ch5": 0.9999999999999999, + "disc_nll_ch6": 0.5074000000000001, + "disc_nll_ch7": 0.7387, + "disc_nll_total": 0.999, + "terminal_flow": 0.9839, + "terminal_norm": 0.9937, + "terminal_packet": 0.9944 + }, + "ddos-slowloris": { + "_n": 303.0, + "disc_nll_ch2": 0.5776892739273928, + "disc_nll_ch3": 0.5254042904290428, + "disc_nll_ch4": 0.6365978547854785, + "disc_nll_ch5": 0.9125409240924094, + "disc_nll_ch6": 0.7575333333333334, + "disc_nll_ch7": 0.5289397689768977, + "disc_nll_total": 0.817469801980198, + "terminal_flow": 0.570768811881188, + "terminal_norm": 0.5743163366336633, + "terminal_packet": 0.6003138613861387 + }, + "ddos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6652168316831684, + "disc_nll_ch3": 0.7541343234323432, + "disc_nll_ch4": 0.7454808580858086, + "disc_nll_ch5": 0.8101033003300331, + "disc_nll_ch6": 0.2893973597359736, + "disc_nll_ch7": 0.7464504950495049, + "disc_nll_total": 0.5288155115511551, + "terminal_flow": 0.7304600660066006, + "terminal_norm": 0.726862706270627, + "terminal_packet": 0.732257095709571 + }, + "ddos-synonymousip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.7338049504950495, + "disc_nll_ch3": 0.9726841584158414, + "disc_nll_ch4": 0.9841587458745875, + "disc_nll_ch5": 0.9761145214521452, + "disc_nll_ch6": 0.7503478547854785, + "disc_nll_ch7": 0.7699828382838283, + "disc_nll_total": 0.965519801980198, + "terminal_flow": 0.9969815181518151, + "terminal_norm": 0.7409356435643564, + "terminal_packet": 0.6847498349834984 + }, + "ddos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.4684033003300331, + "disc_nll_ch3": 0.9932917491749175, + "disc_nll_ch4": 0.7450689768976897, + "disc_nll_ch5": 0.7534174917491749, + "disc_nll_ch6": 0.11744752475247523, + "disc_nll_ch7": 0.7416201320132013, + "disc_nll_total": 0.5524247524752476, + "terminal_flow": 0.7216518151815181, + "terminal_norm": 0.7043171617161716, + "terminal_packet": 0.7030501650165017 + }, + "ddos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.658360396039604, + "disc_nll_ch3": 0.1029633663366337, + "disc_nll_ch4": 0.6487409240924091, + "disc_nll_ch5": 0.6638805280528053, + "disc_nll_ch6": 0.659953795379538, + "disc_nll_ch7": 0.354689108910891, + "disc_nll_total": 0.2040676567656766, + "terminal_flow": 0.8544825082508252, + "terminal_norm": 0.6459501650165015, + "terminal_packet": 0.6945481848184819 + }, + "ddos-udp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.6020150165016501, + "disc_nll_ch3": 0.3564206270627063, + "disc_nll_ch4": 0.5772133663366337, + "disc_nll_ch5": 0.6339105610561057, + "disc_nll_ch6": 0.5673721122112211, + "disc_nll_ch7": 0.4755691419141914, + "disc_nll_total": 0.5599141914191419, + "terminal_flow": 0.6763734323432343, + "terminal_norm": 0.6019452145214521, + "terminal_packet": 0.5801539603960396 + }, + "dictionarybruteforce": { + "_n": 303.0, + "disc_nll_ch2": 0.6031392739273927, + "disc_nll_ch3": 0.46338481848184815, + "disc_nll_ch4": 0.5999881188118812, + "disc_nll_ch5": 0.6141861386138614, + "disc_nll_ch6": 0.5836364686468647, + "disc_nll_ch7": 0.4712778877887789, + "disc_nll_total": 0.4972308580858086, + "terminal_flow": 0.551924587458746, + "terminal_norm": 0.5433367986798681, + "terminal_packet": 0.5734704620462047 + }, + "dns_spoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.4659859735973597, + "disc_nll_ch3": 0.28638151815181523, + "disc_nll_ch4": 0.4517513201320132, + "disc_nll_ch5": 0.5074127062706271, + "disc_nll_ch6": 0.46420478547854793, + "disc_nll_ch7": 0.40581881188118807, + "disc_nll_total": 0.35061650165016506, + "terminal_flow": 0.5995354785478548, + "terminal_norm": 0.591719801980198, + "terminal_packet": 0.543901815181518 + }, + "dos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5120706270627063, + "disc_nll_ch3": 0.4625221122112211, + "disc_nll_ch4": 0.5061752475247525, + "disc_nll_ch5": 0.942016501650165, + "disc_nll_ch6": 0.39752277227722776, + "disc_nll_ch7": 0.5909382838283829, + "disc_nll_total": 0.9020181518151815, + "terminal_flow": 0.7013009900990098, + "terminal_norm": 0.7699196369636963, + "terminal_packet": 0.6867270627062706 + }, + "dos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.7245811881188119, + "disc_nll_ch3": 0.7561808580858085, + "disc_nll_ch4": 0.8083184818481848, + "disc_nll_ch5": 0.9404128712871287, + "disc_nll_ch6": 0.45592673267326733, + "disc_nll_ch7": 0.7550485148514852, + "disc_nll_total": 0.5876016501650165, + "terminal_flow": 0.7395518151815182, + "terminal_norm": 0.6770874587458745, + "terminal_packet": 0.7101534653465346 + }, + "dos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.7235716171617163, + "disc_nll_ch3": 0.9150940594059407, + "disc_nll_ch4": 0.7428910891089109, + "disc_nll_ch5": 0.9258488448844885, + "disc_nll_ch6": 0.22237194719471942, + "disc_nll_ch7": 0.7535326732673268, + "disc_nll_total": 0.7967326732673268, + "terminal_flow": 0.6977003300330034, + "terminal_norm": 0.6725904290429042, + "terminal_packet": 0.6952910891089109 + }, + "dos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.2767778877887789, + "disc_nll_ch3": 0.18124422442244223, + "disc_nll_ch4": 0.7341716171617161, + "disc_nll_ch5": 0.7111861386138614, + "disc_nll_ch6": 0.4153125412541254, + "disc_nll_ch7": 0.3079914191419142, + "disc_nll_total": 0.06590462046204622, + "terminal_flow": 0.723092409240924, + "terminal_norm": 0.6542293729372937, + "terminal_packet": 0.7412735973597359 + }, + "mirai-greeth_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.566296204620462, + "disc_nll_ch3": 0.3111110561056106, + "disc_nll_ch4": 0.4428242574257425, + "disc_nll_ch5": 0.545406105610561, + "disc_nll_ch6": 0.4379806930693069, + "disc_nll_ch7": 0.4728727722772278, + "disc_nll_total": 0.39836452145214524, + "terminal_flow": 0.4531699669966997, + "terminal_norm": 0.4008417491749175, + "terminal_packet": 0.3811349834983499 + }, + "mirai-greip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.6221745874587459, + "disc_nll_ch3": 0.35595544554455444, + "disc_nll_ch4": 0.4686783828382838, + "disc_nll_ch5": 0.6127450495049505, + "disc_nll_ch6": 0.5237935643564356, + "disc_nll_ch7": 0.5008843234323432, + "disc_nll_total": 0.551816501650165, + "terminal_flow": 0.5542610561056106, + "terminal_norm": 0.590173102310231, + "terminal_packet": 0.6074092409240924 + }, + "mirai-udpplain": { + "_n": 303.0, + "disc_nll_ch2": 0.5679975247524751, + "disc_nll_ch3": 0.33587046204620463, + "disc_nll_ch4": 0.5133651815181519, + "disc_nll_ch5": 0.6537384488448845, + "disc_nll_ch6": 0.49333745874587454, + "disc_nll_ch7": 0.512973102310231, + "disc_nll_total": 0.5514932343234323, + "terminal_flow": 0.5831445544554456, + "terminal_norm": 0.5384772277227723, + "terminal_packet": 0.5412981848184819 + }, + "mitm-arpspoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.5546777227722772, + "disc_nll_ch3": 0.29133052805280524, + "disc_nll_ch4": 0.3620519801980198, + "disc_nll_ch5": 0.47642854785478544, + "disc_nll_ch6": 0.5142980198019802, + "disc_nll_ch7": 0.45623910891089114, + "disc_nll_total": 0.4090404290429043, + "terminal_flow": 0.4835859735973597, + "terminal_norm": 0.5233410891089109, + "terminal_packet": 0.55761600660066 + }, + "recon-hostdiscovery": { + "_n": 303.0, + "disc_nll_ch2": 0.13393828382838283, + "disc_nll_ch3": 0.7410224422442244, + "disc_nll_ch4": 0.5341470297029702, + "disc_nll_ch5": 0.4312813531353135, + "disc_nll_ch6": 0.5107239273927393, + "disc_nll_ch7": 0.7824013201320132, + "disc_nll_total": 0.8299333333333333, + "terminal_flow": 0.9381257425742574, + "terminal_norm": 0.9561542904290428, + "terminal_packet": 0.95649900990099 + }, + "recon-osscan": { + "_n": 303.0, + "disc_nll_ch2": 0.4786818481848185, + "disc_nll_ch3": 0.7223254125412542, + "disc_nll_ch4": 0.6172056105610562, + "disc_nll_ch5": 0.6716754125412541, + "disc_nll_ch6": 0.39144108910891084, + "disc_nll_ch7": 0.675593399339934, + "disc_nll_total": 0.789108910891089, + "terminal_flow": 0.6542993399339935, + "terminal_norm": 0.7058145214521452, + "terminal_packet": 0.7017514851485148 + }, + "recon-pingsweep": { + "_n": 303.0, + "disc_nll_ch2": 0.5441950495049506, + "disc_nll_ch3": 0.36872326732673266, + "disc_nll_ch4": 0.4944466996699669, + "disc_nll_ch5": 0.5257597359735975, + "disc_nll_ch6": 0.5251755775577558, + "disc_nll_ch7": 0.5059567656765676, + "disc_nll_total": 0.5115957095709571, + "terminal_flow": 0.5714747524752475, + "terminal_norm": 0.6165046204620462, + "terminal_packet": 0.6801176567656766 + }, + "recon-portscan": { + "_n": 303.0, + "disc_nll_ch2": 0.41888003300330034, + "disc_nll_ch3": 0.7524089108910891, + "disc_nll_ch4": 0.6121359735973597, + "disc_nll_ch5": 0.6555021452145213, + "disc_nll_ch6": 0.4303282178217822, + "disc_nll_ch7": 0.7024991749174918, + "disc_nll_total": 0.7990450495049505, + "terminal_flow": 0.6776577557755775, + "terminal_norm": 0.726137293729373, + "terminal_packet": 0.6930217821782179 + }, + "sqlinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.5218800330033002, + "disc_nll_ch3": 0.42390660066006597, + "disc_nll_ch4": 0.47853415841584157, + "disc_nll_ch5": 0.47795396039603966, + "disc_nll_ch6": 0.5508018151815182, + "disc_nll_ch7": 0.5173978547854786, + "disc_nll_total": 0.5145351485148515, + "terminal_flow": 0.5098816831683168, + "terminal_norm": 0.5341633663366336, + "terminal_packet": 0.5993546204620462 + }, + "uploading_attack": { + "_n": 303.0, + "disc_nll_ch2": 0.6027772277227723, + "disc_nll_ch3": 0.2938155115511551, + "disc_nll_ch4": 0.4419641914191419, + "disc_nll_ch5": 0.5070194719471948, + "disc_nll_ch6": 0.5229364686468647, + "disc_nll_ch7": 0.3964351485148515, + "disc_nll_total": 0.369813201320132, + "terminal_flow": 0.5164524752475248, + "terminal_norm": 0.6030471947194719, + "terminal_packet": 0.6435775577557755 + }, + "vulnerabilityscan": { + "_n": 303.0, + "disc_nll_ch2": 0.45258646864686464, + "disc_nll_ch3": 0.4819336633663366, + "disc_nll_ch4": 0.4545874587458746, + "disc_nll_ch5": 0.5164688118811882, + "disc_nll_ch6": 0.46002376237623765, + "disc_nll_ch7": 0.5611363036303629, + "disc_nll_total": 0.5104673267326733, + "terminal_flow": 0.5230199669966997, + "terminal_norm": 0.5783623762376238, + "terminal_packet": 0.5784559405940595 + }, + "xss": { + "_n": 303.0, + "disc_nll_ch2": 0.5802638613861386, + "disc_nll_ch3": 0.34043382838283825, + "disc_nll_ch4": 0.5464, + "disc_nll_ch5": 0.5608582508250826, + "disc_nll_ch6": 0.5046509900990099, + "disc_nll_ch7": 0.44458300330033, + "disc_nll_total": 0.43926353135313534, + "terminal_flow": 0.5709161716171618, + "terminal_norm": 0.5831224422442245, + "terminal_packet": 0.6106095709570958 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_ciciot2023.log b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_ciciot2023.log new file mode 100644 index 0000000..9fadc65 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_ciciot2023.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,193,621 target rows +[sample] benign=10,000 attack=9,999 (33 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/9,999 +[score] 5,376/9,999 +[eval] attack done 3.8s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_ciciot2023.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_ciciot2023.npz b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_ciciot2023.npz new file mode 100644 index 0000000..1a90986 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_ciciot2023.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_iscxtor2016.json b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_iscxtor2016.json new file mode 100644 index 0000000..9daa885 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_iscxtor2016.json @@ -0,0 +1,64 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed44", + "target_store": "None", + "n_benign": 10000, + "n_attack": 1888, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.5605353283898304, + "auprc": 0.18840495773665916 + }, + "disc_nll_ch3": { + "auroc": 0.47513328919491526, + "auprc": 0.20870162276189386 + }, + "disc_nll_ch4": { + "auroc": 0.39257192796610174, + "auprc": 0.18307742289966566 + }, + "disc_nll_ch5": { + "auroc": 0.5002994173728814, + "auprc": 0.16071686158640283 + }, + "disc_nll_ch6": { + "auroc": 0.48571427436440684, + "auprc": 0.20833470946505886 + }, + "disc_nll_ch7": { + "auroc": 0.5146308262711865, + "auprc": 0.2901942813615881 + }, + "disc_nll_total": { + "auroc": 0.4820331302966101, + "auprc": 0.26709357542754003 + }, + "terminal_flow": { + "auroc": 0.5039088188559322, + "auprc": 0.19798666867221193 + }, + "terminal_norm": { + "auroc": 0.473078813559322, + "auprc": 0.17759368149952676 + }, + "terminal_packet": { + "auroc": 0.4571015889830508, + "auprc": 0.19572872103897365 + } + }, + "per_class": { + "tor": { + "_n": 1888.0, + "disc_nll_ch2": 0.5605353283898304, + "disc_nll_ch3": 0.47513328919491526, + "disc_nll_ch4": 0.39257192796610174, + "disc_nll_ch5": 0.5002994173728814, + "disc_nll_ch6": 0.48571427436440684, + "disc_nll_ch7": 0.5146308262711865, + "disc_nll_total": 0.4820331302966101, + "terminal_flow": 0.5039088188559322, + "terminal_norm": 0.473078813559322, + "terminal_packet": 0.4571015889830508 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_iscxtor2016.log b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_iscxtor2016.log new file mode 100644 index 0000000..fcbfbda --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_iscxtor2016.log @@ -0,0 +1,13 @@ +[model] T=64 flow_dim=20 +[data] 103,079 target rows +[sample] benign=10,000 attack=1,888 (1 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.2s +[eval] attack... +[score] 256/1,888 +[eval] attack done 0.7s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_iscxtor2016.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_iscxtor2016.npz b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_iscxtor2016.npz new file mode 100644 index 0000000..f192e47 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed44_cicids2017_to_iscxtor2016.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_ciciot2023_to_iscxtor2016.json b/artifacts/route_comparison/cross/route_ac_combo_seed44_ciciot2023_to_iscxtor2016.json new file mode 100644 index 0000000..5d3ddd0 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_ciciot2023_to_iscxtor2016.json @@ -0,0 +1,64 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44", + "target_store": "None", + "n_benign": 10000, + "n_attack": 1888, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.46062698622881354, + "auprc": 0.14936238234481644 + }, + "disc_nll_ch3": { + "auroc": 0.371004343220339, + "auprc": 0.15320664412325574 + }, + "disc_nll_ch4": { + "auroc": 0.2923323093220339, + "auprc": 0.12956238916718377 + }, + "disc_nll_ch5": { + "auroc": 0.43564364406779665, + "auprc": 0.15728435612229846 + }, + "disc_nll_ch6": { + "auroc": 0.44173548728813555, + "auprc": 0.13536910343534944 + }, + "disc_nll_ch7": { + "auroc": 0.5131880826271187, + "auprc": 0.24611610855712854 + }, + "disc_nll_total": { + "auroc": 0.42279202860169496, + "auprc": 0.1516253132822143 + }, + "terminal_flow": { + "auroc": 0.5078413665254237, + "auprc": 0.24524135154834703 + }, + "terminal_norm": { + "auroc": 0.4787145656779661, + "auprc": 0.18654158245533362 + }, + "terminal_packet": { + "auroc": 0.4454470338983051, + "auprc": 0.2630081343613694 + } + }, + "per_class": { + "tor": { + "_n": 1888.0, + "disc_nll_ch2": 0.46062698622881354, + "disc_nll_ch3": 0.371004343220339, + "disc_nll_ch4": 0.2923323093220339, + "disc_nll_ch5": 0.43564364406779665, + "disc_nll_ch6": 0.44173548728813555, + "disc_nll_ch7": 0.5131880826271187, + "disc_nll_total": 0.42279202860169496, + "terminal_flow": 0.5078413665254237, + "terminal_norm": 0.4787145656779661, + "terminal_packet": 0.4454470338983051 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_ciciot2023_to_iscxtor2016.log b/artifacts/route_comparison/cross/route_ac_combo_seed44_ciciot2023_to_iscxtor2016.log new file mode 100644 index 0000000..0472611 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_ciciot2023_to_iscxtor2016.log @@ -0,0 +1,13 @@ +[model] T=64 flow_dim=20 +[data] 103,079 target rows +[sample] benign=10,000 attack=1,888 (1 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/1,888 +[eval] attack done 0.7s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed44_ciciot2023_to_iscxtor2016.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_ciciot2023_to_iscxtor2016.npz b/artifacts/route_comparison/cross/route_ac_combo_seed44_ciciot2023_to_iscxtor2016.npz new file mode 100644 index 0000000..08db297 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed44_ciciot2023_to_iscxtor2016.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_ddos2019_to_cicids2017.json b/artifacts/route_comparison/cross/route_ac_combo_seed44_ddos2019_to_cicids2017.json new file mode 100644 index 0000000..d2d3e83 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_ddos2019_to_cicids2017.json @@ -0,0 +1,246 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.7528650177200237, + "auprc": 0.6606271295006348 + }, + "disc_nll_ch3": { + "auroc": 0.8402128174837566, + "auprc": 0.7579024081379337 + }, + "disc_nll_ch4": { + "auroc": 0.8315808328411104, + "auprc": 0.6708455949499171 + }, + "disc_nll_ch5": { + "auroc": 0.7281965372120496, + "auprc": 0.7078045969821811 + }, + "disc_nll_ch6": { + "auroc": 0.8452859125812168, + "auprc": 0.7475662884710141 + }, + "disc_nll_ch7": { + "auroc": 0.8700599158298878, + "auprc": 0.8179393140549218 + }, + "disc_nll_total": { + "auroc": 0.9154659480212639, + "auprc": 0.8563781910533429 + }, + "terminal_flow": { + "auroc": 0.48450354400472534, + "auprc": 0.42234729946376404 + }, + "terminal_norm": { + "auroc": 0.5488774808033077, + "auprc": 0.4003107584193874 + }, + "terminal_packet": { + "auroc": 0.6639020894861193, + "auprc": 0.5147492004117202 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "disc_nll_ch2": 0.9482678678678679, + "disc_nll_ch3": 0.7228142642642642, + "disc_nll_ch4": 0.8793361861861861, + "disc_nll_ch5": 0.6096127627627628, + "disc_nll_ch6": 0.8027313813813814, + "disc_nll_ch7": 0.8826229729729731, + "disc_nll_total": 0.8864222222222223, + "terminal_flow": 0.23987807807807804, + "terminal_norm": 0.6430314564564564, + "terminal_packet": 0.83503993993994 + }, + "DDoS": { + "_n": 666.0, + "disc_nll_ch2": 0.8800472972972974, + "disc_nll_ch3": 0.9310846846846845, + "disc_nll_ch4": 0.927784984984985, + "disc_nll_ch5": 0.8792888888888888, + "disc_nll_ch6": 0.890015915915916, + "disc_nll_ch7": 0.9291712462462463, + "disc_nll_total": 0.958111036036036, + "terminal_flow": 0.8460291291291291, + "terminal_norm": 0.757172972972973, + "terminal_packet": 0.8712150150150151 + }, + "DoS GoldenEye": { + "_n": 666.0, + "disc_nll_ch2": 0.8962702702702702, + "disc_nll_ch3": 0.8825726726726727, + "disc_nll_ch4": 0.8516734234234233, + "disc_nll_ch5": 0.6920987987987988, + "disc_nll_ch6": 0.7843881381381382, + "disc_nll_ch7": 0.8390542042042042, + "disc_nll_total": 0.8955879879879881, + "terminal_flow": 0.8843066816816817, + "terminal_norm": 0.706194069069069, + "terminal_packet": 0.797968993993994 + }, + "DoS Hulk": { + "_n": 666.0, + "disc_nll_ch2": 0.8379191441441441, + "disc_nll_ch3": 0.8855974474474474, + "disc_nll_ch4": 0.9305884384384385, + "disc_nll_ch5": 0.814821021021021, + "disc_nll_ch6": 0.8586770270270271, + "disc_nll_ch7": 0.802191141141141, + "disc_nll_total": 0.9308677927927927, + "terminal_flow": 0.691700900900901, + "terminal_norm": 0.5518398648648648, + "terminal_packet": 0.6736893393393393 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "disc_nll_ch2": 0.7524597597597598, + "disc_nll_ch3": 0.8140990990990992, + "disc_nll_ch4": 0.8471787537537537, + "disc_nll_ch5": 0.7261750750750751, + "disc_nll_ch6": 0.8761780780780781, + "disc_nll_ch7": 0.9274998498498498, + "disc_nll_total": 0.8917255255255256, + "terminal_flow": 0.5032548048048048, + "terminal_norm": 0.6431604354354353, + "terminal_packet": 0.8112626876876876 + }, + "DoS Slowloris": { + "_n": 666.0, + "disc_nll_ch2": 0.6535953453453454, + "disc_nll_ch3": 0.7112783783783784, + "disc_nll_ch4": 0.670026126126126, + "disc_nll_ch5": 0.892548948948949, + "disc_nll_ch6": 0.9911253753753753, + "disc_nll_ch7": 0.7957896396396396, + "disc_nll_total": 0.9455617117117117, + "terminal_flow": 0.5929124624624624, + "terminal_norm": 0.5752656156156155, + "terminal_packet": 0.6913912912912913 + }, + "FTP-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.6248272522522523, + "disc_nll_ch3": 0.7647948948948948, + "disc_nll_ch4": 0.7500348348348348, + "disc_nll_ch5": 0.749368993993994, + "disc_nll_ch6": 0.9994309309309309, + "disc_nll_ch7": 0.8631024024024024, + "disc_nll_total": 0.9184459459459459, + "terminal_flow": 0.3059168168168168, + "terminal_norm": 0.23552762762762766, + "terminal_packet": 0.4288986486486487 + }, + "Heartbleed": { + "_n": 1.0, + "disc_nll_ch2": 0.43979999999999997, + "disc_nll_ch3": 0.6679, + "disc_nll_ch4": 0.35650000000000004, + "disc_nll_ch5": 0.0, + "disc_nll_ch6": 0.719, + "disc_nll_ch7": 0.6587000000000001, + "disc_nll_total": 0.4292, + "terminal_flow": 0.9997, + "terminal_norm": 0.23299999999999998, + "terminal_packet": 0.28 + }, + "Infiltration": { + "_n": 7.0, + "disc_nll_ch2": 0.4910571428571429, + "disc_nll_ch3": 0.6771571428571428, + "disc_nll_ch4": 0.5112571428571429, + "disc_nll_ch5": 0.29698571428571424, + "disc_nll_ch6": 0.9029857142857143, + "disc_nll_ch7": 0.7406, + "disc_nll_total": 0.6777, + "terminal_flow": 0.8470714285714286, + "terminal_norm": 0.38782857142857147, + "terminal_packet": 0.49735714285714283 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.3547303303303303, + "disc_nll_ch3": 0.9895444444444443, + "disc_nll_ch4": 0.9181220720720722, + "disc_nll_ch5": 0.9664049549549549, + "disc_nll_ch6": 0.6673207207207208, + "disc_nll_ch7": 0.9853145645645646, + "disc_nll_total": 0.9864004504504505, + "terminal_flow": 0.2437171171171171, + "terminal_norm": 0.5380742492492493, + "terminal_packet": 0.5495475225225225 + }, + "Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.9322656156156155, + "disc_nll_ch3": 0.999189039039039, + "disc_nll_ch4": 0.893131006006006, + "disc_nll_ch5": 0.9938111111111111, + "disc_nll_ch6": 0.6892252252252252, + "disc_nll_ch7": 0.9993638138138138, + "disc_nll_total": 0.9994525525525525, + "terminal_flow": 0.21202387387387386, + "terminal_norm": 0.7316461711711713, + "terminal_packet": 0.8566234234234235 + }, + "SSH-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.6862244744744745, + "disc_nll_ch3": 0.7307707207207207, + "disc_nll_ch4": 0.71703993993994, + "disc_nll_ch5": 0.06358453453453454, + "disc_nll_ch6": 0.886112012012012, + "disc_nll_ch7": 0.7055978978978978, + "disc_nll_total": 0.7933043543543544, + "terminal_flow": 0.24687184684684685, + "terminal_norm": 0.14947462462462463, + "terminal_packet": 0.1736418918918919 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "disc_nll_ch2": 0.46750273972602735, + "disc_nll_ch3": 0.6309630136986302, + "disc_nll_ch4": 0.3299027397260274, + "disc_nll_ch5": 0.000572602739726022, + "disc_nll_ch6": 0.8853863013698631, + "disc_nll_ch7": 0.6576972602739726, + "disc_nll_total": 0.5192904109589042, + "terminal_flow": 0.9901808219178083, + "terminal_norm": 0.23268630136986304, + "terminal_packet": 0.29937397260273974 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "disc_nll_ch2": 0.9791846153846154, + "disc_nll_ch3": 0.9101692307692308, + "disc_nll_ch4": 0.9603769230769231, + "disc_nll_ch5": 0.692923076923077, + "disc_nll_ch6": 0.7846846153846153, + "disc_nll_ch7": 0.9525153846153847, + "disc_nll_total": 0.965176923076923, + "terminal_flow": 0.7148923076923077, + "terminal_norm": 0.6856384615384615, + "terminal_packet": 0.7643076923076922 + }, + "Web Attack - XSS": { + "_n": 18.0, + "disc_nll_ch2": 0.4615055555555556, + "disc_nll_ch3": 0.61545, + "disc_nll_ch4": 0.3671333333333333, + "disc_nll_ch5": 0.0, + "disc_nll_ch6": 0.9942111111111112, + "disc_nll_ch7": 0.6568277777777778, + "disc_nll_total": 0.7106111111111111, + "terminal_flow": 0.9993666666666666, + "terminal_norm": 0.23596111111111112, + "terminal_packet": 0.29630555555555554 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_ddos2019_to_cicids2017.log b/artifacts/route_comparison/cross/route_ac_combo_seed44_ddos2019_to_cicids2017.log new file mode 100644 index 0000000..42b40e1 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_ddos2019_to_cicids2017.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 2,025,564 target rows +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.9s +[eval] attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done 2.4s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed44_ddos2019_to_cicids2017.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_ddos2019_to_cicids2017.npz b/artifacts/route_comparison/cross/route_ac_combo_seed44_ddos2019_to_cicids2017.npz new file mode 100644 index 0000000..f6adee0 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed44_ddos2019_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicddos2019.json b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicddos2019.json new file mode 100644 index 0000000..c1c9ddc --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicddos2019.json @@ -0,0 +1,272 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.16176267519805, + "auprc": 0.3741410725196248 + }, + "disc_nll_ch3": { + "auroc": 0.40503350091407675, + "auprc": 0.42426362354771174 + }, + "disc_nll_ch4": { + "auroc": 0.11067620353443022, + "auprc": 0.33061852199028086 + }, + "disc_nll_ch5": { + "auroc": 0.1748084704448507, + "auprc": 0.3507894774810292 + }, + "disc_nll_ch6": { + "auroc": 0.22634907068860455, + "auprc": 0.35455560437918293 + }, + "disc_nll_ch7": { + "auroc": 0.3102107759496242, + "auprc": 0.4227788971987195 + }, + "disc_nll_total": { + "auroc": 0.1380693022547227, + "auprc": 0.35093319455156397 + }, + "terminal_flow": { + "auroc": 0.8385933424741011, + "auprc": 0.806308428000737 + }, + "terminal_norm": { + "auroc": 0.7844106032906765, + "auprc": 0.7465487691774311 + }, + "terminal_packet": { + "auroc": 0.48036226386349784, + "auprc": 0.4553434337528535 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "disc_nll_ch2": 0.01891360544217691, + "disc_nll_ch3": 0.45276122448979594, + "disc_nll_ch4": 0.0048272108843537736, + "disc_nll_ch5": 0.06041811224489797, + "disc_nll_ch6": 0.1349360544217687, + "disc_nll_ch7": 0.40482151360544216, + "disc_nll_total": 0.003146343537414914, + "terminal_flow": 0.9657897959183674, + "terminal_norm": 0.9479585034013607, + "terminal_packet": 0.6058602891156462 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.01973333333333337, + "disc_nll_ch3": 0.4620593537414966, + "disc_nll_ch4": 0.0037450680272109187, + "disc_nll_ch5": 0.059363265306122466, + "disc_nll_ch6": 0.13060051020408162, + "disc_nll_ch7": 0.41866632653061214, + "disc_nll_total": 0.0014925170068026683, + "terminal_flow": 0.9713768707482995, + "terminal_norm": 0.9544549319727893, + "terminal_packet": 0.623036394557823 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.020304251700680308, + "disc_nll_ch3": 0.4116794217687075, + "disc_nll_ch4": 0.006002210884353753, + "disc_nll_ch5": 0.05632499999999999, + "disc_nll_ch6": 0.1300767006802721, + "disc_nll_ch7": 0.18834268707482996, + "disc_nll_total": 0.0013892857142856726, + "terminal_flow": 0.9289275510204082, + "terminal_norm": 0.8983564625850342, + "terminal_packet": 0.3580659863945578 + }, + "DrDoS_NTP": { + "_n": 588.0, + "disc_nll_ch2": 0.13087142857142856, + "disc_nll_ch3": 0.4153908163265306, + "disc_nll_ch4": 0.007002721088435371, + "disc_nll_ch5": 0.12007695578231292, + "disc_nll_ch6": 0.5895802721088436, + "disc_nll_ch7": 0.02268571428571429, + "disc_nll_total": 0.05785323129251698, + "terminal_flow": 0.7514635204081632, + "terminal_norm": 0.18680085034013605, + "terminal_packet": 0.22999804421768705 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.0390610544217687, + "disc_nll_ch3": 0.3819457482993197, + "disc_nll_ch4": 0.011033503401360547, + "disc_nll_ch5": 0.05576819727891159, + "disc_nll_ch6": 0.07461411564625847, + "disc_nll_ch7": 0.1555462585034014, + "disc_nll_total": 0.0014549319727890663, + "terminal_flow": 0.8524530612244898, + "terminal_norm": 0.8316852040816327, + "terminal_packet": 0.507956462585034 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "disc_nll_ch2": 0.02223554421768711, + "disc_nll_ch3": 0.46469251700680275, + "disc_nll_ch4": 0.0040384353741496955, + "disc_nll_ch5": 0.058931462585034025, + "disc_nll_ch6": 0.11945561224489795, + "disc_nll_ch7": 0.40502704081632646, + "disc_nll_total": 0.0014955782312924633, + "terminal_flow": 0.9659872448979593, + "terminal_norm": 0.9512430272108844, + "terminal_packet": 0.6036911564625851 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "disc_nll_ch2": 0.04738452380952384, + "disc_nll_ch3": 0.2428127551020408, + "disc_nll_ch4": 0.004768367346938774, + "disc_nll_ch5": 0.062064455782312906, + "disc_nll_ch6": 0.3556134353741497, + "disc_nll_ch7": 0.06586394557823128, + "disc_nll_total": 0.00701224489795915, + "terminal_flow": 0.7172243197278912, + "terminal_norm": 0.6408547619047619, + "terminal_packet": 0.2718425170068028 + }, + "DrDoS_UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.04372346938775512, + "disc_nll_ch3": 0.23585714285714288, + "disc_nll_ch4": 0.004948469387755102, + "disc_nll_ch5": 0.061907993197278896, + "disc_nll_ch6": 0.35875442176870753, + "disc_nll_ch7": 0.057603911564625826, + "disc_nll_total": 0.005153401360544183, + "terminal_flow": 0.7136853741496598, + "terminal_norm": 0.6441549319727892, + "terminal_packet": 0.26769897959183675 + }, + "LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.0227571428571429, + "disc_nll_ch3": 0.46362074829931976, + "disc_nll_ch4": 0.004836734693877587, + "disc_nll_ch5": 0.06132721088435377, + "disc_nll_ch6": 0.1295326530612245, + "disc_nll_ch7": 0.4212314625850341, + "disc_nll_total": 0.0029386054421768172, + "terminal_flow": 0.9718882653061224, + "terminal_norm": 0.9586843537414965, + "terminal_packet": 0.6355513605442177 + }, + "MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.019877551020408196, + "disc_nll_ch3": 0.39425119047619045, + "disc_nll_ch4": 0.006071598639455794, + "disc_nll_ch5": 0.05583018707482992, + "disc_nll_ch6": 0.13224642857142857, + "disc_nll_ch7": 0.1764375850340136, + "disc_nll_total": 0.0013811224489795513, + "terminal_flow": 0.9121528911564625, + "terminal_norm": 0.8845086734693878, + "terminal_packet": 0.3541738095238095 + }, + "NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.037769557823129254, + "disc_nll_ch3": 0.345971768707483, + "disc_nll_ch4": 0.011151360544217686, + "disc_nll_ch5": 0.054839795918367365, + "disc_nll_ch6": 0.0790270408163265, + "disc_nll_ch7": 0.15367176870748303, + "disc_nll_total": 0.0014343537414965518, + "terminal_flow": 0.8278386054421769, + "terminal_norm": 0.8133047619047619, + "terminal_packet": 0.4982212585034014 + }, + "Portmap": { + "_n": 588.0, + "disc_nll_ch2": 0.042496258503401364, + "disc_nll_ch3": 0.3767559523809524, + "disc_nll_ch4": 0.013420408163265306, + "disc_nll_ch5": 0.05880306122448982, + "disc_nll_ch6": 0.08037108843537413, + "disc_nll_ch7": 0.16865969387755106, + "disc_nll_total": 0.0043916666666666175, + "terminal_flow": 0.861705782312925, + "terminal_norm": 0.8408539115646259, + "terminal_packet": 0.5231452380952382 + }, + "Syn": { + "_n": 588.0, + "disc_nll_ch2": 0.9304996598639454, + "disc_nll_ch3": 0.6737908163265306, + "disc_nll_ch4": 0.6404743197278912, + "disc_nll_ch5": 0.8591457482993198, + "disc_nll_ch6": 0.21638707482993197, + "disc_nll_ch7": 0.9540914965986393, + "disc_nll_total": 0.8824755102040817, + "terminal_flow": 0.774541156462585, + "terminal_norm": 0.8482316326530612, + "terminal_packet": 0.7694285714285714 + }, + "TFTP": { + "_n": 588.0, + "disc_nll_ch2": 0.04055000000000004, + "disc_nll_ch3": 0.22067602040816328, + "disc_nll_ch4": 0.00839846938775507, + "disc_nll_ch5": 0.06600782312925169, + "disc_nll_ch6": 0.3895896258503402, + "disc_nll_ch7": 0.08949081632653065, + "disc_nll_total": 0.007661054421768678, + "terminal_flow": 0.7876229591836736, + "terminal_norm": 0.7036062925170067, + "terminal_packet": 0.31994064625850344 + }, + "UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.04511088435374151, + "disc_nll_ch3": 0.2124784013605442, + "disc_nll_ch4": 0.004799319727891159, + "disc_nll_ch5": 0.06181088435374148, + "disc_nll_ch6": 0.37731802721088437, + "disc_nll_ch7": 0.05698146258503399, + "disc_nll_total": 0.003345918367346906, + "terminal_flow": 0.6937568027210884, + "terminal_norm": 0.6225654761904761, + "terminal_packet": 0.2604219387755102 + }, + "UDPLag": { + "_n": 588.0, + "disc_nll_ch2": 0.8301736394557823, + "disc_nll_ch3": 0.6562384353741497, + "disc_nll_ch4": 0.5809942176870748, + "disc_nll_ch5": 0.7548040816326531, + "disc_nll_ch6": 0.20440969387755106, + "disc_nll_ch7": 0.8643350340136053, + "disc_nll_total": 0.7940998299319727, + "terminal_flow": 0.8267539115646259, + "terminal_norm": 0.8566964285714286, + "terminal_packet": 0.7152904761904761 + }, + "WebDDoS": { + "_n": 438.0, + "disc_nll_ch2": 0.5332778538812786, + "disc_nll_ch3": 0.49840696347031965, + "disc_nll_ch4": 0.7205675799086758, + "disc_nll_ch5": 0.5634674657534247, + "disc_nll_ch6": 0.38619965753424657, + "disc_nll_ch7": 0.7933852739726028, + "disc_nll_total": 0.71852899543379, + "terminal_flow": 0.6967287671232877, + "terminal_norm": 0.7395849315068492, + "terminal_packet": 0.6702850456621005 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicddos2019.log b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicddos2019.log new file mode 100644 index 0000000..3a5de3b --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicddos2019.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,993,376 target rows +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 3.9s +[eval] attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done 3.4s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicddos2019.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicddos2019.npz new file mode 100644 index 0000000..5a38286 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicids2017.json b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicids2017.json new file mode 100644 index 0000000..6624517 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicids2017.json @@ -0,0 +1,246 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.6319652982870644, + "auprc": 0.6489974086201645 + }, + "disc_nll_ch3": { + "auroc": 0.4755030862374483, + "auprc": 0.54609373757678 + }, + "disc_nll_ch4": { + "auroc": 0.8641957841110455, + "auprc": 0.7519723860707377 + }, + "disc_nll_ch5": { + "auroc": 0.8184684878913172, + "auprc": 0.7975647540728948 + }, + "disc_nll_ch6": { + "auroc": 0.6887484273479031, + "auprc": 0.5590255535302127 + }, + "disc_nll_ch7": { + "auroc": 0.4854212714116952, + "auprc": 0.5774352441155675 + }, + "disc_nll_total": { + "auroc": 0.8744342808623745, + "auprc": 0.7914466137377457 + }, + "terminal_flow": { + "auroc": 0.6271431187241583, + "auprc": 0.6393668667824943 + }, + "terminal_norm": { + "auroc": 0.672507892793857, + "auprc": 0.6146796821916928 + }, + "terminal_packet": { + "auroc": 0.6634415239220319, + "auprc": 0.5549696062296364 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "disc_nll_ch2": 0.1366921921921922, + "disc_nll_ch3": 0.11239264264264265, + "disc_nll_ch4": 0.9575465465465465, + "disc_nll_ch5": 0.8760496996996997, + "disc_nll_ch6": 0.7082246246246247, + "disc_nll_ch7": 0.20148963963963964, + "disc_nll_total": 0.6536162162162164, + "terminal_flow": 0.32462965465465465, + "terminal_norm": 0.3399870870870871, + "terminal_packet": 0.4298528528528529 + }, + "DDoS": { + "_n": 666.0, + "disc_nll_ch2": 0.29782117117117113, + "disc_nll_ch3": 0.6522558558558558, + "disc_nll_ch4": 0.9613196696696695, + "disc_nll_ch5": 0.9508752252252253, + "disc_nll_ch6": 0.8049986486486487, + "disc_nll_ch7": 0.20175120120120119, + "disc_nll_total": 0.84244496996997, + "terminal_flow": 0.9539852852852853, + "terminal_norm": 0.9079954954954955, + "terminal_packet": 0.8971641891891893 + }, + "DoS GoldenEye": { + "_n": 666.0, + "disc_nll_ch2": 0.616126876876877, + "disc_nll_ch3": 0.42472567567567565, + "disc_nll_ch4": 0.834704054054054, + "disc_nll_ch5": 0.8620858858858859, + "disc_nll_ch6": 0.7795271771771772, + "disc_nll_ch7": 0.2717505255255255, + "disc_nll_total": 0.7959173423423425, + "terminal_flow": 0.732953153153153, + "terminal_norm": 0.8599366366366366, + "terminal_packet": 0.8915743993993993 + }, + "DoS Hulk": { + "_n": 666.0, + "disc_nll_ch2": 0.43849234234234236, + "disc_nll_ch3": 0.325290990990991, + "disc_nll_ch4": 0.9644824324324325, + "disc_nll_ch5": 0.9343084084084085, + "disc_nll_ch6": 0.7935939939939941, + "disc_nll_ch7": 0.26106726726726726, + "disc_nll_total": 0.8912064564564565, + "terminal_flow": 0.890998048048048, + "terminal_norm": 0.9296764264264264, + "terminal_packet": 0.9283468468468468 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "disc_nll_ch2": 0.4129207207207207, + "disc_nll_ch3": 0.49323048048048046, + "disc_nll_ch4": 0.8688845345345345, + "disc_nll_ch5": 0.8921729729729729, + "disc_nll_ch6": 0.8445681681681682, + "disc_nll_ch7": 0.457903003003003, + "disc_nll_total": 0.8335277027027026, + "terminal_flow": 0.8946139639639639, + "terminal_norm": 0.8987698198198197, + "terminal_packet": 0.9091744744744744 + }, + "DoS Slowloris": { + "_n": 666.0, + "disc_nll_ch2": 0.5955001501501502, + "disc_nll_ch3": 0.8412716216216217, + "disc_nll_ch4": 0.7935827327327326, + "disc_nll_ch5": 0.8850731231231233, + "disc_nll_ch6": 0.8311481981981983, + "disc_nll_ch7": 0.8953282282282282, + "disc_nll_total": 0.9577285285285285, + "terminal_flow": 0.8090462462462462, + "terminal_norm": 0.7742343843843844, + "terminal_packet": 0.7708783783783784 + }, + "FTP-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.977377927927928, + "disc_nll_ch3": 0.00867612612612614, + "disc_nll_ch4": 0.7796683183183183, + "disc_nll_ch5": 0.864582882882883, + "disc_nll_ch6": 0.926270945945946, + "disc_nll_ch7": 0.6309399399399399, + "disc_nll_total": 0.9585614114114114, + "terminal_flow": 0.07302972972972974, + "terminal_norm": 0.15925367867867868, + "terminal_packet": 0.3458373123123123 + }, + "Heartbleed": { + "_n": 1.0, + "disc_nll_ch2": 0.23240000000000005, + "disc_nll_ch3": 0.07589999999999997, + "disc_nll_ch4": 0.05069999999999997, + "disc_nll_ch5": 0.0038000000000000256, + "disc_nll_ch6": 0.733, + "disc_nll_ch7": 0.024700000000000055, + "disc_nll_total": 0.5854, + "terminal_flow": 0.9485, + "terminal_norm": 0.8785, + "terminal_packet": 0.899 + }, + "Infiltration": { + "_n": 7.0, + "disc_nll_ch2": 0.7406999999999998, + "disc_nll_ch3": 0.21171428571428574, + "disc_nll_ch4": 0.17830000000000001, + "disc_nll_ch5": 0.2884, + "disc_nll_ch6": 0.8821285714285714, + "disc_nll_ch7": 0.16821428571428573, + "disc_nll_total": 0.8481285714285715, + "terminal_flow": 0.5946, + "terminal_norm": 0.33408571428571426, + "terminal_packet": 0.42864285714285716 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.9931415915915918, + "disc_nll_ch3": 0.9845776276276276, + "disc_nll_ch4": 0.9321168168168169, + "disc_nll_ch5": 0.9692324324324324, + "disc_nll_ch6": 0.24084444444444444, + "disc_nll_ch7": 0.9948496996996998, + "disc_nll_total": 0.9913945945945947, + "terminal_flow": 0.9730513513513513, + "terminal_norm": 0.953775075075075, + "terminal_packet": 0.4877351351351351 + }, + "Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.9643750750750754, + "disc_nll_ch3": 0.9809184684684685, + "disc_nll_ch4": 0.9278304804804803, + "disc_nll_ch5": 0.9968990990990991, + "disc_nll_ch6": 0.05184414414414415, + "disc_nll_ch7": 0.9859279279279277, + "disc_nll_total": 0.9924486486486487, + "terminal_flow": 0.5976794294294295, + "terminal_norm": 0.9294495495495496, + "terminal_packet": 0.7863197447447448 + }, + "SSH-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.8464025525525525, + "disc_nll_ch3": 0.0017432432432432435, + "disc_nll_ch4": 0.7436394144144144, + "disc_nll_ch5": 0.07044849849849849, + "disc_nll_ch6": 0.8605016516516516, + "disc_nll_ch7": 0.028721621621621625, + "disc_nll_total": 0.8179247747747747, + "terminal_flow": 0.01639459459459459, + "terminal_norm": 0.043233483483483486, + "terminal_packet": 0.23006696696696696 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "disc_nll_ch2": 0.9897945205479453, + "disc_nll_ch3": 0.01513698630136985, + "disc_nll_ch4": 0.03389041095890412, + "disc_nll_ch5": 0.001134246575342432, + "disc_nll_ch6": 0.9939575342465753, + "disc_nll_ch7": 0.00800684931506849, + "disc_nll_total": 0.9738150684931506, + "terminal_flow": 0.6470938356164383, + "terminal_norm": 0.14052191780821918, + "terminal_packet": 0.321713698630137 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "disc_nll_ch2": 0.18168461538461542, + "disc_nll_ch3": 0.25906153846153845, + "disc_nll_ch4": 0.8613076923076922, + "disc_nll_ch5": 0.8929615384615385, + "disc_nll_ch6": 0.7953923076923076, + "disc_nll_ch7": 0.15674615384615384, + "disc_nll_total": 0.6913076923076923, + "terminal_flow": 0.34739230769230767, + "terminal_norm": 0.7761307692307693, + "terminal_packet": 0.8760076923076923 + }, + "Web Attack - XSS": { + "_n": 18.0, + "disc_nll_ch2": 0.9955722222222223, + "disc_nll_ch3": 0.03172777777777779, + "disc_nll_ch4": 0.03832777777777778, + "disc_nll_ch5": 0.00020555555555553293, + "disc_nll_ch6": 0.9968777777777778, + "disc_nll_ch7": 0.013827777777777772, + "disc_nll_total": 0.9841055555555556, + "terminal_flow": 0.9299166666666667, + "terminal_norm": 0.23972222222222223, + "terminal_packet": 0.40024444444444446 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicids2017.log b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicids2017.log new file mode 100644 index 0000000..04f5750 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicids2017.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 2,025,564 target rows +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done 2.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicids2017.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicids2017.npz b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicids2017.npz new file mode 100644 index 0000000..a633d99 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_ciciot2023.json b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_ciciot2023.json new file mode 100644 index 0000000..c22947c --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_ciciot2023.json @@ -0,0 +1,480 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "n_benign": 10000, + "n_attack": 9999, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.36927952295229516, + "auprc": 0.42390736914567784 + }, + "disc_nll_ch3": { + "auroc": 0.44592542754275427, + "auprc": 0.5764144530818036 + }, + "disc_nll_ch4": { + "auroc": 0.47685795079507953, + "auprc": 0.47844327452747126 + }, + "disc_nll_ch5": { + "auroc": 0.5658099459945996, + "auprc": 0.6353123277025319 + }, + "disc_nll_ch6": { + "auroc": 0.5008156365636564, + "auprc": 0.5213905358793105 + }, + "disc_nll_ch7": { + "auroc": 0.6743659665966597, + "auprc": 0.6924468911793279 + }, + "disc_nll_total": { + "auroc": 0.6175197869786979, + "auprc": 0.6944242120499502 + }, + "terminal_flow": { + "auroc": 0.6931417591759176, + "auprc": 0.6968968241577209 + }, + "terminal_norm": { + "auroc": 0.6204377487748776, + "auprc": 0.6050456670492099 + }, + "terminal_packet": { + "auroc": 0.5918221872187219, + "auprc": 0.6268623849632103 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 303.0, + "disc_nll_ch2": 0.524670792079208, + "disc_nll_ch3": 0.3347597359735973, + "disc_nll_ch4": 0.35666138613861387, + "disc_nll_ch5": 0.33079768976897694, + "disc_nll_ch6": 0.5175338283828383, + "disc_nll_ch7": 0.5189816831683168, + "disc_nll_total": 0.45730313531353134, + "terminal_flow": 0.5617549504950495, + "terminal_norm": 0.49069900990099014, + "terminal_packet": 0.5291110561056106 + }, + "browserhijacking": { + "_n": 303.0, + "disc_nll_ch2": 0.5006648514851485, + "disc_nll_ch3": 0.361296699669967, + "disc_nll_ch4": 0.3491364686468647, + "disc_nll_ch5": 0.32906237623762374, + "disc_nll_ch6": 0.44257508250825084, + "disc_nll_ch7": 0.4941636963696369, + "disc_nll_total": 0.42591699669967004, + "terminal_flow": 0.5723150165016502, + "terminal_norm": 0.5084156765676568, + "terminal_packet": 0.5075518151815182 + }, + "commandinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.4788077557755776, + "disc_nll_ch3": 0.3285275577557756, + "disc_nll_ch4": 0.3290387788778878, + "disc_nll_ch5": 0.30561699669966996, + "disc_nll_ch6": 0.4715912541254126, + "disc_nll_ch7": 0.5297993399339934, + "disc_nll_total": 0.4001950495049505, + "terminal_flow": 0.5818879537953796, + "terminal_norm": 0.4860199669966997, + "terminal_packet": 0.4656679867986798 + }, + "ddos-ack_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.053078382838283825, + "disc_nll_ch3": 0.045285973597359745, + "disc_nll_ch4": 0.48670016501650165, + "disc_nll_ch5": 0.7588991749174916, + "disc_nll_ch6": 0.6887255775577558, + "disc_nll_ch7": 0.9189503300330033, + "disc_nll_total": 0.9587268976897689, + "terminal_flow": 0.9922282178217823, + "terminal_norm": 0.9852341584158416, + "terminal_packet": 0.9865777227722772 + }, + "ddos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5796066006600661, + "disc_nll_ch3": 0.7231240924092409, + "disc_nll_ch4": 0.6832937293729373, + "disc_nll_ch5": 0.912080198019802, + "disc_nll_ch6": 0.6032917491749175, + "disc_nll_ch7": 0.900163201320132, + "disc_nll_total": 0.9257523102310232, + "terminal_flow": 0.7821387788778879, + "terminal_norm": 0.7679194719471947, + "terminal_packet": 0.9503382838283829 + }, + "ddos-icmp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.4860559405940594, + "disc_nll_ch3": 0.5236194719471947, + "disc_nll_ch4": 0.5017594059405941, + "disc_nll_ch5": 0.5247397689768977, + "disc_nll_ch6": 0.5056103960396039, + "disc_nll_ch7": 0.5623714521452146, + "disc_nll_total": 0.5353905940594059, + "terminal_flow": 0.6148311881188119, + "terminal_norm": 0.5531442244224423, + "terminal_packet": 0.5639491749174916 + }, + "ddos-icmp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.4699973597359736, + "disc_nll_ch3": 0.3583559405940594, + "disc_nll_ch4": 0.4280674917491749, + "disc_nll_ch5": 0.43551666666666666, + "disc_nll_ch6": 0.47315627062706267, + "disc_nll_ch7": 0.6193981848184817, + "disc_nll_total": 0.4973013201320132, + "terminal_flow": 0.6450336633663366, + "terminal_norm": 0.5893767326732673, + "terminal_packet": 0.5737854785478549 + }, + "ddos-pshack_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.12396996699669967, + "disc_nll_ch3": 0.09547656765676565, + "disc_nll_ch4": 0.5684267326732674, + "disc_nll_ch5": 0.5594245874587459, + "disc_nll_ch6": 0.9988976897689769, + "disc_nll_ch7": 0.9310174917491749, + "disc_nll_total": 0.9919683168316832, + "terminal_flow": 0.7563607260726072, + "terminal_norm": 0.5492498349834982, + "terminal_packet": 0.41325214521452147 + }, + "ddos-rstfinflood": { + "_n": 303.0, + "disc_nll_ch2": 0.07299999999999995, + "disc_nll_ch3": 0.5251, + "disc_nll_ch4": 0.7393000000000001, + "disc_nll_ch5": 0.987, + "disc_nll_ch6": 0.548, + "disc_nll_ch7": 0.9697, + "disc_nll_total": 0.9943, + "terminal_flow": 0.993, + "terminal_norm": 0.9783000000000001, + "terminal_packet": 0.7112 + }, + "ddos-slowloris": { + "_n": 303.0, + "disc_nll_ch2": 0.5122320132013201, + "disc_nll_ch3": 0.4872325082508251, + "disc_nll_ch4": 0.5764323432343235, + "disc_nll_ch5": 0.8764861386138613, + "disc_nll_ch6": 0.7027514851485148, + "disc_nll_ch7": 0.6553963696369638, + "disc_nll_total": 0.8286600660066005, + "terminal_flow": 0.5567184818481847, + "terminal_norm": 0.687941419141914, + "terminal_packet": 0.7694351485148515 + }, + "ddos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.09478943894389438, + "disc_nll_ch3": 0.9923029702970297, + "disc_nll_ch4": 0.5476762376237624, + "disc_nll_ch5": 0.5884854785478547, + "disc_nll_ch6": 0.3890607260726072, + "disc_nll_ch7": 0.9290039603960396, + "disc_nll_total": 0.9655320132013201, + "terminal_flow": 0.9410709570957096, + "terminal_norm": 0.7292544554455447, + "terminal_packet": 0.626172607260726 + }, + "ddos-synonymousip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.09365379537953794, + "disc_nll_ch3": 0.9946237623762375, + "disc_nll_ch4": 0.7690544554455445, + "disc_nll_ch5": 0.7121745874587458, + "disc_nll_ch6": 0.7480557755775578, + "disc_nll_ch7": 0.9606663366336634, + "disc_nll_total": 0.9891224422442245, + "terminal_flow": 0.9970825082508251, + "terminal_norm": 0.7376125412541255, + "terminal_packet": 0.34240891089108916 + }, + "ddos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.013468976897689756, + "disc_nll_ch3": 0.002048844884488423, + "disc_nll_ch4": 0.5220676567656766, + "disc_nll_ch5": 0.5260115511551156, + "disc_nll_ch6": 0.3972693069306931, + "disc_nll_ch7": 0.32731716171617153, + "disc_nll_total": 0.01583333333333333, + "terminal_flow": 0.7100554455445546, + "terminal_norm": 0.6522732673267327, + "terminal_packet": 0.4908943894389439 + }, + "ddos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.2334877887788779, + "disc_nll_ch3": 0.4682237623762376, + "disc_nll_ch4": 0.1712019801980198, + "disc_nll_ch5": 0.478973597359736, + "disc_nll_ch6": 0.5452653465346535, + "disc_nll_ch7": 0.3685615511551155, + "disc_nll_total": 0.2156904290429043, + "terminal_flow": 0.8307151815181517, + "terminal_norm": 0.6073673267326732, + "terminal_packet": 0.6134889438943895 + }, + "ddos-udp_fragmentation": { + "_n": 303.0, + "disc_nll_ch2": 0.416730198019802, + "disc_nll_ch3": 0.4285625412541254, + "disc_nll_ch4": 0.38813679867986794, + "disc_nll_ch5": 0.46003696369636965, + "disc_nll_ch6": 0.5778024752475247, + "disc_nll_ch7": 0.5893341584158417, + "disc_nll_total": 0.5170463696369636, + "terminal_flow": 0.6660407590759075, + "terminal_norm": 0.46463514851485144, + "terminal_packet": 0.5105166666666667 + }, + "dictionarybruteforce": { + "_n": 303.0, + "disc_nll_ch2": 0.4456655115511551, + "disc_nll_ch3": 0.42221072607260723, + "disc_nll_ch4": 0.4860851485148515, + "disc_nll_ch5": 0.5231011551155116, + "disc_nll_ch6": 0.5327201320132013, + "disc_nll_ch7": 0.4469424092409241, + "disc_nll_total": 0.5448160066006601, + "terminal_flow": 0.5958777227722771, + "terminal_norm": 0.5735567656765677, + "terminal_packet": 0.6187229372937293 + }, + "dns_spoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.3475922442244224, + "disc_nll_ch3": 0.28571204620462043, + "disc_nll_ch4": 0.3505600660066006, + "disc_nll_ch5": 0.3170641914191419, + "disc_nll_ch6": 0.46886534653465345, + "disc_nll_ch7": 0.563719306930693, + "disc_nll_total": 0.3553130363036303, + "terminal_flow": 0.5729394389438944, + "terminal_norm": 0.5184859735973597, + "terminal_packet": 0.5839980198019803 + }, + "dos-http_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.4381023102310231, + "disc_nll_ch3": 0.5082917491749174, + "disc_nll_ch4": 0.6093544554455446, + "disc_nll_ch5": 0.9483894389438945, + "disc_nll_ch6": 0.5687419141914192, + "disc_nll_ch7": 0.8189191419141915, + "disc_nll_total": 0.938504290429043, + "terminal_flow": 0.8283702970297029, + "terminal_norm": 0.8228308580858086, + "terminal_packet": 0.945294389438944 + }, + "dos-syn_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.37193762376237627, + "disc_nll_ch3": 0.9939046204620461, + "disc_nll_ch4": 0.6414953795379538, + "disc_nll_ch5": 0.9260207920792078, + "disc_nll_ch6": 0.5100462046204621, + "disc_nll_ch7": 0.9605293729372937, + "disc_nll_total": 0.9665498349834982, + "terminal_flow": 0.8577214521452146, + "terminal_norm": 0.7295894389438945, + "terminal_packet": 0.8594099009900991 + }, + "dos-tcp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5892564356435643, + "disc_nll_ch3": 0.040600660066006614, + "disc_nll_ch4": 0.5256825082508251, + "disc_nll_ch5": 0.923476897689769, + "disc_nll_ch6": 0.0972039603960396, + "disc_nll_ch7": 0.8879237623762375, + "disc_nll_total": 0.7009399339933993, + "terminal_flow": 0.7070089108910892, + "terminal_norm": 0.6079815181518152, + "terminal_packet": 0.5542463696369637 + }, + "dos-udp_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.03527689768976899, + "disc_nll_ch3": 0.037101650165016514, + "disc_nll_ch4": 0.035978877887788745, + "disc_nll_ch5": 0.016650165016501663, + "disc_nll_ch6": 0.018788118811881187, + "disc_nll_ch7": 0.2908221122112211, + "disc_nll_total": 0.01713201320132009, + "terminal_flow": 0.641779207920792, + "terminal_norm": 0.36750033003300325, + "terminal_packet": 0.46895973597359736 + }, + "mirai-greeth_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.49269339933993395, + "disc_nll_ch3": 0.3202602310231023, + "disc_nll_ch4": 0.3111623762376238, + "disc_nll_ch5": 0.3205684818481848, + "disc_nll_ch6": 0.4522569306930693, + "disc_nll_ch7": 0.5379504950495049, + "disc_nll_total": 0.42177821782178215, + "terminal_flow": 0.477693399339934, + "terminal_norm": 0.37234603960396034, + "terminal_packet": 0.3784316831683168 + }, + "mirai-greip_flood": { + "_n": 303.0, + "disc_nll_ch2": 0.5732547854785479, + "disc_nll_ch3": 0.4155660066006601, + "disc_nll_ch4": 0.381313201320132, + "disc_nll_ch5": 0.4426828382838284, + "disc_nll_ch6": 0.4973412541254125, + "disc_nll_ch7": 0.679995709570957, + "disc_nll_total": 0.5944798679867986, + "terminal_flow": 0.6468234323432345, + "terminal_norm": 0.5602095709570957, + "terminal_packet": 0.5729917491749175 + }, + "mirai-udpplain": { + "_n": 303.0, + "disc_nll_ch2": 0.4889161716171618, + "disc_nll_ch3": 0.42135231023102304, + "disc_nll_ch4": 0.36345462046204624, + "disc_nll_ch5": 0.4544668316831683, + "disc_nll_ch6": 0.5136155115511551, + "disc_nll_ch7": 0.6208321782178219, + "disc_nll_total": 0.5453268976897689, + "terminal_flow": 0.5972615511551154, + "terminal_norm": 0.5028955445544554, + "terminal_packet": 0.5411998349834983 + }, + "mitm-arpspoofing": { + "_n": 303.0, + "disc_nll_ch2": 0.4919222772277228, + "disc_nll_ch3": 0.3282628712871287, + "disc_nll_ch4": 0.3703641914191419, + "disc_nll_ch5": 0.36173349834983504, + "disc_nll_ch6": 0.4051666666666667, + "disc_nll_ch7": 0.5926245874587458, + "disc_nll_total": 0.4639445544554455, + "terminal_flow": 0.6364295379537954, + "terminal_norm": 0.5825227722772277, + "terminal_packet": 0.5369219471947194 + }, + "recon-hostdiscovery": { + "_n": 303.0, + "disc_nll_ch2": 0.09126072607260724, + "disc_nll_ch3": 0.8171597359735974, + "disc_nll_ch4": 0.7085554455445545, + "disc_nll_ch5": 0.8348108910891088, + "disc_nll_ch6": 0.4936394389438944, + "disc_nll_ch7": 0.9443973597359736, + "disc_nll_total": 0.9461166666666667, + "terminal_flow": 0.7997966996699669, + "terminal_norm": 0.818986303630363, + "terminal_packet": 0.5940990099009901 + }, + "recon-osscan": { + "_n": 303.0, + "disc_nll_ch2": 0.3997257425742574, + "disc_nll_ch3": 0.7709643564356434, + "disc_nll_ch4": 0.6348838283828384, + "disc_nll_ch5": 0.7960912541254126, + "disc_nll_ch6": 0.4446574257425743, + "disc_nll_ch7": 0.8500211221122111, + "disc_nll_total": 0.8508313531353136, + "terminal_flow": 0.6860976897689769, + "terminal_norm": 0.7156580858085809, + "terminal_packet": 0.588560396039604 + }, + "recon-pingsweep": { + "_n": 303.0, + "disc_nll_ch2": 0.48729257425742567, + "disc_nll_ch3": 0.29587359735973595, + "disc_nll_ch4": 0.5073679867986798, + "disc_nll_ch5": 0.5017927392739274, + "disc_nll_ch6": 0.556623597359736, + "disc_nll_ch7": 0.5879986798679869, + "disc_nll_total": 0.517193894389439, + "terminal_flow": 0.5424717821782178, + "terminal_norm": 0.5779183168316832, + "terminal_packet": 0.5974447194719472 + }, + "recon-portscan": { + "_n": 303.0, + "disc_nll_ch2": 0.36949273927392734, + "disc_nll_ch3": 0.8134272277227723, + "disc_nll_ch4": 0.6628523102310231, + "disc_nll_ch5": 0.8254981848184818, + "disc_nll_ch6": 0.45975049504950494, + "disc_nll_ch7": 0.8579854785478549, + "disc_nll_total": 0.8629125412541254, + "terminal_flow": 0.7158072607260725, + "terminal_norm": 0.7248549504950494, + "terminal_packet": 0.544742904290429 + }, + "sqlinjection": { + "_n": 303.0, + "disc_nll_ch2": 0.5079833333333333, + "disc_nll_ch3": 0.4302427392739274, + "disc_nll_ch4": 0.5538889438943895, + "disc_nll_ch5": 0.5088641914191419, + "disc_nll_ch6": 0.5190369636963696, + "disc_nll_ch7": 0.5874800330033003, + "disc_nll_total": 0.5287443894389439, + "terminal_flow": 0.5801747524752474, + "terminal_norm": 0.5935148514851485, + "terminal_packet": 0.5813971947194719 + }, + "uploading_attack": { + "_n": 303.0, + "disc_nll_ch2": 0.4982891089108911, + "disc_nll_ch3": 0.3045721122112211, + "disc_nll_ch4": 0.2857953795379538, + "disc_nll_ch5": 0.25746501650165016, + "disc_nll_ch6": 0.4633846534653465, + "disc_nll_ch7": 0.5591075907590759, + "disc_nll_total": 0.4130082508250825, + "terminal_flow": 0.6000359735973597, + "terminal_norm": 0.5115864686468646, + "terminal_packet": 0.46565742574257424 + }, + "vulnerabilityscan": { + "_n": 303.0, + "disc_nll_ch2": 0.4371795379537953, + "disc_nll_ch3": 0.4867326732673268, + "disc_nll_ch4": 0.5325254125412541, + "disc_nll_ch5": 0.582163201320132, + "disc_nll_ch6": 0.4575744224422442, + "disc_nll_ch7": 0.6581823432343233, + "disc_nll_total": 0.5619359735973598, + "terminal_flow": 0.6098617161716172, + "terminal_norm": 0.6121490099009901, + "terminal_packet": 0.5531767326732673 + }, + "xss": { + "_n": 303.0, + "disc_nll_ch2": 0.46616897689768977, + "disc_nll_ch3": 0.35476336633663363, + "disc_nll_ch4": 0.35803861386138613, + "disc_nll_ch5": 0.3455826732673267, + "disc_nll_ch6": 0.4579160066006601, + "disc_nll_ch7": 0.533820297029703, + "disc_nll_total": 0.42988597359735975, + "terminal_flow": 0.576293399339934, + "terminal_norm": 0.4944156765676568, + "terminal_packet": 0.49052689768976904 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_ciciot2023.log b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_ciciot2023.log new file mode 100644 index 0000000..742d62e --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_ciciot2023.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,193,621 target rows +[sample] benign=10,000 attack=9,999 (33 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 3.9s +[eval] attack... +[score] 256/9,999 +[score] 5,376/9,999 +[eval] attack done 3.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_ciciot2023.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_ciciot2023.npz b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_ciciot2023.npz new file mode 100644 index 0000000..6b7899b Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed44_iscxtor2016_to_ciciot2023.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicddos2019.json b/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicddos2019.json new file mode 100644 index 0000000..44199a5 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicddos2019.json @@ -0,0 +1,272 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.09540543875685559, + "auprc": 0.32205919469460226 + }, + "disc_nll_ch3": { + "auroc": 0.27778043367865124, + "auprc": 0.4469267652582461 + }, + "disc_nll_ch4": { + "auroc": 0.4287985323989437, + "auprc": 0.45414641452505794 + }, + "disc_nll_ch5": { + "auroc": 0.4299943428803574, + "auprc": 0.4316744219151464 + }, + "disc_nll_ch6": { + "auroc": 0.6222773156611822, + "auprc": 0.544231385433275 + }, + "disc_nll_ch7": { + "auroc": 0.8565917276051189, + "auprc": 0.8227325399413554 + }, + "disc_nll_total": { + "auroc": 0.49349276863700997, + "auprc": 0.522675256579878 + }, + "terminal_flow": { + "auroc": 0.8405240300629698, + "auprc": 0.7538763181159392 + }, + "terminal_norm": { + "auroc": 0.8274748476538697, + "auprc": 0.7604623646565779 + }, + "terminal_packet": { + "auroc": 0.6211701503148487, + "auprc": 0.6128404304620012 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "disc_nll_ch2": 0.0018629251700680372, + "disc_nll_ch3": 0.29214081632653066, + "disc_nll_ch4": 0.4452608843537415, + "disc_nll_ch5": 0.48793460884353745, + "disc_nll_ch6": 0.8199807823129251, + "disc_nll_ch7": 0.9462888605442177, + "disc_nll_total": 0.7562461734693877, + "terminal_flow": 0.942404761904762, + "terminal_norm": 0.9539650510204082, + "terminal_packet": 0.8368551020408163 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.0008811224489796037, + "disc_nll_ch3": 0.31756003401360544, + "disc_nll_ch4": 0.45210221088435376, + "disc_nll_ch5": 0.4954267006802721, + "disc_nll_ch6": 0.839181462585034, + "disc_nll_ch7": 0.9481406462585034, + "disc_nll_total": 0.7914340136054421, + "terminal_flow": 0.9531732993197279, + "terminal_norm": 0.959424149659864, + "terminal_packet": 0.8597170068027211 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.002906462585033998, + "disc_nll_ch3": 0.031298639455782304, + "disc_nll_ch4": 0.4332348639455782, + "disc_nll_ch5": 0.4756117346938776, + "disc_nll_ch6": 0.7056763605442177, + "disc_nll_ch7": 0.9299952380952382, + "disc_nll_total": 0.42334795918367346, + "terminal_flow": 0.8644200680272108, + "terminal_norm": 0.8996448979591837, + "terminal_packet": 0.5232437074829932 + }, + "DrDoS_NTP": { + "_n": 588.0, + "disc_nll_ch2": 0.008076530612244889, + "disc_nll_ch3": 0.2758027210884354, + "disc_nll_ch4": 0.12501683673469388, + "disc_nll_ch5": 0.07006581632653062, + "disc_nll_ch6": 0.4585705782312925, + "disc_nll_ch7": 0.6984367346938776, + "disc_nll_total": 0.12719098639455778, + "terminal_flow": 0.8946073129251702, + "terminal_norm": 0.4810055272108843, + "terminal_packet": 0.4498192176870749 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.04341275510204081, + "disc_nll_ch3": 0.0012528911564625698, + "disc_nll_ch4": 0.4299353741496599, + "disc_nll_ch5": 0.44929710884353735, + "disc_nll_ch6": 0.5188695578231293, + "disc_nll_ch7": 0.9071479591836734, + "disc_nll_total": 0.3635414965986394, + "terminal_flow": 0.733970918367347, + "terminal_norm": 0.8132862244897959, + "terminal_packet": 0.47575884353741493 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "disc_nll_ch2": 0.002949319727891166, + "disc_nll_ch3": 0.30710017006802726, + "disc_nll_ch4": 0.45861666666666673, + "disc_nll_ch5": 0.5020501700680273, + "disc_nll_ch6": 0.8297877551020408, + "disc_nll_ch7": 0.9476464285714286, + "disc_nll_total": 0.7663537414965987, + "terminal_flow": 0.9420670068027212, + "terminal_norm": 0.951887925170068, + "terminal_packet": 0.8297968537414966 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "disc_nll_ch2": 0.0029006802721088442, + "disc_nll_ch3": 0.18104489795918366, + "disc_nll_ch4": 0.23567517006802718, + "disc_nll_ch5": 0.2549882653061225, + "disc_nll_ch6": 0.5341498299319727, + "disc_nll_ch7": 0.7210264455782314, + "disc_nll_total": 0.21671989795918364, + "terminal_flow": 0.7995158163265306, + "terminal_norm": 0.7057119047619047, + "terminal_packet": 0.41498588435374156 + }, + "DrDoS_UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.0030052721088435334, + "disc_nll_ch3": 0.17141717687074834, + "disc_nll_ch4": 0.2297498299319728, + "disc_nll_ch5": 0.25082687074829935, + "disc_nll_ch6": 0.5278122448979592, + "disc_nll_ch7": 0.7164069727891156, + "disc_nll_total": 0.202516156462585, + "terminal_flow": 0.7961743197278912, + "terminal_norm": 0.7075142857142858, + "terminal_packet": 0.40443146258503404 + }, + "LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.0013892857142857253, + "disc_nll_ch3": 0.32028265306122455, + "disc_nll_ch4": 0.4546205782312925, + "disc_nll_ch5": 0.49852363945578226, + "disc_nll_ch6": 0.8448369047619048, + "disc_nll_ch7": 0.9483049319727891, + "disc_nll_total": 0.8104494897959185, + "terminal_flow": 0.9562583333333334, + "terminal_norm": 0.9595945578231293, + "terminal_packet": 0.8639651360544218 + }, + "MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.002969047619047606, + "disc_nll_ch3": 0.028974829931972777, + "disc_nll_ch4": 0.4293124149659864, + "disc_nll_ch5": 0.4723947278911564, + "disc_nll_ch6": 0.6914906462585034, + "disc_nll_ch7": 0.927984693877551, + "disc_nll_total": 0.41599132653061227, + "terminal_flow": 0.8618613945578231, + "terminal_norm": 0.8971920068027212, + "terminal_packet": 0.5167752551020408 + }, + "NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.04242057823129251, + "disc_nll_ch3": 0.0013613945578231082, + "disc_nll_ch4": 0.4140585034013605, + "disc_nll_ch5": 0.43179625850340136, + "disc_nll_ch6": 0.5134209183673469, + "disc_nll_ch7": 0.8948857142857143, + "disc_nll_total": 0.3524853741496598, + "terminal_flow": 0.7406613095238095, + "terminal_norm": 0.8176273809523809, + "terminal_packet": 0.4755341836734694 + }, + "Portmap": { + "_n": 588.0, + "disc_nll_ch2": 0.043106292517006796, + "disc_nll_ch3": 0.00481513605442175, + "disc_nll_ch4": 0.418328231292517, + "disc_nll_ch5": 0.4374331632653061, + "disc_nll_ch6": 0.5175, + "disc_nll_ch7": 0.8960874149659865, + "disc_nll_total": 0.3540865646258503, + "terminal_flow": 0.7390607142857143, + "terminal_norm": 0.8179486394557823, + "terminal_packet": 0.4823365646258504 + }, + "Syn": { + "_n": 588.0, + "disc_nll_ch2": 0.49345918367346947, + "disc_nll_ch3": 0.987018537414966, + "disc_nll_ch4": 0.8650513605442177, + "disc_nll_ch5": 0.7583438775510205, + "disc_nll_ch6": 0.5273511904761905, + "disc_nll_ch7": 0.9779945578231292, + "disc_nll_total": 0.939763775510204, + "terminal_flow": 0.8831857142857144, + "terminal_norm": 0.9497833333333333, + "terminal_packet": 0.9924940476190477 + }, + "TFTP": { + "_n": 588.0, + "disc_nll_ch2": 0.006501530612244904, + "disc_nll_ch3": 0.22085680272108843, + "disc_nll_ch4": 0.20391258503401358, + "disc_nll_ch5": 0.22362670068027216, + "disc_nll_ch6": 0.5616168367346939, + "disc_nll_ch7": 0.6836712585034014, + "disc_nll_total": 0.18443537414965985, + "terminal_flow": 0.8809425170068027, + "terminal_norm": 0.877595918367347, + "terminal_packet": 0.5486761054421767 + }, + "UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.0027790816326530563, + "disc_nll_ch3": 0.1831697278911565, + "disc_nll_ch4": 0.21056054421768705, + "disc_nll_ch5": 0.22883690476190477, + "disc_nll_ch6": 0.5176687074829932, + "disc_nll_ch7": 0.6992464285714286, + "disc_nll_total": 0.185691156462585, + "terminal_flow": 0.7959794217687075, + "terminal_norm": 0.697884693877551, + "terminal_packet": 0.40058877551020405 + }, + "UDPLag": { + "_n": 588.0, + "disc_nll_ch2": 0.40939013605442176, + "disc_nll_ch3": 0.8964697278911564, + "disc_nll_ch4": 0.7877858843537414, + "disc_nll_ch5": 0.6615916666666666, + "disc_nll_ch6": 0.5093011904761905, + "disc_nll_ch7": 0.9402630952380953, + "disc_nll_total": 0.8218561224489795, + "terminal_flow": 0.8772100340136055, + "terminal_norm": 0.9243947278911564, + "terminal_packet": 0.9312394557823129 + }, + "WebDDoS": { + "_n": 438.0, + "disc_nll_ch2": 0.7108948630136985, + "disc_nll_ch3": 0.5783864155251142, + "disc_nll_ch4": 0.7879813926940639, + "disc_nll_ch5": 0.6731971461187214, + "disc_nll_ch6": 0.6749316210045662, + "disc_nll_ch7": 0.7517992009132419, + "disc_nll_total": 0.7402039954337898, + "terminal_flow": 0.5544332191780822, + "terminal_norm": 0.5927263698630137, + "terminal_packet": 0.5305601598173516 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicddos2019.log b/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicddos2019.log new file mode 100644 index 0000000..2bab995 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicddos2019.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,993,376 target rows +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.3s +[eval] attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done 3.9s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicddos2019.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicddos2019.npz new file mode 100644 index 0000000..7a9f278 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicids2017.json b/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicids2017.json new file mode 100644 index 0000000..2937762 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicids2017.json @@ -0,0 +1,246 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.7427101668635558, + "auprc": 0.6361441408061701 + }, + "disc_nll_ch3": { + "auroc": 0.8828067631423508, + "auprc": 0.7964909958005644 + }, + "disc_nll_ch4": { + "auroc": 0.8795208210277613, + "auprc": 0.7572631204513167 + }, + "disc_nll_ch5": { + "auroc": 0.7667634450679268, + "auprc": 0.7643527485598366 + }, + "disc_nll_ch6": { + "auroc": 0.866086340815121, + "auprc": 0.7362288974854572 + }, + "disc_nll_ch7": { + "auroc": 0.6343802643236858, + "auprc": 0.6594549062534882 + }, + "disc_nll_total": { + "auroc": 0.92884762994684, + "auprc": 0.8524318656935655 + }, + "terminal_flow": { + "auroc": 0.872596551978736, + "auprc": 0.7434708281557679 + }, + "terminal_norm": { + "auroc": 0.7811682663910219, + "auprc": 0.7249586218576423 + }, + "terminal_packet": { + "auroc": 0.8069582914943887, + "auprc": 0.757974263958988 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "disc_nll_ch2": 0.9389106606606606, + "disc_nll_ch3": 0.9356572072072071, + "disc_nll_ch4": 0.9137989489489489, + "disc_nll_ch5": 0.8414678678678679, + "disc_nll_ch6": 0.8741093093093094, + "disc_nll_ch7": 0.058810285285285285, + "disc_nll_total": 0.9274794294294294, + "terminal_flow": 0.6737556306306307, + "terminal_norm": 0.9510858858858858, + "terminal_packet": 0.9662132132132132 + }, + "DDoS": { + "_n": 666.0, + "disc_nll_ch2": 0.8837998498498498, + "disc_nll_ch3": 0.8846132132132132, + "disc_nll_ch4": 0.948601051051051, + "disc_nll_ch5": 0.9244528528528528, + "disc_nll_ch6": 0.9422043543543545, + "disc_nll_ch7": 0.7476192192192193, + "disc_nll_total": 0.9556445945945945, + "terminal_flow": 0.9672144144144144, + "terminal_norm": 0.9681518018018018, + "terminal_packet": 0.9488333333333333 + }, + "DoS GoldenEye": { + "_n": 666.0, + "disc_nll_ch2": 0.8577377627627629, + "disc_nll_ch3": 0.865156981981982, + "disc_nll_ch4": 0.9258451951951953, + "disc_nll_ch5": 0.6359861861861862, + "disc_nll_ch6": 0.787578078078078, + "disc_nll_ch7": 0.5795881381381381, + "disc_nll_total": 0.8776717717717717, + "terminal_flow": 0.9628391891891891, + "terminal_norm": 0.8593343843843844, + "terminal_packet": 0.8412723723723724 + }, + "DoS Hulk": { + "_n": 666.0, + "disc_nll_ch2": 0.8976435435435436, + "disc_nll_ch3": 0.857517042042042, + "disc_nll_ch4": 0.9472581081081082, + "disc_nll_ch5": 0.89175015015015, + "disc_nll_ch6": 0.8280456456456458, + "disc_nll_ch7": 0.6296786786786788, + "disc_nll_total": 0.9412017267267269, + "terminal_flow": 0.9507456456456457, + "terminal_norm": 0.7545927177177176, + "terminal_packet": 0.7784331831831832 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "disc_nll_ch2": 0.7631966966966967, + "disc_nll_ch3": 0.914127027027027, + "disc_nll_ch4": 0.8783762762762762, + "disc_nll_ch5": 0.8037591591591591, + "disc_nll_ch6": 0.9113028528528527, + "disc_nll_ch7": 0.8635270270270271, + "disc_nll_total": 0.9065055555555556, + "terminal_flow": 0.8236921921921923, + "terminal_norm": 0.891920045045045, + "terminal_packet": 0.9206813813813813 + }, + "DoS Slowloris": { + "_n": 666.0, + "disc_nll_ch2": 0.6482995495495496, + "disc_nll_ch3": 0.8593747747747748, + "disc_nll_ch4": 0.7925842342342343, + "disc_nll_ch5": 0.9614708708708708, + "disc_nll_ch6": 0.925366966966967, + "disc_nll_ch7": 0.9541175675675675, + "disc_nll_total": 0.8831004504504505, + "terminal_flow": 0.7608860360360361, + "terminal_norm": 0.7508121621621621, + "terminal_packet": 0.8072566066066067 + }, + "FTP-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.9118214714714714, + "disc_nll_ch3": 0.8414028528528529, + "disc_nll_ch4": 0.7894852852852854, + "disc_nll_ch5": 0.6714222972972973, + "disc_nll_ch6": 0.994478978978979, + "disc_nll_ch7": 0.6109785285285284, + "disc_nll_total": 0.9549539039039039, + "terminal_flow": 0.852838138138138, + "terminal_norm": 0.44549744744744746, + "terminal_packet": 0.5337561561561561 + }, + "Heartbleed": { + "_n": 1.0, + "disc_nll_ch2": 0.6504, + "disc_nll_ch3": 0.6942, + "disc_nll_ch4": 0.6735, + "disc_nll_ch5": 0.20740000000000003, + "disc_nll_ch6": 0.7537999999999999, + "disc_nll_ch7": 0.059699999999999975, + "disc_nll_total": 0.6196999999999999, + "terminal_flow": 0.9941, + "terminal_norm": 0.5384, + "terminal_packet": 0.39759999999999995 + }, + "Infiltration": { + "_n": 7.0, + "disc_nll_ch2": 0.7896285714285713, + "disc_nll_ch3": 0.7472571428571428, + "disc_nll_ch4": 0.6102571428571428, + "disc_nll_ch5": 0.3887285714285714, + "disc_nll_ch6": 0.9822571428571429, + "disc_nll_ch7": 0.25005714285714287, + "disc_nll_total": 0.9165428571428571, + "terminal_flow": 0.9422, + "terminal_norm": 0.8069285714285713, + "terminal_packet": 0.8356857142857143 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.36705285285285294, + "disc_nll_ch3": 0.9954153153153151, + "disc_nll_ch4": 0.9638884384384385, + "disc_nll_ch5": 0.9755154654654654, + "disc_nll_ch6": 0.7437127627627628, + "disc_nll_ch7": 0.9970001501501502, + "disc_nll_total": 0.9945732732732733, + "terminal_flow": 0.9457531531531532, + "terminal_norm": 0.9925842342342341, + "terminal_packet": 0.9960878378378378 + }, + "Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.1895857357357357, + "disc_nll_ch3": 0.9987442942942943, + "disc_nll_ch4": 0.9199675675675677, + "disc_nll_ch5": 0.9959560060060061, + "disc_nll_ch6": 0.7688914414414414, + "disc_nll_ch7": 0.9947262762762764, + "disc_nll_total": 0.9962684684684685, + "terminal_flow": 0.9097036036036036, + "terminal_norm": 0.9925462462462462, + "terminal_packet": 0.9982331831831831 + }, + "SSH-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.9721782282282283, + "disc_nll_ch3": 0.7023914414414414, + "disc_nll_ch4": 0.7607487987987988, + "disc_nll_ch5": 0.06596711711711711, + "disc_nll_ch6": 0.8797445945945945, + "disc_nll_ch7": 0.0026771771771771664, + "disc_nll_total": 0.8808400900900901, + "terminal_flow": 0.8598947447447449, + "terminal_norm": 0.24206711711711712, + "terminal_packet": 0.3321617867867868 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "disc_nll_ch2": 0.6984739726027397, + "disc_nll_ch3": 0.7007123287671233, + "disc_nll_ch4": 0.5388643835616438, + "disc_nll_ch5": 0.07720547945205479, + "disc_nll_ch6": 0.9017, + "disc_nll_ch7": 0.006094520547945202, + "disc_nll_total": 0.7040095890410959, + "terminal_flow": 0.9906, + "terminal_norm": 0.48800547945205475, + "terminal_packet": 0.40909178082191777 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "disc_nll_ch2": 0.9647538461538463, + "disc_nll_ch3": 0.8984923076923076, + "disc_nll_ch4": 0.9530923076923077, + "disc_nll_ch5": 0.7025769230769231, + "disc_nll_ch6": 0.7368923076923077, + "disc_nll_ch7": 0.4068461538461538, + "disc_nll_total": 0.9272923076923076, + "terminal_flow": 0.9516384615384617, + "terminal_norm": 0.9127000000000001, + "terminal_packet": 0.8591 + }, + "Web Attack - XSS": { + "_n": 18.0, + "disc_nll_ch2": 0.6330166666666667, + "disc_nll_ch3": 0.6988611111111112, + "disc_nll_ch4": 0.6463055555555556, + "disc_nll_ch5": 0.08354999999999999, + "disc_nll_ch6": 0.9768722222222223, + "disc_nll_ch7": 0.01608888888888889, + "disc_nll_total": 0.7625444444444444, + "terminal_flow": 0.9929055555555556, + "terminal_norm": 0.5129333333333334, + "terminal_packet": 0.4206333333333333 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicids2017.log b/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicids2017.log new file mode 100644 index 0000000..5707589 --- /dev/null +++ b/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicids2017.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 2,025,564 target rows +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 3.9s +[eval] attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done 2.4s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicids2017.json diff --git a/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicids2017.npz b/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicids2017.npz new file mode 100644 index 0000000..07a1bb6 Binary files /dev/null and b/artifacts/route_comparison/cross/route_ac_combo_seed44_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicddos2019.json b/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicddos2019.json new file mode 100644 index 0000000..31d6f85 --- /dev/null +++ b/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicddos2019.json @@ -0,0 +1,818 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.7184133759902499, + "auprc": 0.5888413922459589 + }, + "causal_surprisal_flow": { + "auroc": 0.16287810786106033, + "auprc": 0.33054017850252493 + }, + "causal_surprisal_packet_max": { + "auroc": 0.15127532500507823, + "auprc": 0.32809479049128165 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.1272569774527727, + "auprc": 0.32238627429296135 + }, + "causal_surprisal_packet_median": { + "auroc": 0.1849558196221816, + "auprc": 0.34752447251768104 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.12700902396912453, + "auprc": 0.3230276881965676 + }, + "causal_surprisal_total": { + "auroc": 0.23086301543774124, + "auprc": 0.35098610593622254 + }, + "consistency_total": { + "auroc": 0.5511044637416209, + "auprc": 0.4785642832563205 + }, + "curvature_flow": { + "auroc": 0.20581998781230956, + "auprc": 0.3500660143101544 + }, + "curvature_packet": { + "auroc": 0.9272387720901889, + "auprc": 0.9284512711198935 + }, + "curvature_total": { + "auroc": 0.7465902396912452, + "auprc": 0.6879693673774272 + }, + "direction_drift_flow": { + "auroc": 0.45922855474304286, + "auprc": 0.43240322871482056 + }, + "direction_drift_packet_max": { + "auroc": 0.47709685151330494, + "auprc": 0.4669679451302381 + }, + "direction_drift_packet_mean": { + "auroc": 0.5961632845825716, + "auprc": 0.5672916757990969 + }, + "direction_drift_packet_median": { + "auroc": 0.5992459069672963, + "auprc": 0.5731802883863715 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.597314168190128, + "auprc": 0.5687764140286793 + }, + "direction_drift_total": { + "auroc": 0.43025378326223845, + "auprc": 0.4417311547258214 + }, + "flow_consistency": { + "auroc": 0.5311767926061345, + "auprc": 0.47950782802433817 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.8773568403412554, + "auprc": 0.9169274066081535 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.8847262746292912, + "auprc": 0.920688096174293 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.8779700487507616, + "auprc": 0.9180858370855836 + }, + "kinetic_energy": { + "auroc": 0.7163883150517976, + "auprc": 0.5872511831483215 + }, + "kinetic_flow": { + "auroc": 0.6037269855778998, + "auprc": 0.49516651667686934 + }, + "kinetic_packet": { + "auroc": 0.6225710542352224, + "auprc": 0.5475264254216731 + }, + "packet_consistency": { + "auroc": 0.5366825005078204, + "auprc": 0.48600460154239283 + }, + "pna_flow": { + "auroc": 0.17352123197237457, + "auprc": 0.33346562187107187 + }, + "pna_packet_max": { + "auroc": 0.6844707850903919, + "auprc": 0.6999804266942223 + }, + "pna_packet_mean": { + "auroc": 0.8773568403412554, + "auprc": 0.9169274066081535 + }, + "pna_packet_median": { + "auroc": 0.8847262746292912, + "auprc": 0.920688096174293 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.8779700487507616, + "auprc": 0.9180858370855836 + }, + "terminal_flow": { + "auroc": 0.6610239386552915, + "auprc": 0.5581844024267697 + }, + "terminal_norm": { + "auroc": 0.7762731718464351, + "auprc": 0.715048197210455 + }, + "terminal_packet": { + "auroc": 0.5596390564696323, + "auprc": 0.5114040387438024 + }, + "velocity_flow": { + "auroc": 0.6179185709932967, + "auprc": 0.5105716564500689 + }, + "velocity_packet": { + "auroc": 0.6864563782246597, + "auprc": 0.6384271604068914 + }, + "velocity_total": { + "auroc": 0.824659176315255, + "auprc": 0.7330109442191552 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "arc_length": 0.7391355442176871, + "causal_surprisal_flow": 0.06094914965986395, + "causal_surprisal_packet_max": 0.043807142857142864, + "causal_surprisal_packet_mean": 0.04565850340136055, + "causal_surprisal_packet_median": 0.09742959183673469, + "causal_surprisal_packet_trimmed10_mean": 0.04867210884353741, + "causal_surprisal_total": 0.20571632653061228, + "consistency_total": 0.5630865646258504, + "curvature_flow": 0.08930187074829932, + "curvature_packet": 0.985408843537415, + "curvature_total": 0.7296812074829933, + "direction_drift_flow": 0.5695751700680272, + "direction_drift_packet_max": 0.16316658163265307, + "direction_drift_packet_mean": 0.2849518707482993, + "direction_drift_packet_median": 0.2987573979591837, + "direction_drift_packet_trimmed10_mean": 0.30110986394557826, + "direction_drift_total": 0.09094651360544218, + "flow_consistency": 0.37695119047619047, + "kappa2_speed2norm_packet_mean": 0.9462537414965986, + "kappa2_speed2norm_packet_median": 0.953784693877551, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9529416666666666, + "kinetic_energy": 0.7373039115646258, + "kinetic_flow": 0.5524892006802722, + "kinetic_packet": 0.6561798469387755, + "packet_consistency": 0.7843852040816326, + "pna_flow": 0.09818979591836736, + "pna_packet_max": 0.5915684523809522, + "pna_packet_mean": 0.9462537414965986, + "pna_packet_median": 0.953784693877551, + "pna_packet_trimmed10_mean": 0.9529416666666666, + "terminal_flow": 0.7635551020408163, + "terminal_norm": 0.9461539115646259, + "terminal_packet": 0.5395205782312925, + "velocity_flow": 0.5105011904761905, + "velocity_packet": 0.9475874149659864, + "velocity_total": 0.9542598639455783 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "arc_length": 0.7388007653061224, + "causal_surprisal_flow": 0.060352380952380956, + "causal_surprisal_packet_max": 0.04367244897959185, + "causal_surprisal_packet_mean": 0.04450425170068028, + "causal_surprisal_packet_median": 0.09482219387755102, + "causal_surprisal_packet_trimmed10_mean": 0.04698571428571428, + "causal_surprisal_total": 0.20482602040816325, + "consistency_total": 0.5624909013605441, + "curvature_flow": 0.08827551020408164, + "curvature_packet": 0.9875688775510204, + "curvature_total": 0.732121343537415, + "direction_drift_flow": 0.5720756802721088, + "direction_drift_packet_max": 0.15460204081632656, + "direction_drift_packet_mean": 0.2686266156462585, + "direction_drift_packet_median": 0.2827461734693878, + "direction_drift_packet_trimmed10_mean": 0.28473069727891154, + "direction_drift_total": 0.0807954081632653, + "flow_consistency": 0.35784642857142857, + "kappa2_speed2norm_packet_mean": 0.9412781462585034, + "kappa2_speed2norm_packet_median": 0.9492518707482992, + "kappa2_speed2norm_packet_trimmed10_mean": 0.948227380952381, + "kinetic_energy": 0.7370966836734694, + "kinetic_flow": 0.5503141156462584, + "kinetic_packet": 0.6604508503401361, + "packet_consistency": 0.810868537414966, + "pna_flow": 0.09688622448979593, + "pna_packet_max": 0.576979761904762, + "pna_packet_mean": 0.9412781462585034, + "pna_packet_median": 0.9492518707482992, + "pna_packet_trimmed10_mean": 0.948227380952381, + "terminal_flow": 0.7705758503401361, + "terminal_norm": 0.954162074829932, + "terminal_packet": 0.5418330782312926, + "velocity_flow": 0.5040534013605443, + "velocity_packet": 0.9690706632653061, + "velocity_total": 0.9588244897959184 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "arc_length": 0.7400904761904761, + "causal_surprisal_flow": 0.07576675170068027, + "causal_surprisal_packet_max": 0.04240816326530615, + "causal_surprisal_packet_mean": 0.042824829931972806, + "causal_surprisal_packet_median": 0.07270731292517008, + "causal_surprisal_packet_trimmed10_mean": 0.044230612244897966, + "causal_surprisal_total": 0.21739795918367344, + "consistency_total": 0.5477782312925171, + "curvature_flow": 0.10280816326530612, + "curvature_packet": 0.9887114795918366, + "curvature_total": 0.7778831632653062, + "direction_drift_flow": 0.5527477891156464, + "direction_drift_packet_max": 0.3792693877551021, + "direction_drift_packet_mean": 0.5972997448979592, + "direction_drift_packet_median": 0.6053096088435374, + "direction_drift_packet_trimmed10_mean": 0.6121653911564625, + "direction_drift_total": 0.29609914965986395, + "flow_consistency": 0.5814857142857144, + "kappa2_speed2norm_packet_mean": 0.993175, + "kappa2_speed2norm_packet_median": 0.9939051020408164, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9939397959183673, + "kinetic_energy": 0.7377724489795917, + "kinetic_flow": 0.5851525510204082, + "kinetic_packet": 0.6175760204081633, + "packet_consistency": 0.48990867346938777, + "pna_flow": 0.11108265306122449, + "pna_packet_max": 0.8443923469387755, + "pna_packet_mean": 0.993175, + "pna_packet_median": 0.9939051020408164, + "pna_packet_trimmed10_mean": 0.9939397959183673, + "terminal_flow": 0.6830530612244898, + "terminal_norm": 0.8854087585034013, + "terminal_packet": 0.5318377551020408, + "velocity_flow": 0.5708923469387754, + "velocity_packet": 0.7207889455782313, + "velocity_total": 0.9066454081632653 + }, + "DrDoS_NTP": { + "_n": 588.0, + "arc_length": 0.5001812925170068, + "causal_surprisal_flow": 0.6558972789115646, + "causal_surprisal_packet_max": 0.6622768707482993, + "causal_surprisal_packet_mean": 0.24617448979591838, + "causal_surprisal_packet_median": 0.09852687074829933, + "causal_surprisal_packet_trimmed10_mean": 0.07012789115646259, + "causal_surprisal_total": 0.1298656462585034, + "consistency_total": 0.8254265306122448, + "curvature_flow": 0.37961105442176873, + "curvature_packet": 0.9867388605442177, + "curvature_total": 0.9720095238095238, + "direction_drift_flow": 0.20875552721088433, + "direction_drift_packet_max": 0.8156506802721087, + "direction_drift_packet_mean": 0.5242249999999999, + "direction_drift_packet_median": 0.4770662414965986, + "direction_drift_packet_trimmed10_mean": 0.4850352040816327, + "direction_drift_total": 0.7645775510204083, + "flow_consistency": 0.8469511904761905, + "kappa2_speed2norm_packet_mean": 0.9954066326530613, + "kappa2_speed2norm_packet_median": 0.9953520408163264, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9950282312925172, + "kinetic_energy": 0.5057010204081632, + "kinetic_flow": 0.7068785714285715, + "kinetic_packet": 0.5424024659863946, + "packet_consistency": 0.5896578231292517, + "pna_flow": 0.2160081632653061, + "pna_packet_max": 0.9830442176870748, + "pna_packet_mean": 0.9954066326530613, + "pna_packet_median": 0.9953520408163264, + "pna_packet_trimmed10_mean": 0.9950282312925172, + "terminal_flow": 0.9204059523809525, + "terminal_norm": 0.6160369897959184, + "terminal_packet": 0.521140306122449, + "velocity_flow": 0.795228231292517, + "velocity_packet": 0.7444358843537415, + "velocity_total": 0.4923016156462585 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "arc_length": 0.758435544217687, + "causal_surprisal_flow": 0.08513197278911563, + "causal_surprisal_packet_max": 0.041989115646258526, + "causal_surprisal_packet_mean": 0.04228605442176873, + "causal_surprisal_packet_median": 0.06195850340136054, + "causal_surprisal_packet_trimmed10_mean": 0.04308299319727893, + "causal_surprisal_total": 0.21947925170068028, + "consistency_total": 0.6014102891156462, + "curvature_flow": 0.13473979591836735, + "curvature_packet": 0.8640295918367348, + "curvature_total": 0.6251773809523808, + "direction_drift_flow": 0.48991743197278914, + "direction_drift_packet_max": 0.5454671768707483, + "direction_drift_packet_mean": 0.8005069727891156, + "direction_drift_packet_median": 0.8068619047619049, + "direction_drift_packet_trimmed10_mean": 0.8100392857142857, + "direction_drift_total": 0.5444477891156463, + "flow_consistency": 0.6968035714285714, + "kappa2_speed2norm_packet_mean": 0.9837039965986395, + "kappa2_speed2norm_packet_median": 0.9853947278911563, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9858731292517007, + "kinetic_energy": 0.756333843537415, + "kinetic_flow": 0.5990501700680272, + "kinetic_packet": 0.6588440476190475, + "packet_consistency": 0.15941836734693876, + "pna_flow": 0.14212431972789116, + "pna_packet_max": 0.651868537414966, + "pna_packet_mean": 0.9837039965986395, + "pna_packet_median": 0.9853947278911563, + "pna_packet_trimmed10_mean": 0.9858731292517007, + "terminal_flow": 0.6046933673469387, + "terminal_norm": 0.7309876700680272, + "terminal_packet": 0.609951955782313, + "velocity_flow": 0.6011477891156463, + "velocity_packet": 0.3173721088435374, + "velocity_total": 0.7710568877551021 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "arc_length": 0.7398000850340136, + "causal_surprisal_flow": 0.061269047619047626, + "causal_surprisal_packet_max": 0.04296377551020409, + "causal_surprisal_packet_mean": 0.04419931972789116, + "causal_surprisal_packet_median": 0.09266241496598639, + "causal_surprisal_packet_trimmed10_mean": 0.046538265306122456, + "causal_surprisal_total": 0.20583945578231294, + "consistency_total": 0.5604663265306122, + "curvature_flow": 0.09381530612244898, + "curvature_packet": 0.9801074829931973, + "curvature_total": 0.726454081632653, + "direction_drift_flow": 0.5675040816326531, + "direction_drift_packet_max": 0.1720777210884354, + "direction_drift_packet_mean": 0.2882837585034014, + "direction_drift_packet_median": 0.3022784013605442, + "direction_drift_packet_trimmed10_mean": 0.30428222789115644, + "direction_drift_total": 0.09887619047619046, + "flow_consistency": 0.3622848639455782, + "kappa2_speed2norm_packet_mean": 0.9449917517006802, + "kappa2_speed2norm_packet_median": 0.9526840986394558, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9518698979591838, + "kinetic_energy": 0.7380086734693877, + "kinetic_flow": 0.5549552721088434, + "kinetic_packet": 0.6555909863945577, + "packet_consistency": 0.7778062925170067, + "pna_flow": 0.10038996598639457, + "pna_packet_max": 0.5867801020408163, + "pna_packet_mean": 0.9449917517006802, + "pna_packet_median": 0.9526840986394558, + "pna_packet_trimmed10_mean": 0.9518698979591838, + "terminal_flow": 0.7539801020408162, + "terminal_norm": 0.9432484693877551, + "terminal_packet": 0.5395788265306123, + "velocity_flow": 0.5104154761904762, + "velocity_packet": 0.9382493197278912, + "velocity_total": 0.9508482993197279 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "arc_length": 0.6379547619047619, + "causal_surprisal_flow": 0.2339901360544218, + "causal_surprisal_packet_max": 0.1630544217687075, + "causal_surprisal_packet_mean": 0.1037578231292517, + "causal_surprisal_packet_median": 0.11211394557823129, + "causal_surprisal_packet_trimmed10_mean": 0.09934183673469388, + "causal_surprisal_total": 0.23891462585034012, + "consistency_total": 0.3878925170068027, + "curvature_flow": 0.3657818027210884, + "curvature_packet": 0.9798546768707482, + "curvature_total": 0.8550028911564626, + "direction_drift_flow": 0.39491921768707483, + "direction_drift_packet_max": 0.5863732993197278, + "direction_drift_packet_mean": 0.6655517857142857, + "direction_drift_packet_median": 0.6610989795918366, + "direction_drift_packet_trimmed10_mean": 0.6492875, + "direction_drift_total": 0.53634481292517, + "flow_consistency": 0.39963486394557823, + "kappa2_speed2norm_packet_mean": 0.9987261904761905, + "kappa2_speed2norm_packet_median": 0.9985124149659864, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9987394557823129, + "kinetic_energy": 0.6333656462585034, + "kinetic_flow": 0.6084583333333334, + "kinetic_packet": 0.43333707482993195, + "packet_consistency": 0.45219081632653063, + "pna_flow": 0.28176275510204085, + "pna_packet_max": 0.9136319727891158, + "pna_packet_mean": 0.9987261904761905, + "pna_packet_median": 0.9985124149659864, + "pna_packet_trimmed10_mean": 0.9987394557823129, + "terminal_flow": 0.5206586734693878, + "terminal_norm": 0.5781535714285714, + "terminal_packet": 0.37306513605442176, + "velocity_flow": 0.6945085034013606, + "velocity_packet": 0.6564085034013605, + "velocity_total": 0.7753212585034013 + }, + "DrDoS_UDP": { + "_n": 588.0, + "arc_length": 0.6389096088435375, + "causal_surprisal_flow": 0.23143690476190476, + "causal_surprisal_packet_max": 0.1670450680272109, + "causal_surprisal_packet_mean": 0.10870867346938776, + "causal_surprisal_packet_median": 0.11110051020408163, + "causal_surprisal_packet_trimmed10_mean": 0.11005935374149661, + "causal_surprisal_total": 0.24396751700680272, + "consistency_total": 0.3665258503401361, + "curvature_flow": 0.40208095238095237, + "curvature_packet": 0.9780496598639455, + "curvature_total": 0.8556200680272108, + "direction_drift_flow": 0.3908578231292517, + "direction_drift_packet_max": 0.5850687925170068, + "direction_drift_packet_mean": 0.6714586734693878, + "direction_drift_packet_median": 0.6714096938775509, + "direction_drift_packet_trimmed10_mean": 0.6630093537414966, + "direction_drift_total": 0.5358904761904763, + "flow_consistency": 0.3908331632653061, + "kappa2_speed2norm_packet_mean": 0.9993906462585034, + "kappa2_speed2norm_packet_median": 0.9991149659863947, + "kappa2_speed2norm_packet_trimmed10_mean": 0.999125850340136, + "kinetic_energy": 0.6340951530612244, + "kinetic_flow": 0.6127285714285715, + "kinetic_packet": 0.42449829931972793, + "packet_consistency": 0.44060952380952384, + "pna_flow": 0.29915008503401364, + "pna_packet_max": 0.9215355442176871, + "pna_packet_mean": 0.9993906462585034, + "pna_packet_median": 0.9991149659863947, + "pna_packet_trimmed10_mean": 0.999125850340136, + "terminal_flow": 0.47714897959183666, + "terminal_norm": 0.5418645408163265, + "terminal_packet": 0.36334795918367346, + "velocity_flow": 0.6996600340136054, + "velocity_packet": 0.6514627551020409, + "velocity_total": 0.7803331632653062 + }, + "LDAP": { + "_n": 588.0, + "arc_length": 0.7380619047619048, + "causal_surprisal_flow": 0.059901700680272105, + "causal_surprisal_packet_max": 0.044225340136054433, + "causal_surprisal_packet_mean": 0.04562602040816327, + "causal_surprisal_packet_median": 0.09656394557823128, + "causal_surprisal_packet_trimmed10_mean": 0.04848290816326531, + "causal_surprisal_total": 0.20435493197278912, + "consistency_total": 0.5639460884353741, + "curvature_flow": 0.08691615646258503, + "curvature_packet": 0.9864465986394557, + "curvature_total": 0.7252687074829932, + "direction_drift_flow": 0.5728721938775511, + "direction_drift_packet_max": 0.15474914965986394, + "direction_drift_packet_mean": 0.27084294217687077, + "direction_drift_packet_median": 0.2852410714285714, + "direction_drift_packet_trimmed10_mean": 0.2872992346938776, + "direction_drift_total": 0.07946224489795918, + "flow_consistency": 0.36639557823129254, + "kappa2_speed2norm_packet_mean": 0.9389068027210885, + "kappa2_speed2norm_packet_median": 0.9472169217687076, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9462085034013606, + "kinetic_energy": 0.7363566326530613, + "kinetic_flow": 0.5500301020408164, + "kinetic_packet": 0.6564147108843538, + "packet_consistency": 0.8100284013605443, + "pna_flow": 0.09589472789115647, + "pna_packet_max": 0.5764580782312925, + "pna_packet_mean": 0.9389068027210885, + "pna_packet_median": 0.9472169217687076, + "pna_packet_trimmed10_mean": 0.9462085034013606, + "terminal_flow": 0.7749784013605442, + "terminal_norm": 0.9546494897959185, + "terminal_packet": 0.5401038265306123, + "velocity_flow": 0.5018897959183674, + "velocity_packet": 0.967984693877551, + "velocity_total": 0.9583884353741495 + }, + "MSSQL": { + "_n": 588.0, + "arc_length": 0.7393966836734694, + "causal_surprisal_flow": 0.08071666666666666, + "causal_surprisal_packet_max": 0.043465816326530626, + "causal_surprisal_packet_mean": 0.04405323129251702, + "causal_surprisal_packet_median": 0.07315867346938776, + "causal_surprisal_packet_trimmed10_mean": 0.045718537414965996, + "causal_surprisal_total": 0.22095221088435374, + "consistency_total": 0.549012074829932, + "curvature_flow": 0.10432551020408162, + "curvature_packet": 0.9876767006802721, + "curvature_total": 0.7781765306122449, + "direction_drift_flow": 0.551506037414966, + "direction_drift_packet_max": 0.3777238095238096, + "direction_drift_packet_mean": 0.5998972789115646, + "direction_drift_packet_median": 0.6075716836734694, + "direction_drift_packet_trimmed10_mean": 0.6148265306122449, + "direction_drift_total": 0.2933517857142857, + "flow_consistency": 0.5844735544217687, + "kappa2_speed2norm_packet_mean": 0.9967054421768708, + "kappa2_speed2norm_packet_median": 0.9969260204081632, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9971073129251701, + "kinetic_energy": 0.7370484693877551, + "kinetic_flow": 0.5841938775510204, + "kinetic_packet": 0.616674149659864, + "packet_consistency": 0.4800835884353742, + "pna_flow": 0.11364778911564626, + "pna_packet_max": 0.8536074829931973, + "pna_packet_mean": 0.9967054421768708, + "pna_packet_median": 0.9969260204081632, + "pna_packet_trimmed10_mean": 0.9971073129251701, + "terminal_flow": 0.6804125850340136, + "terminal_norm": 0.8762844387755103, + "terminal_packet": 0.5299300170068028, + "velocity_flow": 0.5783854591836735, + "velocity_packet": 0.7151295918367347, + "velocity_total": 0.9048929421768708 + }, + "NetBIOS": { + "_n": 588.0, + "arc_length": 0.757198469387755, + "causal_surprisal_flow": 0.10104965986394558, + "causal_surprisal_packet_max": 0.041848299319727916, + "causal_surprisal_packet_mean": 0.041978741496598665, + "causal_surprisal_packet_median": 0.06186224489795918, + "causal_surprisal_packet_trimmed10_mean": 0.04270459183673471, + "causal_surprisal_total": 0.23296683673469387, + "consistency_total": 0.603978656462585, + "curvature_flow": 0.14186326530612245, + "curvature_packet": 0.8732147959183674, + "curvature_total": 0.6393739795918368, + "direction_drift_flow": 0.48437593537414964, + "direction_drift_packet_max": 0.5478238945578231, + "direction_drift_packet_mean": 0.798967857142857, + "direction_drift_packet_median": 0.8052316326530611, + "direction_drift_packet_trimmed10_mean": 0.8085849489795917, + "direction_drift_total": 0.5439470238095238, + "flow_consistency": 0.6997864795918367, + "kappa2_speed2norm_packet_mean": 0.986190306122449, + "kappa2_speed2norm_packet_median": 0.987550850340136, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9881231292517008, + "kinetic_energy": 0.7550464285714286, + "kinetic_flow": 0.5944850340136055, + "kinetic_packet": 0.6607890306122448, + "packet_consistency": 0.15264489795918368, + "pna_flow": 0.15052891156462583, + "pna_packet_max": 0.6639684523809524, + "pna_packet_mean": 0.986190306122449, + "pna_packet_median": 0.987550850340136, + "pna_packet_trimmed10_mean": 0.9881231292517008, + "terminal_flow": 0.6065960884353742, + "terminal_norm": 0.7282176870748299, + "terminal_packet": 0.6112000850340136, + "velocity_flow": 0.5990300170068028, + "velocity_packet": 0.31660501700680277, + "velocity_total": 0.7688873299319728 + }, + "Portmap": { + "_n": 588.0, + "arc_length": 0.7608501700680274, + "causal_surprisal_flow": 0.08985833333333333, + "causal_surprisal_packet_max": 0.04341105442176873, + "causal_surprisal_packet_mean": 0.04379251700680275, + "causal_surprisal_packet_median": 0.0636498299319728, + "causal_surprisal_packet_trimmed10_mean": 0.04490051020408165, + "causal_surprisal_total": 0.2251324829931973, + "consistency_total": 0.6055539115646258, + "curvature_flow": 0.1292765306122449, + "curvature_packet": 0.8715938775510205, + "curvature_total": 0.6324169217687075, + "direction_drift_flow": 0.49247346938775516, + "direction_drift_packet_max": 0.5419670918367346, + "direction_drift_packet_mean": 0.799656887755102, + "direction_drift_packet_median": 0.8060301870748299, + "direction_drift_packet_trimmed10_mean": 0.8091550170068027, + "direction_drift_total": 0.545908843537415, + "flow_consistency": 0.7000304421768707, + "kappa2_speed2norm_packet_mean": 0.9821960884353742, + "kappa2_speed2norm_packet_median": 0.9839729591836733, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9843931972789115, + "kinetic_energy": 0.7588066326530613, + "kinetic_flow": 0.5953860544217687, + "kinetic_packet": 0.6721450680272107, + "packet_consistency": 0.15859132653061225, + "pna_flow": 0.13599795918367347, + "pna_packet_max": 0.6554971088435375, + "pna_packet_mean": 0.9821960884353742, + "pna_packet_median": 0.9839729591836733, + "pna_packet_trimmed10_mean": 0.9843931972789115, + "terminal_flow": 0.6110670068027212, + "terminal_norm": 0.7438019557823129, + "terminal_packet": 0.6220636904761906, + "velocity_flow": 0.5943484693877551, + "velocity_packet": 0.32014464285714284, + "velocity_total": 0.7689787414965986 + }, + "Syn": { + "_n": 588.0, + "arc_length": 0.8654168367346939, + "causal_surprisal_flow": 0.22409438775510204, + "causal_surprisal_packet_max": 0.2997165816326531, + "causal_surprisal_packet_mean": 0.38080238095238095, + "causal_surprisal_packet_median": 0.6702840136054422, + "causal_surprisal_packet_trimmed10_mean": 0.44935357142857146, + "causal_surprisal_total": 0.350808843537415, + "consistency_total": 0.6977297619047619, + "curvature_flow": 0.13365960884353742, + "curvature_packet": 0.8146579081632653, + "curvature_total": 0.6126518707482993, + "direction_drift_flow": 0.4607259353741497, + "direction_drift_packet_max": 0.7071792517006802, + "direction_drift_packet_mean": 0.809237074829932, + "direction_drift_packet_median": 0.838173469387755, + "direction_drift_packet_trimmed10_mean": 0.8076348639455783, + "direction_drift_total": 0.6691106292517008, + "flow_consistency": 0.7086985544217688, + "kappa2_speed2norm_packet_mean": 0.27800459183673465, + "kappa2_speed2norm_packet_median": 0.32781760204081634, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2797582482993197, + "kinetic_energy": 0.8649680272108844, + "kinetic_flow": 0.5793319727891156, + "kinetic_packet": 0.9386785714285715, + "packet_consistency": 0.7400772108843536, + "pna_flow": 0.13769098639455782, + "pna_packet_max": 0.19019642857142857, + "pna_packet_mean": 0.27800459183673465, + "pna_packet_median": 0.32781760204081634, + "pna_packet_trimmed10_mean": 0.2797582482993197, + "terminal_flow": 0.6948406462585034, + "terminal_norm": 0.9491363945578232, + "terminal_packet": 0.955009693877551, + "velocity_flow": 0.5968388605442176, + "velocity_packet": 0.7198918367346938, + "velocity_total": 0.827631887755102 + }, + "TFTP": { + "_n": 588.0, + "arc_length": 0.67255, + "causal_surprisal_flow": 0.08046887755102042, + "causal_surprisal_packet_max": 0.07901607142857144, + "causal_surprisal_packet_mean": 0.06127125850340137, + "causal_surprisal_packet_median": 0.09734812925170068, + "causal_surprisal_packet_trimmed10_mean": 0.05773384353741497, + "causal_surprisal_total": 0.18280884353741494, + "consistency_total": 0.3658043367346939, + "curvature_flow": 0.21517431972789117, + "curvature_packet": 0.9919627551020409, + "curvature_total": 0.8888389455782313, + "direction_drift_flow": 0.37494710884353744, + "direction_drift_packet_max": 0.5115329931972789, + "direction_drift_packet_mean": 0.6494419217687075, + "direction_drift_packet_median": 0.63819481292517, + "direction_drift_packet_trimmed10_mean": 0.6522704081632653, + "direction_drift_total": 0.5094482993197279, + "flow_consistency": 0.3552091836734694, + "kappa2_speed2norm_packet_mean": 0.9936430272108845, + "kappa2_speed2norm_packet_median": 0.9936559523809524, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9936909863945578, + "kinetic_energy": 0.6690388605442177, + "kinetic_flow": 0.7111658163265305, + "kinetic_packet": 0.4700653911564626, + "packet_consistency": 0.568418962585034, + "pna_flow": 0.1815824829931973, + "pna_packet_max": 0.927191836734694, + "pna_packet_mean": 0.9936430272108845, + "pna_packet_median": 0.9936559523809524, + "pna_packet_trimmed10_mean": 0.9936909863945578, + "terminal_flow": 0.6574059523809525, + "terminal_norm": 0.6689480442176869, + "terminal_packet": 0.3772030612244899, + "velocity_flow": 0.7077778061224489, + "velocity_packet": 0.7580880102040816, + "velocity_total": 0.8475237244897958 + }, + "UDP": { + "_n": 588.0, + "arc_length": 0.6307914965986394, + "causal_surprisal_flow": 0.24817023809523814, + "causal_surprisal_packet_max": 0.18411734693877552, + "causal_surprisal_packet_mean": 0.12042908163265308, + "causal_surprisal_packet_median": 0.11799608843537415, + "causal_surprisal_packet_trimmed10_mean": 0.12276003401360545, + "causal_surprisal_total": 0.2511613095238095, + "consistency_total": 0.3616147959183674, + "curvature_flow": 0.41530595238095236, + "curvature_packet": 0.9777784013605443, + "curvature_total": 0.8614725340136054, + "direction_drift_flow": 0.38065382653061225, + "direction_drift_packet_max": 0.5709378401360543, + "direction_drift_packet_mean": 0.6516649659863946, + "direction_drift_packet_median": 0.6479376700680273, + "direction_drift_packet_trimmed10_mean": 0.6410256802721088, + "direction_drift_total": 0.5200778061224489, + "flow_consistency": 0.38130858843537413, + "kappa2_speed2norm_packet_mean": 0.999402380952381, + "kappa2_speed2norm_packet_median": 0.9991602040816326, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9993404761904761, + "kinetic_energy": 0.6257015306122449, + "kinetic_flow": 0.6122427721088435, + "kinetic_packet": 0.41051471088435376, + "packet_consistency": 0.44479574829931967, + "pna_flow": 0.3104530612244898, + "pna_packet_max": 0.9260766156462586, + "pna_packet_mean": 0.999402380952381, + "pna_packet_median": 0.9991602040816326, + "pna_packet_trimmed10_mean": 0.9993404761904761, + "terminal_flow": 0.47630153061224484, + "terminal_norm": 0.5271413265306122, + "terminal_packet": 0.35213401360544216, + "velocity_flow": 0.7085785714285714, + "velocity_packet": 0.6555158163265307, + "velocity_total": 0.7742879251700682 + }, + "UDPLag": { + "_n": 588.0, + "arc_length": 0.8382751700680273, + "causal_surprisal_flow": 0.2055857142857143, + "causal_surprisal_packet_max": 0.29397287414965984, + "causal_surprisal_packet_mean": 0.3714443877551021, + "causal_surprisal_packet_median": 0.6510141156462586, + "causal_surprisal_packet_trimmed10_mean": 0.4332017006802721, + "causal_surprisal_total": 0.3230534013605442, + "consistency_total": 0.6629630102040814, + "curvature_flow": 0.17639574829931973, + "curvature_packet": 0.8500153061224489, + "curvature_total": 0.6556132653061224, + "direction_drift_flow": 0.43456130952380956, + "direction_drift_packet_max": 0.6953194727891157, + "direction_drift_packet_mean": 0.8243330782312924, + "direction_drift_packet_median": 0.8349580782312924, + "direction_drift_packet_trimmed10_mean": 0.8219496598639455, + "direction_drift_total": 0.6875333333333334, + "flow_consistency": 0.6697246598639455, + "kappa2_speed2norm_packet_mean": 0.4016086734693878, + "kappa2_speed2norm_packet_median": 0.44023809523809526, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4020436224489796, + "kinetic_energy": 0.8371364795918368, + "kinetic_flow": 0.5779738095238095, + "kinetic_packet": 0.8771243197278911, + "packet_consistency": 0.7249435374149659, + "pna_flow": 0.17472908163265308, + "pna_packet_max": 0.2919083333333333, + "pna_packet_mean": 0.4016086734693878, + "pna_packet_median": 0.44023809523809526, + "pna_packet_trimmed10_mean": 0.4020436224489796, + "terminal_flow": 0.6749284013605441, + "terminal_norm": 0.905720068027211, + "terminal_packet": 0.880662074829932, + "velocity_flow": 0.6121933673469389, + "velocity_packet": 0.7215586734693877, + "velocity_total": 0.8302489795918367 + }, + "WebDDoS": { + "_n": 438.0, + "arc_length": 0.7167557077625571, + "causal_surprisal_flow": 0.23189497716894975, + "causal_surprisal_packet_max": 0.3975034246575342, + "causal_surprisal_packet_mean": 0.46099406392694064, + "causal_surprisal_packet_median": 0.7032747716894977, + "causal_surprisal_packet_trimmed10_mean": 0.50055, + "causal_surprisal_total": 0.2799470319634703, + "consistency_total": 0.5403534246575343, + "curvature_flow": 0.5196727168949771, + "curvature_packet": 0.5674640410958904, + "curvature_total": 0.5823817351598173, + "direction_drift_flow": 0.25676906392694065, + "direction_drift_packet_max": 0.6444223744292238, + "direction_drift_packet_mean": 0.6413589041095891, + "direction_drift_packet_median": 0.6248433789954337, + "direction_drift_packet_trimmed10_mean": 0.6035174657534247, + "direction_drift_total": 0.5473740867579908, + "flow_consistency": 0.558577397260274, + "kappa2_speed2norm_packet_mean": 0.41840273972602743, + "kappa2_speed2norm_packet_median": 0.4163156392694064, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3827477168949772, + "kinetic_energy": 0.7142841324200914, + "kinetic_flow": 0.7175621004566209, + "kinetic_packet": 0.6357961187214611, + "packet_consistency": 0.5400267123287672, + "pna_flow": 0.3483381278538813, + "pna_packet_max": 0.41171837899543373, + "pna_packet_mean": 0.41840273972602743, + "pna_packet_median": 0.4163156392694064, + "pna_packet_trimmed10_mean": 0.3827477168949772, + "terminal_flow": 0.5345385844748858, + "terminal_norm": 0.6023639269406392, + "terminal_packet": 0.6477623287671234, + "velocity_flow": 0.7538402968036528, + "velocity_packet": 0.5025495433789955, + "velocity_total": 0.7227873287671233 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicddos2019.log b/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicddos2019.log new file mode 100644 index 0000000..efe7fa9 --- /dev/null +++ b/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicddos2019.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=52 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 8,993,376 target rows; label distribution top: + Syn 1,495,248 + NetBIOS 702,760 + UDP 611,999 + MSSQL 523,845 + LDAP 509,665 +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 19.7s +[eval] scoring attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done in 18.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicddos2019.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicddos2019.npz + +=== overall AUROC top-10 === + curvature_packet AUROC=0.9272 AUPRC=0.9285 + kappa2_speed2norm_packet_median AUROC=0.8847 AUPRC=0.9207 + pna_packet_median AUROC=0.8847 AUPRC=0.9207 + kappa2_speed2norm_packet_trimmed10_mean AUROC=0.8780 AUPRC=0.9181 + pna_packet_trimmed10_mean AUROC=0.8780 AUPRC=0.9181 + kappa2_speed2norm_packet_mean AUROC=0.8774 AUPRC=0.9169 + pna_packet_mean AUROC=0.8774 AUPRC=0.9169 + velocity_total AUROC=0.8247 AUPRC=0.7330 + terminal_norm AUROC=0.7763 AUPRC=0.7150 + curvature_total AUROC=0.7466 AUPRC=0.6880 diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicddos2019.npz new file mode 100644 index 0000000..d2a82f1 Binary files /dev/null and b/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicids2017.json b/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicids2017.json new file mode 100644 index 0000000..7657d8e --- /dev/null +++ b/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicids2017.json @@ -0,0 +1,740 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.6693987226816303, + "auprc": 0.6307168667057912 + }, + "causal_surprisal_flow": { + "auroc": 0.32992626255168345, + "auprc": 0.4228554061280035 + }, + "causal_surprisal_packet_max": { + "auroc": 0.6924694624926166, + "auprc": 0.5408682075240602 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.7250726225634967, + "auprc": 0.6077455682069488 + }, + "causal_surprisal_packet_median": { + "auroc": 0.6106990327820437, + "auprc": 0.5762540135189611 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.6283507678676905, + "auprc": 0.562712635331508 + }, + "causal_surprisal_total": { + "auroc": 0.3555159849379799, + "auprc": 0.3168708826769052 + }, + "consistency_total": { + "auroc": 0.7191444108092144, + "auprc": 0.5140557057422118 + }, + "curvature_flow": { + "auroc": 0.41400631275841693, + "auprc": 0.3385120457920695 + }, + "curvature_packet": { + "auroc": 0.6941839486119314, + "auprc": 0.5237704909664221 + }, + "curvature_total": { + "auroc": 0.5417761739515653, + "auprc": 0.3836516353060392 + }, + "direction_drift_flow": { + "auroc": 0.3091564899586533, + "auprc": 0.2947530475988029 + }, + "direction_drift_packet_max": { + "auroc": 0.670409347312463, + "auprc": 0.5216951586768741 + }, + "direction_drift_packet_mean": { + "auroc": 0.5511160440047254, + "auprc": 0.41034217041257676 + }, + "direction_drift_packet_median": { + "auroc": 0.5294736414648553, + "auprc": 0.40358711990661333 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.5181976668635558, + "auprc": 0.3969801090776931 + }, + "direction_drift_total": { + "auroc": 0.5887480877141169, + "auprc": 0.5021914972067998 + }, + "flow_consistency": { + "auroc": 0.6975689825753101, + "auprc": 0.5006756340488067 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.29486365180153573, + "auprc": 0.28960202212815694 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.28411503987005315, + "auprc": 0.2862638749329162 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.2639871308328411, + "auprc": 0.28121159576177096 + }, + "kinetic_energy": { + "auroc": 0.662477990253987, + "auprc": 0.626442536406984 + }, + "kinetic_flow": { + "auroc": 0.7623019344359125, + "auprc": 0.5722558963862513 + }, + "kinetic_packet": { + "auroc": 0.7329009155345542, + "auprc": 0.6638587540234341 + }, + "packet_consistency": { + "auroc": 0.7718631423508565, + "auprc": 0.5442551545407739 + }, + "pna_flow": { + "auroc": 0.33444410809214414, + "auprc": 0.305197180784214 + }, + "pna_packet_max": { + "auroc": 0.4321551757235676, + "auprc": 0.34202736165933983 + }, + "pna_packet_mean": { + "auroc": 0.29486365180153573, + "auprc": 0.28960202212815694 + }, + "pna_packet_median": { + "auroc": 0.28411503987005315, + "auprc": 0.2862638749329162 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.2639871308328411, + "auprc": 0.28121159576177096 + }, + "terminal_flow": { + "auroc": 0.7382281010041347, + "auprc": 0.547069590690638 + }, + "terminal_norm": { + "auroc": 0.7620579075605435, + "auprc": 0.6863413028328904 + }, + "terminal_packet": { + "auroc": 0.7606633933845245, + "auprc": 0.6919732677873608 + }, + "velocity_flow": { + "auroc": 0.7416655050206734, + "auprc": 0.5632900885051604 + }, + "velocity_packet": { + "auroc": 0.746884303012404, + "auprc": 0.5242604565760098 + }, + "velocity_total": { + "auroc": 0.7252487669816894, + "auprc": 0.6147208410956186 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "arc_length": 0.7449078828828829, + "causal_surprisal_flow": 0.9648211711711712, + "causal_surprisal_packet_max": 0.7045349849849849, + "causal_surprisal_packet_mean": 0.6510421921921923, + "causal_surprisal_packet_median": 0.1679518018018018, + "causal_surprisal_packet_trimmed10_mean": 0.3164503003003003, + "causal_surprisal_total": 0.8302705705705704, + "consistency_total": 0.7861270270270271, + "curvature_flow": 0.09034609609609609, + "curvature_packet": 0.8535024774774774, + "curvature_total": 0.6467901651651651, + "direction_drift_flow": 0.5655278528528528, + "direction_drift_packet_max": 0.8636650150150151, + "direction_drift_packet_mean": 0.7289415915915917, + "direction_drift_packet_median": 0.6221217717717717, + "direction_drift_packet_trimmed10_mean": 0.6303181681681681, + "direction_drift_total": 0.808478003003003, + "flow_consistency": 0.773031981981982, + "kappa2_speed2norm_packet_mean": 0.595156981981982, + "kappa2_speed2norm_packet_median": 0.595947972972973, + "kappa2_speed2norm_packet_trimmed10_mean": 0.545228903903904, + "kinetic_energy": 0.7468393393393394, + "kinetic_flow": 0.6499132132132133, + "kinetic_packet": 0.8575852852852853, + "packet_consistency": 0.7509972222222222, + "pna_flow": 0.08537567567567567, + "pna_packet_max": 0.6045066066066066, + "pna_packet_mean": 0.595156981981982, + "pna_packet_median": 0.595947972972973, + "pna_packet_trimmed10_mean": 0.545228903903904, + "terminal_flow": 0.7635360360360361, + "terminal_norm": 0.7630103603603604, + "terminal_packet": 0.7972462462462463, + "velocity_flow": 0.4735554054054054, + "velocity_packet": 0.7595021771771773, + "velocity_total": 0.5208243243243244 + }, + "DDoS": { + "_n": 666.0, + "arc_length": 0.8535571321321321, + "causal_surprisal_flow": 0.040753903903903904, + "causal_surprisal_packet_max": 0.7227740240240239, + "causal_surprisal_packet_mean": 0.7853739489489489, + "causal_surprisal_packet_median": 0.7025003003003004, + "causal_surprisal_packet_trimmed10_mean": 0.7495021021021021, + "causal_surprisal_total": 0.15795585585585584, + "consistency_total": 0.7446772522522522, + "curvature_flow": 0.36689204204204207, + "curvature_packet": 0.788875075075075, + "curvature_total": 0.637391966966967, + "direction_drift_flow": 0.31126681681681684, + "direction_drift_packet_max": 0.7311108108108109, + "direction_drift_packet_mean": 0.48732334834834834, + "direction_drift_packet_median": 0.4348989489489489, + "direction_drift_packet_trimmed10_mean": 0.40128460960960965, + "direction_drift_total": 0.5789665915915916, + "flow_consistency": 0.71198490990991, + "kappa2_speed2norm_packet_mean": 0.26428633633633636, + "kappa2_speed2norm_packet_median": 0.21030285285285288, + "kappa2_speed2norm_packet_trimmed10_mean": 0.1766987987987988, + "kinetic_energy": 0.8474240240240242, + "kinetic_flow": 0.7041777777777778, + "kinetic_packet": 0.9231331831831833, + "packet_consistency": 0.8410141141141143, + "pna_flow": 0.35833753753753755, + "pna_packet_max": 0.5855533033033032, + "pna_packet_mean": 0.26428633633633636, + "pna_packet_median": 0.21030285285285288, + "pna_packet_trimmed10_mean": 0.1766987987987988, + "terminal_flow": 0.8132323573573573, + "terminal_norm": 0.9293594594594594, + "terminal_packet": 0.9563722222222223, + "velocity_flow": 0.7175671171171171, + "velocity_packet": 0.8440139639639639, + "velocity_total": 0.8027474474474475 + }, + "DoS GoldenEye": { + "_n": 666.0, + "arc_length": 0.544963963963964, + "causal_surprisal_flow": 0.023365015015015023, + "causal_surprisal_packet_max": 0.7755627627627628, + "causal_surprisal_packet_mean": 0.8512054804804805, + "causal_surprisal_packet_median": 0.6208696696696696, + "causal_surprisal_packet_trimmed10_mean": 0.7914606606606607, + "causal_surprisal_total": 0.14564474474474476, + "consistency_total": 0.7462177177177177, + "curvature_flow": 0.23909954954954957, + "curvature_packet": 0.521356981981982, + "curvature_total": 0.4388395645645646, + "direction_drift_flow": 0.2615807057057057, + "direction_drift_packet_max": 0.7309156156156157, + "direction_drift_packet_mean": 0.5508364864864865, + "direction_drift_packet_median": 0.5317722972972974, + "direction_drift_packet_trimmed10_mean": 0.49830780780780776, + "direction_drift_total": 0.6703533033033033, + "flow_consistency": 0.6937810810810812, + "kappa2_speed2norm_packet_mean": 0.17148978978978976, + "kappa2_speed2norm_packet_median": 0.13097845345345346, + "kappa2_speed2norm_packet_trimmed10_mean": 0.11262545045045044, + "kinetic_energy": 0.5326445195195195, + "kinetic_flow": 0.760256906906907, + "kinetic_packet": 0.6007538288288288, + "packet_consistency": 0.8297723723723723, + "pna_flow": 0.09624174174174174, + "pna_packet_max": 0.5360021021021022, + "pna_packet_mean": 0.17148978978978976, + "pna_packet_median": 0.13097845345345346, + "pna_packet_trimmed10_mean": 0.11262545045045044, + "terminal_flow": 0.8490830330330331, + "terminal_norm": 0.7967322072072073, + "terminal_packet": 0.7481662162162162, + "velocity_flow": 0.7611861861861862, + "velocity_packet": 0.7987527027027027, + "velocity_total": 0.7713645645645646 + }, + "DoS Hulk": { + "_n": 666.0, + "arc_length": 0.5479768018018019, + "causal_surprisal_flow": 0.0756430930930931, + "causal_surprisal_packet_max": 0.7968755255255255, + "causal_surprisal_packet_mean": 0.8739295795795795, + "causal_surprisal_packet_median": 0.6786788288288288, + "causal_surprisal_packet_trimmed10_mean": 0.8010968468468469, + "causal_surprisal_total": 0.2150006006006006, + "consistency_total": 0.6587692192192193, + "curvature_flow": 0.32485878378378374, + "curvature_packet": 0.783915015015015, + "curvature_total": 0.6373363363363362, + "direction_drift_flow": 0.31204136636636637, + "direction_drift_packet_max": 0.6362640390390392, + "direction_drift_packet_mean": 0.3666141141141141, + "direction_drift_packet_median": 0.2952928678678679, + "direction_drift_packet_trimmed10_mean": 0.28125938438438436, + "direction_drift_total": 0.4585988738738739, + "flow_consistency": 0.5840722222222222, + "kappa2_speed2norm_packet_mean": 0.26822447447447445, + "kappa2_speed2norm_packet_median": 0.21757927927927928, + "kappa2_speed2norm_packet_trimmed10_mean": 0.19130570570570568, + "kinetic_energy": 0.5380961711711711, + "kinetic_flow": 0.6868316816816817, + "kinetic_packet": 0.6724398648648648, + "packet_consistency": 0.8604506006006006, + "pna_flow": 0.35912702702702703, + "pna_packet_max": 0.5467501501501502, + "pna_packet_mean": 0.26822447447447445, + "pna_packet_median": 0.21757927927927928, + "pna_packet_trimmed10_mean": 0.19130570570570568, + "terminal_flow": 0.7870956456456456, + "terminal_norm": 0.6697349099099099, + "terminal_packet": 0.6776635885885886, + "velocity_flow": 0.6820720720720721, + "velocity_packet": 0.8733442942942943, + "velocity_total": 0.7884078078078077 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "arc_length": 0.8028598348348349, + "causal_surprisal_flow": 0.17477785285285286, + "causal_surprisal_packet_max": 0.7769890390390392, + "causal_surprisal_packet_mean": 0.8812935435435434, + "causal_surprisal_packet_median": 0.8236770270270269, + "causal_surprisal_packet_trimmed10_mean": 0.8595885885885886, + "causal_surprisal_total": 0.33990863363363366, + "consistency_total": 0.7536858858858859, + "curvature_flow": 0.3504734234234234, + "curvature_packet": 0.7700536786786786, + "curvature_total": 0.6261974474474474, + "direction_drift_flow": 0.30790007507507505, + "direction_drift_packet_max": 0.7074005255255256, + "direction_drift_packet_mean": 0.538072972972973, + "direction_drift_packet_median": 0.47658596096096095, + "direction_drift_packet_trimmed10_mean": 0.47523243243243246, + "direction_drift_total": 0.6275132882882882, + "flow_consistency": 0.7161111111111113, + "kappa2_speed2norm_packet_mean": 0.3219861861861862, + "kappa2_speed2norm_packet_median": 0.28043018018018023, + "kappa2_speed2norm_packet_trimmed10_mean": 0.26579684684684685, + "kinetic_energy": 0.7933168918918918, + "kinetic_flow": 0.8086042042042042, + "kinetic_packet": 0.8058686936936937, + "packet_consistency": 0.8104385135135135, + "pna_flow": 0.20860015015015015, + "pna_packet_max": 0.4777091591591592, + "pna_packet_mean": 0.3219861861861862, + "pna_packet_median": 0.28043018018018023, + "pna_packet_trimmed10_mean": 0.26579684684684685, + "terminal_flow": 0.8468663663663663, + "terminal_norm": 0.8923644894894894, + "terminal_packet": 0.8401673423423425, + "velocity_flow": 0.791451951951952, + "velocity_packet": 0.7534039039039038, + "velocity_total": 0.8209992492492493 + }, + "DoS Slowloris": { + "_n": 666.0, + "arc_length": 0.8650246996996999, + "causal_surprisal_flow": 0.15426223723723725, + "causal_surprisal_packet_max": 0.8000246246246248, + "causal_surprisal_packet_mean": 0.8249454954954956, + "causal_surprisal_packet_median": 0.8546498498498498, + "causal_surprisal_packet_trimmed10_mean": 0.8124259009009008, + "causal_surprisal_total": 0.5751306306306307, + "consistency_total": 0.7233432432432432, + "curvature_flow": 0.341669069069069, + "curvature_packet": 0.7359489489489489, + "curvature_total": 0.6315705705705705, + "direction_drift_flow": 0.2538779279279279, + "direction_drift_packet_max": 0.5393774024024024, + "direction_drift_packet_mean": 0.44224992492492493, + "direction_drift_packet_median": 0.42356711711711714, + "direction_drift_packet_trimmed10_mean": 0.40950195195195194, + "direction_drift_total": 0.47277710210210205, + "flow_consistency": 0.7364663663663663, + "kappa2_speed2norm_packet_mean": 0.1647605105105105, + "kappa2_speed2norm_packet_median": 0.18250127627627627, + "kappa2_speed2norm_packet_trimmed10_mean": 0.1507153153153153, + "kinetic_energy": 0.8567547297297298, + "kinetic_flow": 0.8289081081081082, + "kinetic_packet": 0.8683192942942942, + "packet_consistency": 0.6663804804804806, + "pna_flow": 0.21918828828828826, + "pna_packet_max": 0.2118527027027027, + "pna_packet_mean": 0.1647605105105105, + "pna_packet_median": 0.18250127627627627, + "pna_packet_trimmed10_mean": 0.1507153153153153, + "terminal_flow": 0.7947292792792793, + "terminal_norm": 0.8672115615615615, + "terminal_packet": 0.821593018018018, + "velocity_flow": 0.8118031531531531, + "velocity_packet": 0.7027504504504505, + "velocity_total": 0.8093076576576576 + }, + "FTP-Patator": { + "_n": 666.0, + "arc_length": 0.22062154654654656, + "causal_surprisal_flow": 0.9800861861861861, + "causal_surprisal_packet_max": 0.7562686186186186, + "causal_surprisal_packet_mean": 0.6823668168168168, + "causal_surprisal_packet_median": 0.33588866366366366, + "causal_surprisal_packet_trimmed10_mean": 0.3672710960960961, + "causal_surprisal_total": 0.27867852852852854, + "consistency_total": 0.8560152402402402, + "curvature_flow": 0.7871641141141141, + "curvature_packet": 0.383324024024024, + "curvature_total": 0.413961036036036, + "direction_drift_flow": 0.1522465465465465, + "direction_drift_packet_max": 0.8903622372372374, + "direction_drift_packet_mean": 0.8307945945945946, + "direction_drift_packet_median": 0.8497588588588588, + "direction_drift_packet_trimmed10_mean": 0.8311876876876878, + "direction_drift_total": 0.9707225225225227, + "flow_consistency": 0.8637250750750752, + "kappa2_speed2norm_packet_mean": 0.39473753753753754, + "kappa2_speed2norm_packet_median": 0.36915382882882886, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3686786036036036, + "kinetic_energy": 0.21214316816816817, + "kinetic_flow": 0.800751051051051, + "kinetic_packet": 0.3745954954954955, + "packet_consistency": 0.7533007507507506, + "pna_flow": 0.6221668168168167, + "pna_packet_max": 0.592245870870871, + "pna_packet_mean": 0.39473753753753754, + "pna_packet_median": 0.36915382882882886, + "pna_packet_trimmed10_mean": 0.3686786036036036, + "terminal_flow": 0.8077165165165167, + "terminal_norm": 0.4555972222222222, + "terminal_packet": 0.49410735735735734, + "velocity_flow": 0.8510432432432433, + "velocity_packet": 0.5998142642642644, + "velocity_total": 0.37351208708708705 + }, + "Heartbleed": { + "_n": 1.0, + "arc_length": 0.22940000000000005, + "causal_surprisal_flow": 0.006199999999999983, + "causal_surprisal_packet_max": 0.8280000000000001, + "causal_surprisal_packet_mean": 0.7535000000000001, + "causal_surprisal_packet_median": 0.14890000000000003, + "causal_surprisal_packet_trimmed10_mean": 0.7015, + "causal_surprisal_total": 0.0131, + "consistency_total": 0.9259, + "curvature_flow": 0.03759999999999997, + "curvature_packet": 0.60615, + "curvature_total": 0.5516, + "direction_drift_flow": 0.006700000000000039, + "direction_drift_packet_max": 0.43620000000000003, + "direction_drift_packet_mean": 0.1533, + "direction_drift_packet_median": 0.21199999999999997, + "direction_drift_packet_trimmed10_mean": 0.16279999999999994, + "direction_drift_total": 0.29359999999999997, + "flow_consistency": 0.9027999999999999, + "kappa2_speed2norm_packet_mean": 0.13649999999999995, + "kappa2_speed2norm_packet_median": 0.17879999999999996, + "kappa2_speed2norm_packet_trimmed10_mean": 0.12270000000000003, + "kinetic_energy": 0.22009999999999996, + "kinetic_flow": 0.9969, + "kinetic_packet": 0.29369999999999996, + "packet_consistency": 0.9387, + "pna_flow": 0.00019999999999997797, + "pna_packet_max": 0.39970000000000006, + "pna_packet_mean": 0.13649999999999995, + "pna_packet_median": 0.17879999999999996, + "pna_packet_trimmed10_mean": 0.12270000000000003, + "terminal_flow": 0.9734999999999999, + "terminal_norm": 0.3829, + "terminal_packet": 0.29390000000000005, + "velocity_flow": 0.9887, + "velocity_packet": 0.9424, + "velocity_total": 0.878 + }, + "Infiltration": { + "_n": 7.0, + "arc_length": 0.7563285714285714, + "causal_surprisal_flow": 0.035128571428571426, + "causal_surprisal_packet_max": 0.7922428571428571, + "causal_surprisal_packet_mean": 0.7515428571428572, + "causal_surprisal_packet_median": 0.41222857142857144, + "causal_surprisal_packet_trimmed10_mean": 0.4978, + "causal_surprisal_total": 0.06947142857142856, + "consistency_total": 0.8925142857142857, + "curvature_flow": 0.5968428571428571, + "curvature_packet": 0.8749571428571429, + "curvature_total": 0.7596714285714286, + "direction_drift_flow": 0.08321428571428571, + "direction_drift_packet_max": 0.7289285714285714, + "direction_drift_packet_mean": 0.5966285714285714, + "direction_drift_packet_median": 0.5945714285714286, + "direction_drift_packet_trimmed10_mean": 0.6001428571428572, + "direction_drift_total": 0.7018142857142857, + "flow_consistency": 0.8834428571428572, + "kappa2_speed2norm_packet_mean": 0.5571714285714285, + "kappa2_speed2norm_packet_median": 0.5758857142857143, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5580571428571428, + "kinetic_energy": 0.7574285714285715, + "kinetic_flow": 0.9193285714285714, + "kinetic_packet": 0.8231857142857143, + "packet_consistency": 0.8775, + "pna_flow": 0.22648571428571426, + "pna_packet_max": 0.7004142857142857, + "pna_packet_mean": 0.5571714285714285, + "pna_packet_median": 0.5758857142857143, + "pna_packet_trimmed10_mean": 0.5580571428571428, + "terminal_flow": 0.8904285714285715, + "terminal_norm": 0.6553571428571429, + "terminal_packet": 0.7634, + "velocity_flow": 0.9224571428571429, + "velocity_packet": 0.7559142857142858, + "velocity_total": 0.5763428571428572 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "arc_length": 0.990817867867868, + "causal_surprisal_flow": 0.09773235735735736, + "causal_surprisal_packet_max": 0.239622972972973, + "causal_surprisal_packet_mean": 0.33772012012012015, + "causal_surprisal_packet_median": 0.6859567567567568, + "causal_surprisal_packet_trimmed10_mean": 0.43885015015015016, + "causal_surprisal_total": 0.4350009009009009, + "consistency_total": 0.5353623123123122, + "curvature_flow": 0.2851948948948949, + "curvature_packet": 0.737964114114114, + "curvature_total": 0.35540030030030023, + "direction_drift_flow": 0.46061996996996996, + "direction_drift_packet_max": 0.46805653153153154, + "direction_drift_packet_mean": 0.5896559309309309, + "direction_drift_packet_median": 0.6056434684684684, + "direction_drift_packet_trimmed10_mean": 0.6108731231231231, + "direction_drift_total": 0.3276623873873874, + "flow_consistency": 0.5163756756756757, + "kappa2_speed2norm_packet_mean": 0.1578379129129129, + "kappa2_speed2norm_packet_median": 0.19533055555555556, + "kappa2_speed2norm_packet_trimmed10_mean": 0.17974451951951953, + "kinetic_energy": 0.9908219219219219, + "kinetic_flow": 0.6872102102102102, + "kinetic_packet": 0.988695945945946, + "packet_consistency": 0.7322303303303305, + "pna_flow": 0.32033048048048046, + "pna_packet_max": 0.09424834834834833, + "pna_packet_mean": 0.1578379129129129, + "pna_packet_median": 0.19533055555555556, + "pna_packet_trimmed10_mean": 0.17974451951951953, + "terminal_flow": 0.49708693693693695, + "terminal_norm": 0.9872205705705707, + "terminal_packet": 0.9910753753753754, + "velocity_flow": 0.6619809309309309, + "velocity_packet": 0.7089581081081081, + "velocity_total": 0.9740695195195195 + }, + "Portscan": { + "_n": 666.0, + "arc_length": 0.9946276276276276, + "causal_surprisal_flow": 0.11201006006006006, + "causal_surprisal_packet_max": 0.4609096096096096, + "causal_surprisal_packet_mean": 0.6351240240240239, + "causal_surprisal_packet_median": 0.8729183183183183, + "causal_surprisal_packet_trimmed10_mean": 0.7524354354354355, + "causal_surprisal_total": 0.5708877627627628, + "consistency_total": 0.4977373123123122, + "curvature_flow": 0.5025959459459458, + "curvature_packet": 0.667976951951952, + "curvature_total": 0.36538333333333334, + "direction_drift_flow": 0.47323475975975976, + "direction_drift_packet_max": 0.2752542042042042, + "direction_drift_packet_mean": 0.2663171921921922, + "direction_drift_packet_median": 0.2893987987987988, + "direction_drift_packet_trimmed10_mean": 0.2882246996996997, + "direction_drift_total": 0.05748070570570571, + "flow_consistency": 0.4780400900900901, + "kappa2_speed2norm_packet_mean": 0.12129061561561562, + "kappa2_speed2norm_packet_median": 0.1473921171171171, + "kappa2_speed2norm_packet_trimmed10_mean": 0.13814534534534534, + "kinetic_energy": 0.9946756756756756, + "kinetic_flow": 0.6961642642642643, + "kinetic_packet": 0.9907635135135134, + "packet_consistency": 0.7568313813813814, + "pna_flow": 0.5158088588588587, + "pna_packet_max": 0.088040990990991, + "pna_packet_mean": 0.12129061561561562, + "pna_packet_median": 0.1473921171171171, + "pna_packet_trimmed10_mean": 0.13814534534534534, + "terminal_flow": 0.3548667417417417, + "terminal_norm": 0.9826932432432433, + "terminal_packet": 0.993889039039039, + "velocity_flow": 0.6596908408408408, + "velocity_packet": 0.7586807057057058, + "velocity_total": 0.990734984984985 + }, + "SSH-Patator": { + "_n": 666.0, + "arc_length": 0.16886471471471473, + "causal_surprisal_flow": 0.7269503003003004, + "causal_surprisal_packet_max": 0.8515376876876876, + "causal_surprisal_packet_mean": 0.7061093093093094, + "causal_surprisal_packet_median": 0.3513644144144144, + "causal_surprisal_packet_trimmed10_mean": 0.3694935435435436, + "causal_surprisal_total": 0.04878798798798798, + "consistency_total": 0.8695192192192192, + "curvature_flow": 0.8278376876876877, + "curvature_packet": 0.6691362612612614, + "curvature_total": 0.6295495495495496, + "direction_drift_flow": 0.03452672672672672, + "direction_drift_packet_max": 0.8675357357357357, + "direction_drift_packet_mean": 0.770211036036036, + "direction_drift_packet_median": 0.8211530030030031, + "direction_drift_packet_trimmed10_mean": 0.8129550300300301, + "direction_drift_total": 0.9609063063063062, + "flow_consistency": 0.8795788288288288, + "kappa2_speed2norm_packet_mean": 0.48899752252252254, + "kappa2_speed2norm_packet_median": 0.5092927177177178, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5057882132132132, + "kinetic_energy": 0.15335615615615616, + "kinetic_flow": 0.9672073573573574, + "kinetic_packet": 0.3014863363363363, + "packet_consistency": 0.7041127627627628, + "pna_flow": 0.605712012012012, + "pna_packet_max": 0.5766968468468467, + "pna_packet_mean": 0.48899752252252254, + "pna_packet_median": 0.5092927177177178, + "pna_packet_trimmed10_mean": 0.5057882132132132, + "terminal_flow": 0.8560506006006006, + "terminal_norm": 0.34858746246246247, + "terminal_packet": 0.3585047297297297, + "velocity_flow": 0.97006996996997, + "velocity_packet": 0.6457852852852852, + "velocity_total": 0.38327492492492493 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "arc_length": 0.3402616438356164, + "causal_surprisal_flow": 0.012378082191780824, + "causal_surprisal_packet_max": 0.9735369863013699, + "causal_surprisal_packet_mean": 0.8947383561643836, + "causal_surprisal_packet_median": 0.7921684931506849, + "causal_surprisal_packet_trimmed10_mean": 0.8528767123287672, + "causal_surprisal_total": 0.10278287671232876, + "consistency_total": 0.8650739726027398, + "curvature_flow": 0.6405534246575343, + "curvature_packet": 0.901772602739726, + "curvature_total": 0.7861910958904109, + "direction_drift_flow": 0.0014273972602739553, + "direction_drift_packet_max": 0.6489568493150685, + "direction_drift_packet_mean": 0.15835479452054793, + "direction_drift_packet_median": 0.17187808219178083, + "direction_drift_packet_trimmed10_mean": 0.1507972602739726, + "direction_drift_total": 0.3014821917808219, + "flow_consistency": 0.866813698630137, + "kappa2_speed2norm_packet_mean": 0.31279383561643836, + "kappa2_speed2norm_packet_median": 0.34082191780821924, + "kappa2_speed2norm_packet_trimmed10_mean": 0.33081643835616437, + "kinetic_energy": 0.3254178082191781, + "kinetic_flow": 0.9991041095890412, + "kinetic_packet": 0.3003753424657534, + "packet_consistency": 0.8412616438356164, + "pna_flow": 0.025658904109589036, + "pna_packet_max": 0.4606821917808219, + "pna_packet_mean": 0.31279383561643836, + "pna_packet_median": 0.34082191780821924, + "pna_packet_trimmed10_mean": 0.33081643835616437, + "terminal_flow": 0.796827397260274, + "terminal_norm": 0.21581232876712328, + "terminal_packet": 0.2221972602739726, + "velocity_flow": 0.9990753424657535, + "velocity_packet": 0.8956410958904109, + "velocity_total": 0.8421726027397259 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "arc_length": 0.6317653846153846, + "causal_surprisal_flow": 0.12284615384615384, + "causal_surprisal_packet_max": 0.6715384615384616, + "causal_surprisal_packet_mean": 0.6378538461538461, + "causal_surprisal_packet_median": 0.27288461538461534, + "causal_surprisal_packet_trimmed10_mean": 0.4386076923076923, + "causal_surprisal_total": 0.16276923076923078, + "consistency_total": 0.6079692307692308, + "curvature_flow": 0.2693076923076923, + "curvature_packet": 0.6346538461538461, + "curvature_total": 0.49343846153846155, + "direction_drift_flow": 0.4962923076923077, + "direction_drift_packet_max": 0.7328846153846154, + "direction_drift_packet_mean": 0.3527, + "direction_drift_packet_median": 0.1541923076923077, + "direction_drift_packet_trimmed10_mean": 0.23261538461538467, + "direction_drift_total": 0.41267692307692305, + "flow_consistency": 0.5526384615384616, + "kappa2_speed2norm_packet_mean": 0.1968923076923077, + "kappa2_speed2norm_packet_median": 0.11034615384615384, + "kappa2_speed2norm_packet_trimmed10_mean": 0.10636153846153845, + "kinetic_energy": 0.6212461538461539, + "kinetic_flow": 0.6911846153846154, + "kinetic_packet": 0.7178, + "packet_consistency": 0.821346153846154, + "pna_flow": 0.22612307692307693, + "pna_packet_max": 0.5441923076923078, + "pna_packet_mean": 0.1968923076923077, + "pna_packet_median": 0.11034615384615384, + "pna_packet_trimmed10_mean": 0.10636153846153845, + "terminal_flow": 0.841076923076923, + "terminal_norm": 0.9011846153846155, + "terminal_packet": 0.7580230769230769, + "velocity_flow": 0.6784846153846154, + "velocity_packet": 0.8315461538461538, + "velocity_total": 0.7650692307692308 + }, + "Web Attack - XSS": { + "_n": 18.0, + "arc_length": 0.5333611111111112, + "causal_surprisal_flow": 0.007783333333333315, + "causal_surprisal_packet_max": 0.9863777777777778, + "causal_surprisal_packet_mean": 0.8878833333333332, + "causal_surprisal_packet_median": 0.6853388888888889, + "causal_surprisal_packet_trimmed10_mean": 0.8240388888888889, + "causal_surprisal_total": 0.0920222222222222, + "consistency_total": 0.8683222222222222, + "curvature_flow": 0.4350111111111111, + "curvature_packet": 0.9319611111111111, + "curvature_total": 0.8078000000000001, + "direction_drift_flow": 0.00014444444444442855, + "direction_drift_packet_max": 0.4861444444444445, + "direction_drift_packet_mean": 0.07698333333333335, + "direction_drift_packet_median": 0.19118333333333334, + "direction_drift_packet_trimmed10_mean": 0.08711666666666666, + "direction_drift_total": 0.15216666666666667, + "flow_consistency": 0.8655055555555555, + "kappa2_speed2norm_packet_mean": 0.19483333333333333, + "kappa2_speed2norm_packet_median": 0.15494444444444444, + "kappa2_speed2norm_packet_trimmed10_mean": 0.1906, + "kinetic_energy": 0.5190444444444444, + "kinetic_flow": 1.0, + "kinetic_packet": 0.4658333333333334, + "packet_consistency": 0.8891333333333333, + "pna_flow": 0.006966666666666652, + "pna_packet_max": 0.42701666666666666, + "pna_packet_mean": 0.19483333333333333, + "pna_packet_median": 0.15494444444444444, + "pna_packet_trimmed10_mean": 0.1906, + "terminal_flow": 0.7986833333333333, + "terminal_norm": 0.2779666666666667, + "terminal_packet": 0.30162222222222224, + "velocity_flow": 0.9999888888888888, + "velocity_packet": 0.95005, + "velocity_total": 0.909788888888889 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicids2017.log b/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicids2017.log new file mode 100644 index 0000000..bafeab3 --- /dev/null +++ b/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicids2017.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=52 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 2,025,564 target rows; label distribution top: + normal 1,521,748 + Portscan 159,040 + DoS Hulk 158,454 + DDoS 95,144 + Infiltration - Portscan 71,714 +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 19.9s +[eval] scoring attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done in 13.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicids2017.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicids2017.npz + +=== overall AUROC top-10 === + packet_consistency AUROC=0.7719 AUPRC=0.5443 + kinetic_flow AUROC=0.7623 AUPRC=0.5723 + terminal_norm AUROC=0.7621 AUPRC=0.6863 + terminal_packet AUROC=0.7607 AUPRC=0.6920 + velocity_packet AUROC=0.7469 AUPRC=0.5243 + velocity_flow AUROC=0.7417 AUPRC=0.5633 + terminal_flow AUROC=0.7382 AUPRC=0.5471 + kinetic_packet AUROC=0.7329 AUPRC=0.6639 + velocity_total AUROC=0.7252 AUPRC=0.6147 + causal_surprisal_packet_mean AUROC=0.7251 AUPRC=0.6077 diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicids2017.npz b/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicids2017.npz new file mode 100644 index 0000000..cb9fd8c Binary files /dev/null and b/artifacts/route_comparison/cross/route_b_spectral_seed42_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicddos2019.json b/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicddos2019.json new file mode 100644 index 0000000..96f53dc --- /dev/null +++ b/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicddos2019.json @@ -0,0 +1,818 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.7443990554539914, + "auprc": 0.6702360480462698 + }, + "causal_surprisal_flow": { + "auroc": 0.1267866646353849, + "auprc": 0.3294534141505031 + }, + "causal_surprisal_packet_max": { + "auroc": 0.15454891834247408, + "auprc": 0.32842227856740885 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.13564981210643917, + "auprc": 0.32437938297144747 + }, + "causal_surprisal_packet_median": { + "auroc": 0.24224769449522648, + "auprc": 0.3611594614494653 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.15275712472069874, + "auprc": 0.32991959432215395 + }, + "causal_surprisal_total": { + "auroc": 0.11247482226284786, + "auprc": 0.32179614738777906 + }, + "consistency_total": { + "auroc": 0.6663130916108064, + "auprc": 0.5439562495236414 + }, + "curvature_flow": { + "auroc": 0.1672688909201706, + "auprc": 0.33370816378485774 + }, + "curvature_packet": { + "auroc": 0.8329748121064391, + "auprc": 0.8214372659139666 + }, + "curvature_total": { + "auroc": 0.6520795297582775, + "auprc": 0.5631274997762173 + }, + "direction_drift_flow": { + "auroc": 0.2938201147674182, + "auprc": 0.36775569935235464 + }, + "direction_drift_packet_max": { + "auroc": 0.43898495328052, + "auprc": 0.4240287961068487 + }, + "direction_drift_packet_mean": { + "auroc": 0.6075551950030468, + "auprc": 0.5055577015063591 + }, + "direction_drift_packet_median": { + "auroc": 0.6146904021937842, + "auprc": 0.510888931896762 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.6147898639041235, + "auprc": 0.5100370868447096 + }, + "direction_drift_total": { + "auroc": 0.45536649908592325, + "auprc": 0.42768465147132945 + }, + "flow_consistency": { + "auroc": 0.613944160065001, + "auprc": 0.5176181769728174 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.8110621013609587, + "auprc": 0.8571315240736395 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.8186048903107861, + "auprc": 0.8548591300720549 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.8152483140361568, + "auprc": 0.860337450285101 + }, + "kinetic_energy": { + "auroc": 0.7428140260004061, + "auprc": 0.6768294498953198 + }, + "kinetic_flow": { + "auroc": 0.6112520871419866, + "auprc": 0.5007004927718789 + }, + "kinetic_packet": { + "auroc": 0.7295286055250862, + "auprc": 0.7260836754849276 + }, + "packet_consistency": { + "auroc": 0.786867799106236, + "auprc": 0.7683990048758063 + }, + "pna_flow": { + "auroc": 0.16295282855982124, + "auprc": 0.3314367207196718 + }, + "pna_packet_max": { + "auroc": 0.6227553981312208, + "auprc": 0.6114164307484966 + }, + "pna_packet_mean": { + "auroc": 0.8110621013609587, + "auprc": 0.8571315240736395 + }, + "pna_packet_median": { + "auroc": 0.8186048903107861, + "auprc": 0.8548591300720549 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.8152483140361568, + "auprc": 0.860337450285101 + }, + "terminal_flow": { + "auroc": 0.638307216128377, + "auprc": 0.5469012292891559 + }, + "terminal_norm": { + "auroc": 0.7546101970343286, + "auprc": 0.7048917321194453 + }, + "terminal_packet": { + "auroc": 0.6367744972577697, + "auprc": 0.6139334871619357 + }, + "velocity_flow": { + "auroc": 0.6567382287223238, + "auprc": 0.5412806103692716 + }, + "velocity_packet": { + "auroc": 0.8193837497460896, + "auprc": 0.766401875591895 + }, + "velocity_total": { + "auroc": 0.8785906002437538, + "auprc": 0.8043187854728424 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "arc_length": 0.8563817176870747, + "causal_surprisal_flow": 0.04328707482993194, + "causal_surprisal_packet_max": 0.042411904761904755, + "causal_surprisal_packet_mean": 0.042540306122448975, + "causal_surprisal_packet_median": 0.16946292517006803, + "causal_surprisal_packet_trimmed10_mean": 0.050961224489795925, + "causal_surprisal_total": 0.07131972789115645, + "consistency_total": 0.7255130952380954, + "curvature_flow": 0.09688350340136054, + "curvature_packet": 0.8768316326530612, + "curvature_total": 0.6139721088435374, + "direction_drift_flow": 0.42926624149659864, + "direction_drift_packet_max": 0.31601700680272105, + "direction_drift_packet_mean": 0.5350999149659864, + "direction_drift_packet_median": 0.5446636904761906, + "direction_drift_packet_trimmed10_mean": 0.5512260204081633, + "direction_drift_total": 0.31371343537414964, + "flow_consistency": 0.6194632653061225, + "kappa2_speed2norm_packet_mean": 0.8137857993197278, + "kappa2_speed2norm_packet_median": 0.8263034863945578, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8269521258503401, + "kinetic_energy": 0.864754761904762, + "kinetic_flow": 0.5549047619047618, + "kinetic_packet": 0.9143578231292516, + "packet_consistency": 0.9837908163265306, + "pna_flow": 0.10175374149659865, + "pna_packet_max": 0.5022588435374149, + "pna_packet_mean": 0.8137857993197278, + "pna_packet_median": 0.8263034863945578, + "pna_packet_trimmed10_mean": 0.8269521258503401, + "terminal_flow": 0.7459188775510204, + "terminal_norm": 0.9468993197278912, + "terminal_packet": 0.779071343537415, + "velocity_flow": 0.5272154761904763, + "velocity_packet": 0.9765658163265306, + "velocity_total": 0.9650132653061226 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "arc_length": 0.860706717687075, + "causal_surprisal_flow": 0.04298486394557819, + "causal_surprisal_packet_max": 0.0427454081632653, + "causal_surprisal_packet_mean": 0.04257210884353741, + "causal_surprisal_packet_median": 0.17046632653061225, + "causal_surprisal_packet_trimmed10_mean": 0.05107670068027211, + "causal_surprisal_total": 0.06907329931972789, + "consistency_total": 0.7275215136054423, + "curvature_flow": 0.09609149659863946, + "curvature_packet": 0.8775406462585034, + "curvature_total": 0.612086819727891, + "direction_drift_flow": 0.4473652210884354, + "direction_drift_packet_max": 0.31120867346938774, + "direction_drift_packet_mean": 0.5334646258503402, + "direction_drift_packet_median": 0.5425551020408164, + "direction_drift_packet_trimmed10_mean": 0.5498238095238096, + "direction_drift_total": 0.3148868197278912, + "flow_consistency": 0.6139569727891157, + "kappa2_speed2norm_packet_mean": 0.8117681972789116, + "kappa2_speed2norm_packet_median": 0.8248665816326531, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8253829081632653, + "kinetic_energy": 0.8700291666666666, + "kinetic_flow": 0.5519168367346939, + "kinetic_packet": 0.9244393707482994, + "packet_consistency": 0.9975522108843538, + "pna_flow": 0.10048724489795918, + "pna_packet_max": 0.49663537414965986, + "pna_packet_mean": 0.8117681972789116, + "pna_packet_median": 0.8248665816326531, + "pna_packet_trimmed10_mean": 0.8253829081632653, + "terminal_flow": 0.752665306122449, + "terminal_norm": 0.9543719387755102, + "terminal_packet": 0.7872482993197278, + "velocity_flow": 0.5153778911564625, + "velocity_packet": 0.9868187074829933, + "velocity_total": 0.9657243197278911 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "arc_length": 0.8629277210884353, + "causal_surprisal_flow": 0.043622789115646224, + "causal_surprisal_packet_max": 0.04243894557823129, + "causal_surprisal_packet_mean": 0.04277534013605442, + "causal_surprisal_packet_median": 0.13756190476190477, + "causal_surprisal_packet_trimmed10_mean": 0.04903605442176871, + "causal_surprisal_total": 0.059830612244897954, + "consistency_total": 0.6975554421768707, + "curvature_flow": 0.10937976190476191, + "curvature_packet": 0.9526329931972788, + "curvature_total": 0.7374029761904761, + "direction_drift_flow": 0.26760918367346936, + "direction_drift_packet_max": 0.38058673469387755, + "direction_drift_packet_mean": 0.6077474489795919, + "direction_drift_packet_median": 0.6122639455782313, + "direction_drift_packet_trimmed10_mean": 0.6231882653061224, + "direction_drift_total": 0.39550187074829934, + "flow_consistency": 0.6657419217687074, + "kappa2_speed2norm_packet_mean": 0.9587427721088435, + "kappa2_speed2norm_packet_median": 0.9589102891156464, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9617920068027209, + "kinetic_energy": 0.8650112244897958, + "kinetic_flow": 0.619398469387755, + "kinetic_packet": 0.8514319727891156, + "packet_consistency": 0.8657380952380952, + "pna_flow": 0.11025102040816326, + "pna_packet_max": 0.7746654761904762, + "pna_packet_mean": 0.9587427721088435, + "pna_packet_median": 0.9589102891156464, + "pna_packet_trimmed10_mean": 0.9617920068027209, + "terminal_flow": 0.6620272959183672, + "terminal_norm": 0.8858522108843536, + "terminal_packet": 0.7017596088435375, + "velocity_flow": 0.6698978741496598, + "velocity_packet": 0.8826010204081632, + "velocity_total": 0.9572448979591837 + }, + "DrDoS_NTP": { + "_n": 588.0, + "arc_length": 0.3129232142857143, + "causal_surprisal_flow": 0.7491874149659864, + "causal_surprisal_packet_max": 0.600842006802721, + "causal_surprisal_packet_mean": 0.09778061224489795, + "causal_surprisal_packet_median": 0.06396428571428574, + "causal_surprisal_packet_trimmed10_mean": 0.05401683673469389, + "causal_surprisal_total": 0.1303856292517007, + "consistency_total": 0.8426957482993198, + "curvature_flow": 0.44064013605442176, + "curvature_packet": 0.8789455782312925, + "curvature_total": 0.9162255102040817, + "direction_drift_flow": 0.16191598639455781, + "direction_drift_packet_max": 0.8178227891156462, + "direction_drift_packet_mean": 0.5546227891156463, + "direction_drift_packet_median": 0.5131666666666668, + "direction_drift_packet_trimmed10_mean": 0.5177189625850339, + "direction_drift_total": 0.6912079931972788, + "flow_consistency": 0.8189852040816327, + "kappa2_speed2norm_packet_mean": 0.979372619047619, + "kappa2_speed2norm_packet_median": 0.9713738095238095, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9770557823129252, + "kinetic_energy": 0.3041199829931973, + "kinetic_flow": 0.7058369047619046, + "kinetic_packet": 0.43802627551020407, + "packet_consistency": 0.8988126700680271, + "pna_flow": 0.2989739795918368, + "pna_packet_max": 0.952436394557823, + "pna_packet_mean": 0.979372619047619, + "pna_packet_median": 0.9713738095238095, + "pna_packet_trimmed10_mean": 0.9770557823129252, + "terminal_flow": 0.9144819727891157, + "terminal_norm": 0.5332793367346939, + "terminal_packet": 0.2928090136054422, + "velocity_flow": 0.7602700680272109, + "velocity_packet": 0.8912639455782313, + "velocity_total": 0.6001960884353742 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "arc_length": 0.8224103741496598, + "causal_surprisal_flow": 0.045970408163265274, + "causal_surprisal_packet_max": 0.04234132653061225, + "causal_surprisal_packet_mean": 0.04264251700680272, + "causal_surprisal_packet_median": 0.14196445578231295, + "causal_surprisal_packet_trimmed10_mean": 0.04938843537414966, + "causal_surprisal_total": 0.08293316326530613, + "consistency_total": 0.6837552721088436, + "curvature_flow": 0.12378367346938773, + "curvature_packet": 0.8543102040816326, + "curvature_total": 0.6186171768707482, + "direction_drift_flow": 0.23896955782312926, + "direction_drift_packet_max": 0.41339863945578237, + "direction_drift_packet_mean": 0.6608527210884354, + "direction_drift_packet_median": 0.6660930272108843, + "direction_drift_packet_trimmed10_mean": 0.6740515306122449, + "direction_drift_total": 0.4533505952380953, + "flow_consistency": 0.7186139455782313, + "kappa2_speed2norm_packet_mean": 0.9298091836734694, + "kappa2_speed2norm_packet_median": 0.931259523809524, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9351793367346941, + "kinetic_energy": 0.819918962585034, + "kinetic_flow": 0.6254552721088436, + "kinetic_packet": 0.7531081632653063, + "packet_consistency": 0.5851469387755102, + "pna_flow": 0.12900374149659866, + "pna_packet_max": 0.6559190476190476, + "pna_packet_mean": 0.9298091836734694, + "pna_packet_median": 0.931259523809524, + "pna_packet_trimmed10_mean": 0.9351793367346941, + "terminal_flow": 0.588384693877551, + "terminal_norm": 0.7241758503401362, + "terminal_packet": 0.6582954081632654, + "velocity_flow": 0.7844816326530611, + "velocity_packet": 0.6655781462585033, + "velocity_total": 0.9242812074829931 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "arc_length": 0.8656196428571428, + "causal_surprisal_flow": 0.04191003401360541, + "causal_surprisal_packet_max": 0.04246173469387755, + "causal_surprisal_packet_mean": 0.0426312925170068, + "causal_surprisal_packet_median": 0.1680891156462585, + "causal_surprisal_packet_trimmed10_mean": 0.05101921768707484, + "causal_surprisal_total": 0.06791666666666667, + "consistency_total": 0.7231352040816327, + "curvature_flow": 0.10154591836734693, + "curvature_packet": 0.8729822278911565, + "curvature_total": 0.6111874149659865, + "direction_drift_flow": 0.41341513605442176, + "direction_drift_packet_max": 0.31121785714285716, + "direction_drift_packet_mean": 0.5325938775510204, + "direction_drift_packet_median": 0.5427378401360544, + "direction_drift_packet_trimmed10_mean": 0.5485951530612245, + "direction_drift_total": 0.30965799319727894, + "flow_consistency": 0.6146003401360544, + "kappa2_speed2norm_packet_mean": 0.8093470238095238, + "kappa2_speed2norm_packet_median": 0.8231483843537416, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8236471938775509, + "kinetic_energy": 0.8746494897959183, + "kinetic_flow": 0.5619699829931973, + "kinetic_packet": 0.9215151360544218, + "packet_consistency": 0.9781564625850341, + "pna_flow": 0.10487738095238094, + "pna_packet_max": 0.49309149659863943, + "pna_packet_mean": 0.8093470238095238, + "pna_packet_median": 0.8231483843537416, + "pna_packet_trimmed10_mean": 0.8236471938775509, + "terminal_flow": 0.7386658163265307, + "terminal_norm": 0.9426175170068027, + "terminal_packet": 0.7871197278911564, + "velocity_flow": 0.5296778061224491, + "velocity_packet": 0.9715714285714285, + "velocity_total": 0.9647028911564626 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "arc_length": 0.5585284013605442, + "causal_surprisal_flow": 0.15118673469387753, + "causal_surprisal_packet_max": 0.13641955782312926, + "causal_surprisal_packet_mean": 0.08221828231292518, + "causal_surprisal_packet_median": 0.14889957482993196, + "causal_surprisal_packet_trimmed10_mean": 0.10305756802721089, + "causal_surprisal_total": 0.10402091836734695, + "consistency_total": 0.5625743197278912, + "curvature_flow": 0.18498928571428572, + "curvature_packet": 0.8615866496598641, + "curvature_total": 0.7490457482993197, + "direction_drift_flow": 0.24066615646258507, + "direction_drift_packet_max": 0.49421853741496596, + "direction_drift_packet_mean": 0.6352448129251701, + "direction_drift_packet_median": 0.6489996598639455, + "direction_drift_packet_trimmed10_mean": 0.6339695578231292, + "direction_drift_total": 0.5362778911564626, + "flow_consistency": 0.46545799319727893, + "kappa2_speed2norm_packet_mean": 0.9669083333333333, + "kappa2_speed2norm_packet_median": 0.9649494897959183, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9676969387755103, + "kinetic_energy": 0.5474610544217687, + "kinetic_flow": 0.6054048469387755, + "kinetic_packet": 0.4553988095238095, + "packet_consistency": 0.7698732993197279, + "pna_flow": 0.2151998299319728, + "pna_packet_max": 0.8414768707482992, + "pna_packet_mean": 0.9669083333333333, + "pna_packet_median": 0.9649494897959183, + "pna_packet_trimmed10_mean": 0.9676969387755103, + "terminal_flow": 0.47754804421768704, + "terminal_norm": 0.4950416666666667, + "terminal_packet": 0.3779964285714285, + "velocity_flow": 0.6591731292517007, + "velocity_packet": 0.8087691326530612, + "velocity_total": 0.8200136054421768 + }, + "DrDoS_UDP": { + "_n": 588.0, + "arc_length": 0.5747753401360545, + "causal_surprisal_flow": 0.1555491496598639, + "causal_surprisal_packet_max": 0.14543333333333333, + "causal_surprisal_packet_mean": 0.08932329931972788, + "causal_surprisal_packet_median": 0.1548763605442177, + "causal_surprisal_packet_trimmed10_mean": 0.11462295918367346, + "causal_surprisal_total": 0.10873316326530613, + "consistency_total": 0.5420295068027211, + "curvature_flow": 0.18425289115646257, + "curvature_packet": 0.8626445578231293, + "curvature_total": 0.750710969387755, + "direction_drift_flow": 0.23210042517006801, + "direction_drift_packet_max": 0.4929062074829932, + "direction_drift_packet_mean": 0.6258830782312925, + "direction_drift_packet_median": 0.6423089285714285, + "direction_drift_packet_trimmed10_mean": 0.6296621598639456, + "direction_drift_total": 0.5221858843537415, + "flow_consistency": 0.43744651360544223, + "kappa2_speed2norm_packet_mean": 0.9734338435374149, + "kappa2_speed2norm_packet_median": 0.9683877551020409, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9741372448979593, + "kinetic_energy": 0.5618733843537415, + "kinetic_flow": 0.609445918367347, + "kinetic_packet": 0.4519545918367347, + "packet_consistency": 0.7558585034013606, + "pna_flow": 0.21376768707482993, + "pna_packet_max": 0.8578447278911565, + "pna_packet_mean": 0.9734338435374149, + "pna_packet_median": 0.9683877551020409, + "pna_packet_trimmed10_mean": 0.9741372448979593, + "terminal_flow": 0.432387074829932, + "terminal_norm": 0.47867857142857145, + "terminal_packet": 0.37229226190476195, + "velocity_flow": 0.6718371598639455, + "velocity_packet": 0.8069445578231292, + "velocity_total": 0.8253233843537414 + }, + "LDAP": { + "_n": 588.0, + "arc_length": 0.8665738945578231, + "causal_surprisal_flow": 0.042751190476190436, + "causal_surprisal_packet_max": 0.043179251700680266, + "causal_surprisal_packet_mean": 0.043862925170068026, + "causal_surprisal_packet_median": 0.1734721088435374, + "causal_surprisal_packet_trimmed10_mean": 0.052847959183673465, + "causal_surprisal_total": 0.06600391156462586, + "consistency_total": 0.7284726190476191, + "curvature_flow": 0.09366428571428571, + "curvature_packet": 0.8706535714285715, + "curvature_total": 0.6015419217687075, + "direction_drift_flow": 0.4681545918367347, + "direction_drift_packet_max": 0.3090453231292517, + "direction_drift_packet_mean": 0.5292936224489796, + "direction_drift_packet_median": 0.5391835034013606, + "direction_drift_packet_trimmed10_mean": 0.5457348639455782, + "direction_drift_total": 0.30932185374149657, + "flow_consistency": 0.6161937925170068, + "kappa2_speed2norm_packet_mean": 0.803095068027211, + "kappa2_speed2norm_packet_median": 0.8170676870748298, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8177530612244899, + "kinetic_energy": 0.8762147959183674, + "kinetic_flow": 0.5533647959183673, + "kinetic_packet": 0.930003231292517, + "packet_consistency": 0.9972263605442176, + "pna_flow": 0.09749965986394557, + "pna_packet_max": 0.476683843537415, + "pna_packet_mean": 0.803095068027211, + "pna_packet_median": 0.8170676870748298, + "pna_packet_trimmed10_mean": 0.8177530612244899, + "terminal_flow": 0.7542697278911564, + "terminal_norm": 0.9545751700680272, + "terminal_packet": 0.796003231292517, + "velocity_flow": 0.515356462585034, + "velocity_packet": 0.9865940476190476, + "velocity_total": 0.9654332482993198 + }, + "MSSQL": { + "_n": 588.0, + "arc_length": 0.856191156462585, + "causal_surprisal_flow": 0.044339965986394524, + "causal_surprisal_packet_max": 0.042720578231292515, + "causal_surprisal_packet_mean": 0.042638775510204084, + "causal_surprisal_packet_median": 0.1357015306122449, + "causal_surprisal_packet_trimmed10_mean": 0.048476700680272114, + "causal_surprisal_total": 0.06313384353741497, + "consistency_total": 0.6978445578231294, + "curvature_flow": 0.1092998299319728, + "curvature_packet": 0.9545142857142856, + "curvature_total": 0.7380831632653061, + "direction_drift_flow": 0.2648096088435374, + "direction_drift_packet_max": 0.3872869047619048, + "direction_drift_packet_mean": 0.6161069727891157, + "direction_drift_packet_median": 0.6200461734693876, + "direction_drift_packet_trimmed10_mean": 0.6312668367346939, + "direction_drift_total": 0.40533767006802723, + "flow_consistency": 0.6680490646258503, + "kappa2_speed2norm_packet_mean": 0.9639608843537415, + "kappa2_speed2norm_packet_median": 0.9640061224489797, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9671404761904763, + "kinetic_energy": 0.8579252551020409, + "kinetic_flow": 0.6170889455782312, + "kinetic_packet": 0.8408071428571428, + "packet_consistency": 0.8594477891156462, + "pna_flow": 0.11154472789115646, + "pna_packet_max": 0.7767147959183673, + "pna_packet_mean": 0.9639608843537415, + "pna_packet_median": 0.9640061224489797, + "pna_packet_trimmed10_mean": 0.9671404761904763, + "terminal_flow": 0.658157142857143, + "terminal_norm": 0.8807018707482994, + "terminal_packet": 0.6954916666666667, + "velocity_flow": 0.6760425170068028, + "velocity_packet": 0.8790210884353741, + "velocity_total": 0.9567380952380953 + }, + "NetBIOS": { + "_n": 588.0, + "arc_length": 0.8142426020408163, + "causal_surprisal_flow": 0.049510204081632626, + "causal_surprisal_packet_max": 0.04244965986394558, + "causal_surprisal_packet_mean": 0.04284319727891157, + "causal_surprisal_packet_median": 0.14773979591836736, + "causal_surprisal_packet_trimmed10_mean": 0.05017448979591837, + "causal_surprisal_total": 0.09295680272108843, + "consistency_total": 0.6868590136054422, + "curvature_flow": 0.12681530612244898, + "curvature_packet": 0.8570448979591837, + "curvature_total": 0.6218578231292516, + "direction_drift_flow": 0.2358471088435374, + "direction_drift_packet_max": 0.4092534013605442, + "direction_drift_packet_mean": 0.6603953231292516, + "direction_drift_packet_median": 0.6658545918367347, + "direction_drift_packet_trimmed10_mean": 0.673500850340136, + "direction_drift_total": 0.45148375850340133, + "flow_consistency": 0.7221369047619048, + "kappa2_speed2norm_packet_mean": 0.9262948979591836, + "kappa2_speed2norm_packet_median": 0.9278332482993196, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9313496598639455, + "kinetic_energy": 0.8115215136054421, + "kinetic_flow": 0.6192216836734694, + "kinetic_packet": 0.7453831632653061, + "packet_consistency": 0.5851872448979591, + "pna_flow": 0.13354387755102043, + "pna_packet_max": 0.6575938775510205, + "pna_packet_mean": 0.9262948979591836, + "pna_packet_median": 0.9278332482993196, + "pna_packet_trimmed10_mean": 0.9313496598639455, + "terminal_flow": 0.5906260204081631, + "terminal_norm": 0.7208352040816326, + "terminal_packet": 0.650677380952381, + "velocity_flow": 0.775409693877551, + "velocity_packet": 0.6673653911564627, + "velocity_total": 0.9200484693877551 + }, + "Portmap": { + "_n": 588.0, + "arc_length": 0.8181411564625849, + "causal_surprisal_flow": 0.04930850340136051, + "causal_surprisal_packet_max": 0.043619897959183675, + "causal_surprisal_packet_mean": 0.04527585034013606, + "causal_surprisal_packet_median": 0.15077448979591837, + "causal_surprisal_packet_trimmed10_mean": 0.05328010204081633, + "causal_surprisal_total": 0.0868390306122449, + "consistency_total": 0.6867222789115646, + "curvature_flow": 0.11983010204081633, + "curvature_packet": 0.8462748299319728, + "curvature_total": 0.6049485544217688, + "direction_drift_flow": 0.2407313775510204, + "direction_drift_packet_max": 0.40692848639455786, + "direction_drift_packet_mean": 0.6581909863945579, + "direction_drift_packet_median": 0.6636239795918367, + "direction_drift_packet_trimmed10_mean": 0.6713345238095237, + "direction_drift_total": 0.4500715136054422, + "flow_consistency": 0.7223510204081632, + "kappa2_speed2norm_packet_mean": 0.9135409863945578, + "kappa2_speed2norm_packet_median": 0.9159350340136054, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9194782312925169, + "kinetic_energy": 0.8156347789115647, + "kinetic_flow": 0.6201692176870749, + "kinetic_packet": 0.7508893707482993, + "packet_consistency": 0.5826296768707482, + "pna_flow": 0.12436904761904764, + "pna_packet_max": 0.6343578231292517, + "pna_packet_mean": 0.9135409863945578, + "pna_packet_median": 0.9159350340136054, + "pna_packet_trimmed10_mean": 0.9194782312925169, + "terminal_flow": 0.5973944727891156, + "terminal_norm": 0.7345363095238094, + "terminal_packet": 0.6576122448979591, + "velocity_flow": 0.7740484693877552, + "velocity_packet": 0.664847193877551, + "velocity_total": 0.9176037414965986 + }, + "Syn": { + "_n": 588.0, + "arc_length": 0.8502279761904763, + "causal_surprisal_flow": 0.1570799319727891, + "causal_surprisal_packet_max": 0.4227121598639455, + "causal_surprisal_packet_mean": 0.5876695578231294, + "causal_surprisal_packet_median": 0.8160814625850341, + "causal_surprisal_packet_trimmed10_mean": 0.673790306122449, + "causal_surprisal_total": 0.27667261904761903, + "consistency_total": 0.6828738095238094, + "curvature_flow": 0.1011746598639456, + "curvature_packet": 0.5794347789115646, + "curvature_total": 0.3821840136054422, + "direction_drift_flow": 0.35277933673469386, + "direction_drift_packet_max": 0.49653290816326534, + "direction_drift_packet_mean": 0.6857817176870749, + "direction_drift_packet_median": 0.7142874149659865, + "direction_drift_packet_trimmed10_mean": 0.6918928571428571, + "direction_drift_total": 0.5467164965986394, + "flow_consistency": 0.6974875850340135, + "kappa2_speed2norm_packet_mean": 0.17406658163265304, + "kappa2_speed2norm_packet_median": 0.21132874149659864, + "kappa2_speed2norm_packet_trimmed10_mean": 0.17249447278911564, + "kinetic_energy": 0.8491655612244899, + "kinetic_flow": 0.5627856292517006, + "kinetic_packet": 0.9483518707482993, + "packet_consistency": 0.6617534013605442, + "pna_flow": 0.11237380952380951, + "pna_packet_max": 0.14603707482993197, + "pna_packet_mean": 0.17406658163265304, + "pna_packet_median": 0.21132874149659864, + "pna_packet_trimmed10_mean": 0.17249447278911564, + "terminal_flow": 0.70233231292517, + "terminal_norm": 0.9459059523809523, + "terminal_packet": 0.9853600340136054, + "velocity_flow": 0.5566096938775511, + "velocity_packet": 0.7205127551020408, + "velocity_total": 0.8252918367346938 + }, + "TFTP": { + "_n": 588.0, + "arc_length": 0.7153808673469387, + "causal_surprisal_flow": 0.05901479591836732, + "causal_surprisal_packet_max": 0.0670938775510204, + "causal_surprisal_packet_mean": 0.052209183673469384, + "causal_surprisal_packet_median": 0.1270232142857143, + "causal_surprisal_packet_trimmed10_mean": 0.06284710884353742, + "causal_surprisal_total": 0.07132925170068027, + "consistency_total": 0.5726437074829932, + "curvature_flow": 0.33548554421768706, + "curvature_packet": 0.9585970238095238, + "curvature_total": 0.8450426870748298, + "direction_drift_flow": 0.20487227891156462, + "direction_drift_packet_max": 0.4080420918367347, + "direction_drift_packet_mean": 0.5713302721088435, + "direction_drift_packet_median": 0.5639469387755102, + "direction_drift_packet_trimmed10_mean": 0.5805706632653063, + "direction_drift_total": 0.46130926870748296, + "flow_consistency": 0.40071326530612245, + "kappa2_speed2norm_packet_mean": 0.9484739795918368, + "kappa2_speed2norm_packet_median": 0.9373930272108845, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9498040816326528, + "kinetic_energy": 0.712812074829932, + "kinetic_flow": 0.7237680272108843, + "kinetic_packet": 0.6082488095238096, + "packet_consistency": 0.8656425170068027, + "pna_flow": 0.27723350340136055, + "pna_packet_max": 0.801543962585034, + "pna_packet_mean": 0.9484739795918368, + "pna_packet_median": 0.9373930272108845, + "pna_packet_trimmed10_mean": 0.9498040816326528, + "terminal_flow": 0.649861224489796, + "terminal_norm": 0.683580612244898, + "terminal_packet": 0.4454931972789115, + "velocity_flow": 0.7525744897959183, + "velocity_packet": 0.9092762755102041, + "velocity_total": 0.9086670068027211 + }, + "UDP": { + "_n": 588.0, + "arc_length": 0.5368720238095238, + "causal_surprisal_flow": 0.16073877551020407, + "causal_surprisal_packet_max": 0.1554406462585034, + "causal_surprisal_packet_mean": 0.09704489795918367, + "causal_surprisal_packet_median": 0.16405272108843538, + "causal_surprisal_packet_trimmed10_mean": 0.12378741496598639, + "causal_surprisal_total": 0.11379727891156462, + "consistency_total": 0.5389933673469388, + "curvature_flow": 0.18936190476190473, + "curvature_packet": 0.8505537414965987, + "curvature_total": 0.7418923469387754, + "direction_drift_flow": 0.23011079931972792, + "direction_drift_packet_max": 0.4761454081632652, + "direction_drift_packet_mean": 0.6157196428571429, + "direction_drift_packet_median": 0.6336718537414966, + "direction_drift_packet_trimmed10_mean": 0.6178853741496599, + "direction_drift_total": 0.5169930272108844, + "flow_consistency": 0.4313959183673469, + "kappa2_speed2norm_packet_mean": 0.9659017006802721, + "kappa2_speed2norm_packet_median": 0.9626071428571429, + "kappa2_speed2norm_packet_trimmed10_mean": 0.967213775510204, + "kinetic_energy": 0.5231936224489795, + "kinetic_flow": 0.6068630952380952, + "kinetic_packet": 0.41497125850340133, + "packet_consistency": 0.7560659863945578, + "pna_flow": 0.2219996598639456, + "pna_packet_max": 0.8387904761904762, + "pna_packet_mean": 0.9659017006802721, + "pna_packet_median": 0.9626071428571429, + "pna_packet_trimmed10_mean": 0.967213775510204, + "terminal_flow": 0.43219404761904767, + "terminal_norm": 0.44961734693877553, + "terminal_packet": 0.34594710884353747, + "velocity_flow": 0.6642044217687074, + "velocity_packet": 0.8082119047619047, + "velocity_total": 0.8174858843537416 + }, + "UDPLag": { + "_n": 588.0, + "arc_length": 0.8233019557823129, + "causal_surprisal_flow": 0.13405544217687076, + "causal_surprisal_packet_max": 0.43156037414965986, + "causal_surprisal_packet_mean": 0.5686054421768708, + "causal_surprisal_packet_median": 0.7588477891156462, + "causal_surprisal_packet_trimmed10_mean": 0.647896768707483, + "causal_surprisal_total": 0.25311173469387754, + "consistency_total": 0.6739324829931973, + "curvature_flow": 0.11746785714285714, + "curvature_packet": 0.6271015306122449, + "curvature_total": 0.4332709183673469, + "direction_drift_flow": 0.3086932823129252, + "direction_drift_packet_max": 0.5200805272108844, + "direction_drift_packet_mean": 0.7106748299319727, + "direction_drift_packet_median": 0.7263302721088435, + "direction_drift_packet_trimmed10_mean": 0.7160195578231292, + "direction_drift_total": 0.5751224489795919, + "flow_consistency": 0.6734683673469388, + "kappa2_speed2norm_packet_mean": 0.28804455782312927, + "kappa2_speed2norm_packet_median": 0.32192355442176873, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2863817176870748, + "kinetic_energy": 0.8212277210884353, + "kinetic_flow": 0.5669687074829932, + "kinetic_packet": 0.892096343537415, + "packet_consistency": 0.6819726190476191, + "pna_flow": 0.13642142857142858, + "pna_packet_max": 0.22511088435374152, + "pna_packet_mean": 0.28804455782312927, + "pna_packet_median": 0.32192355442176873, + "pna_packet_trimmed10_mean": 0.2863817176870748, + "terminal_flow": 0.6762719387755102, + "terminal_norm": 0.8979187074829931, + "terminal_packet": 0.9184210034013606, + "velocity_flow": 0.5762137755102041, + "velocity_packet": 0.7347765306122448, + "velocity_total": 0.8331076530612246 + }, + "WebDDoS": { + "_n": 438.0, + "arc_length": 0.6305312785388129, + "causal_surprisal_flow": 0.20476963470319637, + "causal_surprisal_packet_max": 0.3276089041095891, + "causal_surprisal_packet_mean": 0.4145650684931507, + "causal_surprisal_packet_median": 0.5738166666666666, + "causal_surprisal_packet_trimmed10_mean": 0.4317673515981735, + "causal_surprisal_total": 0.22193881278538816, + "consistency_total": 0.5158059360730594, + "curvature_flow": 0.3627803652968037, + "curvature_packet": 0.4919184931506849, + "curvature_total": 0.45769360730593606, + "direction_drift_flow": 0.24524372146118723, + "direction_drift_packet_max": 0.5370759132420091, + "direction_drift_packet_mean": 0.5912851598173516, + "direction_drift_packet_median": 0.6083980593607305, + "direction_drift_packet_trimmed10_mean": 0.588204794520548, + "direction_drift_total": 0.4992993150684931, + "flow_consistency": 0.5294285388127854, + "kappa2_speed2norm_packet_mean": 0.47604600456620993, + "kappa2_speed2norm_packet_median": 0.5103537671232876, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4668972602739726, + "kinetic_energy": 0.6213357305936074, + "kinetic_flow": 0.7125683789954338, + "kinetic_packet": 0.5032886986301369, + "packet_consistency": 0.4714288812785388, + "pna_flow": 0.3212898401826484, + "pna_packet_max": 0.3984634703196347, + "pna_packet_mean": 0.47604600456620993, + "pna_packet_median": 0.5103537671232876, + "pna_packet_trimmed10_mean": 0.4668972602739726, + "terminal_flow": 0.42314954337899546, + "terminal_norm": 0.546763698630137, + "terminal_packet": 0.5519226027397259, + "velocity_flow": 0.7902076484018266, + "velocity_packet": 0.48299143835616437, + "velocity_total": 0.7316899543378994 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicddos2019.log b/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicddos2019.log new file mode 100644 index 0000000..69e51e8 --- /dev/null +++ b/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicddos2019.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=52 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 8,993,376 target rows; label distribution top: + Syn 1,495,248 + NetBIOS 702,760 + UDP 611,999 + MSSQL 523,845 + LDAP 509,665 +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 19.7s +[eval] scoring attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done in 18.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicddos2019.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicddos2019.npz + +=== overall AUROC top-10 === + velocity_total AUROC=0.8786 AUPRC=0.8043 + curvature_packet AUROC=0.8330 AUPRC=0.8214 + velocity_packet AUROC=0.8194 AUPRC=0.7664 + kappa2_speed2norm_packet_median AUROC=0.8186 AUPRC=0.8549 + pna_packet_median AUROC=0.8186 AUPRC=0.8549 + kappa2_speed2norm_packet_trimmed10_mean AUROC=0.8152 AUPRC=0.8603 + pna_packet_trimmed10_mean AUROC=0.8152 AUPRC=0.8603 + kappa2_speed2norm_packet_mean AUROC=0.8111 AUPRC=0.8571 + pna_packet_mean AUROC=0.8111 AUPRC=0.8571 + packet_consistency AUROC=0.7869 AUPRC=0.7684 diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicddos2019.npz new file mode 100644 index 0000000..d14ebc9 Binary files /dev/null and b/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicids2017.json b/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicids2017.json new file mode 100644 index 0000000..64ef0bb --- /dev/null +++ b/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicids2017.json @@ -0,0 +1,740 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.6731213821618429, + "auprc": 0.6601812751789737 + }, + "causal_surprisal_flow": { + "auroc": 0.3429603219137626, + "auprc": 0.375586081715795 + }, + "causal_surprisal_packet_max": { + "auroc": 0.6964786178381571, + "auprc": 0.49616640250555377 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.7304736119314825, + "auprc": 0.5287590113219349 + }, + "causal_surprisal_packet_median": { + "auroc": 0.6027443074424099, + "auprc": 0.5629960234860334 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.5537537950383933, + "auprc": 0.46750434908946115 + }, + "causal_surprisal_total": { + "auroc": 0.3415919890726521, + "auprc": 0.33747163604951946 + }, + "consistency_total": { + "auroc": 0.7338486931482576, + "auprc": 0.5502282812199316 + }, + "curvature_flow": { + "auroc": 0.285123087714117, + "auprc": 0.3069225487465348 + }, + "curvature_packet": { + "auroc": 0.7231231098641464, + "auprc": 0.5419442859356953 + }, + "curvature_total": { + "auroc": 0.5922927126402835, + "auprc": 0.4308022834353352 + }, + "direction_drift_flow": { + "auroc": 0.32685869019492025, + "auprc": 0.30022814137773945 + }, + "direction_drift_packet_max": { + "auroc": 0.6226771264028352, + "auprc": 0.4861219164595384 + }, + "direction_drift_packet_mean": { + "auroc": 0.6724585646780862, + "auprc": 0.5829400371863157 + }, + "direction_drift_packet_median": { + "auroc": 0.6941950457767277, + "auprc": 0.5879088162559429 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.6628927347903131, + "auprc": 0.5804076929330316 + }, + "direction_drift_total": { + "auroc": 0.6586551240401655, + "auprc": 0.6037848316080936 + }, + "flow_consistency": { + "auroc": 0.7219745274660366, + "auprc": 0.5486277022911475 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.4295475265800355, + "auprc": 0.36508377918415286 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.45060235528647374, + "auprc": 0.37884846953803913 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.39657317631423505, + "auprc": 0.3432465091878655 + }, + "kinetic_energy": { + "auroc": 0.6691219359125811, + "auprc": 0.6589901730912271 + }, + "kinetic_flow": { + "auroc": 0.7013848198464264, + "auprc": 0.5359287974429626 + }, + "kinetic_packet": { + "auroc": 0.7330576565268754, + "auprc": 0.6965849297642898 + }, + "packet_consistency": { + "auroc": 0.7238028795038394, + "auprc": 0.5007545179744498 + }, + "pna_flow": { + "auroc": 0.2395849084465446, + "auprc": 0.2767413602869443 + }, + "pna_packet_max": { + "auroc": 0.49882364146485525, + "auprc": 0.3857121077591738 + }, + "pna_packet_mean": { + "auroc": 0.4295475265800355, + "auprc": 0.36508377918415286 + }, + "pna_packet_median": { + "auroc": 0.45060235528647374, + "auprc": 0.37884846953803913 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.39657317631423505, + "auprc": 0.3432465091878655 + }, + "terminal_flow": { + "auroc": 0.7428825383933845, + "auprc": 0.5540126149769743 + }, + "terminal_norm": { + "auroc": 0.7762918709391613, + "auprc": 0.7410499341806679 + }, + "terminal_packet": { + "auroc": 0.7527451417601891, + "auprc": 0.7331018075192343 + }, + "velocity_flow": { + "auroc": 0.7122562389249851, + "auprc": 0.5434404812689125 + }, + "velocity_packet": { + "auroc": 0.7269751993502658, + "auprc": 0.5064591520572581 + }, + "velocity_total": { + "auroc": 0.6718174394565859, + "auprc": 0.5703099615774657 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "arc_length": 0.8701861111111112, + "causal_surprisal_flow": 0.9764933933933935, + "causal_surprisal_packet_max": 0.7247933933933933, + "causal_surprisal_packet_mean": 0.7374295795795798, + "causal_surprisal_packet_median": 0.36966936936936934, + "causal_surprisal_packet_trimmed10_mean": 0.37919129129129125, + "causal_surprisal_total": 0.9146614114114114, + "consistency_total": 0.8747815315315316, + "curvature_flow": 0.07665645645645645, + "curvature_packet": 0.923237987987988, + "curvature_total": 0.8352540540540541, + "direction_drift_flow": 0.6050529279279279, + "direction_drift_packet_max": 0.9070217717717718, + "direction_drift_packet_mean": 0.9684858108108109, + "direction_drift_packet_median": 0.9482058558558559, + "direction_drift_packet_trimmed10_mean": 0.9538552552552553, + "direction_drift_total": 0.9676001501501501, + "flow_consistency": 0.8887542042042044, + "kappa2_speed2norm_packet_mean": 0.9459651651651652, + "kappa2_speed2norm_packet_median": 0.9495189939939939, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9291042792792793, + "kinetic_energy": 0.8783361861861861, + "kinetic_flow": 0.42368596096096095, + "kinetic_packet": 0.9426364864864865, + "packet_consistency": 0.6521531531531531, + "pna_flow": 0.11150968468468468, + "pna_packet_max": 0.8216695195195195, + "pna_packet_mean": 0.9459651651651652, + "pna_packet_median": 0.9495189939939939, + "pna_packet_trimmed10_mean": 0.9291042792792793, + "terminal_flow": 0.7361987987987988, + "terminal_norm": 0.8626265015015017, + "terminal_packet": 0.9362533033033033, + "velocity_flow": 0.4312243243243243, + "velocity_packet": 0.6798551051051052, + "velocity_total": 0.427172972972973 + }, + "DDoS": { + "_n": 666.0, + "arc_length": 0.9408909909909909, + "causal_surprisal_flow": 0.06307102102102102, + "causal_surprisal_packet_max": 0.715790840840841, + "causal_surprisal_packet_mean": 0.7352333333333334, + "causal_surprisal_packet_median": 0.6439484234234234, + "causal_surprisal_packet_trimmed10_mean": 0.4208279279279279, + "causal_surprisal_total": 0.10830570570570572, + "consistency_total": 0.7032254504504504, + "curvature_flow": 0.11360285285285285, + "curvature_packet": 0.9083481981981981, + "curvature_total": 0.8492235735735737, + "direction_drift_flow": 0.33218783783783784, + "direction_drift_packet_max": 0.7327064564564565, + "direction_drift_packet_mean": 0.8038079579579579, + "direction_drift_packet_median": 0.8087277027027028, + "direction_drift_packet_trimmed10_mean": 0.7672307807807808, + "direction_drift_total": 0.8445448948948949, + "flow_consistency": 0.6558942942942944, + "kappa2_speed2norm_packet_mean": 0.7175057807807808, + "kappa2_speed2norm_packet_median": 0.6913590090090089, + "kappa2_speed2norm_packet_trimmed10_mean": 0.640348873873874, + "kinetic_energy": 0.9421993243243243, + "kinetic_flow": 0.5741348348348349, + "kinetic_packet": 0.9775342342342341, + "packet_consistency": 0.8176552552552554, + "pna_flow": 0.1544066066066066, + "pna_packet_max": 0.7939813063063063, + "pna_packet_mean": 0.7175057807807808, + "pna_packet_median": 0.6913590090090089, + "pna_packet_trimmed10_mean": 0.640348873873874, + "terminal_flow": 0.8160334084084083, + "terminal_norm": 0.9830782282282282, + "terminal_packet": 0.985673873873874, + "velocity_flow": 0.6155608108108108, + "velocity_packet": 0.8198975975975976, + "velocity_total": 0.6581042042042041 + }, + "DoS GoldenEye": { + "_n": 666.0, + "arc_length": 0.5244370870870871, + "causal_surprisal_flow": 0.0761063063063063, + "causal_surprisal_packet_max": 0.7341130630630631, + "causal_surprisal_packet_mean": 0.7764207207207208, + "causal_surprisal_packet_median": 0.7494756006006005, + "causal_surprisal_packet_trimmed10_mean": 0.5480776276276276, + "causal_surprisal_total": 0.11898168168168168, + "consistency_total": 0.7179995495495496, + "curvature_flow": 0.03592942942942943, + "curvature_packet": 0.6962557807807808, + "curvature_total": 0.5514281531531532, + "direction_drift_flow": 0.27061373873873873, + "direction_drift_packet_max": 0.6781475975975976, + "direction_drift_packet_mean": 0.7736782282282282, + "direction_drift_packet_median": 0.7965342342342342, + "direction_drift_packet_trimmed10_mean": 0.7542822072072073, + "direction_drift_total": 0.8362083333333332, + "flow_consistency": 0.6643394894894895, + "kappa2_speed2norm_packet_mean": 0.3919060810810811, + "kappa2_speed2norm_packet_median": 0.44256493993993995, + "kappa2_speed2norm_packet_trimmed10_mean": 0.33270735735735735, + "kinetic_energy": 0.5128329579579579, + "kinetic_flow": 0.7409022522522524, + "kinetic_packet": 0.6065532282282283, + "packet_consistency": 0.7833867867867867, + "pna_flow": 0.043601051051051054, + "pna_packet_max": 0.561032057057057, + "pna_packet_mean": 0.3919060810810811, + "pna_packet_median": 0.44256493993993995, + "pna_packet_trimmed10_mean": 0.33270735735735735, + "terminal_flow": 0.853942042042042, + "terminal_norm": 0.8268972972972971, + "terminal_packet": 0.7283554054054053, + "velocity_flow": 0.7444822822822823, + "velocity_packet": 0.7554864114114114, + "velocity_total": 0.5637332582582583 + }, + "DoS Hulk": { + "_n": 666.0, + "arc_length": 0.5777724474474475, + "causal_surprisal_flow": 0.11326771771771772, + "causal_surprisal_packet_max": 0.6796569069069068, + "causal_surprisal_packet_mean": 0.714230780780781, + "causal_surprisal_packet_median": 0.7032451951951952, + "causal_surprisal_packet_trimmed10_mean": 0.6306633633633634, + "causal_surprisal_total": 0.10810555555555557, + "consistency_total": 0.773569144144144, + "curvature_flow": 0.050377627627627625, + "curvature_packet": 0.7577794294294294, + "curvature_total": 0.6207105855855857, + "direction_drift_flow": 0.3398468468468469, + "direction_drift_packet_max": 0.6533668168168167, + "direction_drift_packet_mean": 0.5657683933933935, + "direction_drift_packet_median": 0.5982395645645646, + "direction_drift_packet_trimmed10_mean": 0.5116524774774774, + "direction_drift_total": 0.6739546546546545, + "flow_consistency": 0.7430493993993995, + "kappa2_speed2norm_packet_mean": 0.4144963963963964, + "kappa2_speed2norm_packet_median": 0.3852496996996997, + "kappa2_speed2norm_packet_trimmed10_mean": 0.31914684684684685, + "kinetic_energy": 0.5725324324324326, + "kinetic_flow": 0.4578674924924925, + "kinetic_packet": 0.7511581081081081, + "packet_consistency": 0.8387863363363364, + "pna_flow": 0.11746171171171171, + "pna_packet_max": 0.6182361861861863, + "pna_packet_mean": 0.4144963963963964, + "pna_packet_median": 0.3852496996996997, + "pna_packet_trimmed10_mean": 0.31914684684684685, + "terminal_flow": 0.7873280780780781, + "terminal_norm": 0.7340606606606607, + "terminal_packet": 0.728486936936937, + "velocity_flow": 0.5275040540540541, + "velocity_packet": 0.8523747747747747, + "velocity_total": 0.6664447447447449 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "arc_length": 0.8509204204204204, + "causal_surprisal_flow": 0.342021021021021, + "causal_surprisal_packet_max": 0.7688591591591593, + "causal_surprisal_packet_mean": 0.8230484984984984, + "causal_surprisal_packet_median": 0.7072192192192193, + "causal_surprisal_packet_trimmed10_mean": 0.6142854354354355, + "causal_surprisal_total": 0.3835483483483484, + "consistency_total": 0.8445178678678679, + "curvature_flow": 0.12478528528528529, + "curvature_packet": 0.8406867867867868, + "curvature_total": 0.7390824324324323, + "direction_drift_flow": 0.1758509009009009, + "direction_drift_packet_max": 0.5833882132132133, + "direction_drift_packet_mean": 0.6348789039039038, + "direction_drift_packet_median": 0.6818064564564563, + "direction_drift_packet_trimmed10_mean": 0.6172040540540542, + "direction_drift_total": 0.6882270270270271, + "flow_consistency": 0.8504548048048048, + "kappa2_speed2norm_packet_mean": 0.46272912912912917, + "kappa2_speed2norm_packet_median": 0.4859697447447447, + "kappa2_speed2norm_packet_trimmed10_mean": 0.40333948948948944, + "kinetic_energy": 0.8449990240240239, + "kinetic_flow": 0.7986202702702703, + "kinetic_packet": 0.8660843843843844, + "packet_consistency": 0.7887265015015014, + "pna_flow": 0.08958258258258259, + "pna_packet_max": 0.5106397897897899, + "pna_packet_mean": 0.46272912912912917, + "pna_packet_median": 0.4859697447447447, + "pna_packet_trimmed10_mean": 0.40333948948948944, + "terminal_flow": 0.8558617117117117, + "terminal_norm": 0.9567803303303303, + "terminal_packet": 0.8810110360360361, + "velocity_flow": 0.8063237987987988, + "velocity_packet": 0.7517918918918919, + "velocity_total": 0.8056148648648649 + }, + "DoS Slowloris": { + "_n": 666.0, + "arc_length": 0.8261616366366366, + "causal_surprisal_flow": 0.2314629129129129, + "causal_surprisal_packet_max": 0.7233585585585587, + "causal_surprisal_packet_mean": 0.8058064564564565, + "causal_surprisal_packet_median": 0.8866729729729729, + "causal_surprisal_packet_trimmed10_mean": 0.8165728228228228, + "causal_surprisal_total": 0.5270803303303303, + "consistency_total": 0.7330162162162162, + "curvature_flow": 0.22418753753753753, + "curvature_packet": 0.7951921921921922, + "curvature_total": 0.7288718468468468, + "direction_drift_flow": 0.2139316816816817, + "direction_drift_packet_max": 0.4244038288288289, + "direction_drift_packet_mean": 0.35528506006006005, + "direction_drift_packet_median": 0.38559009009009004, + "direction_drift_packet_trimmed10_mean": 0.33205075075075074, + "direction_drift_total": 0.34163295795795795, + "flow_consistency": 0.7469001501501501, + "kappa2_speed2norm_packet_mean": 0.2629473723723723, + "kappa2_speed2norm_packet_median": 0.3122954954954955, + "kappa2_speed2norm_packet_trimmed10_mean": 0.24248558558558558, + "kinetic_energy": 0.8165718468468469, + "kinetic_flow": 0.8280337837837838, + "kinetic_packet": 0.8152722222222223, + "packet_consistency": 0.6353723723723723, + "pna_flow": 0.18307822822822825, + "pna_packet_max": 0.3011074324324325, + "pna_packet_mean": 0.2629473723723723, + "pna_packet_median": 0.3122954954954955, + "pna_packet_trimmed10_mean": 0.24248558558558558, + "terminal_flow": 0.8020971471471471, + "terminal_norm": 0.8734202702702702, + "terminal_packet": 0.7950731231231231, + "velocity_flow": 0.8135493993993994, + "velocity_packet": 0.7093615615615615, + "velocity_total": 0.8307711711711713 + }, + "FTP-Patator": { + "_n": 666.0, + "arc_length": 0.17411163663663665, + "causal_surprisal_flow": 0.7689223723723724, + "causal_surprisal_packet_max": 0.8510223723723723, + "causal_surprisal_packet_mean": 0.7607412912912912, + "causal_surprisal_packet_median": 0.1592948948948949, + "causal_surprisal_packet_trimmed10_mean": 0.2962047297297298, + "causal_surprisal_total": 0.23438303303303304, + "consistency_total": 0.9348554054054055, + "curvature_flow": 0.7677648648648648, + "curvature_packet": 0.5207111861861862, + "curvature_total": 0.4648068318318318, + "direction_drift_flow": 0.2770728228228228, + "direction_drift_packet_max": 0.887465765765766, + "direction_drift_packet_mean": 0.9673561561561562, + "direction_drift_packet_median": 0.9561421921921922, + "direction_drift_packet_trimmed10_mean": 0.9740705705705706, + "direction_drift_total": 0.9827986486486486, + "flow_consistency": 0.937067117117117, + "kappa2_speed2norm_packet_mean": 0.4245881381381382, + "kappa2_speed2norm_packet_median": 0.4415996246246246, + "kappa2_speed2norm_packet_trimmed10_mean": 0.39085765765765756, + "kinetic_energy": 0.16356726726726728, + "kinetic_flow": 0.8205450450450451, + "kinetic_packet": 0.3156546546546547, + "packet_consistency": 0.7082915915915915, + "pna_flow": 0.6129190690690691, + "pna_packet_max": 0.5957834834834835, + "pna_packet_mean": 0.4245881381381382, + "pna_packet_median": 0.4415996246246246, + "pna_packet_trimmed10_mean": 0.39085765765765756, + "terminal_flow": 0.8316846846846846, + "terminal_norm": 0.4485364114114115, + "terminal_packet": 0.37985285285285286, + "velocity_flow": 0.8519585585585586, + "velocity_packet": 0.6113232732732733, + "velocity_total": 0.3681575075075075 + }, + "Heartbleed": { + "_n": 1.0, + "arc_length": 0.5599000000000001, + "causal_surprisal_flow": 0.0343, + "causal_surprisal_packet_max": 0.9205, + "causal_surprisal_packet_mean": 0.8553, + "causal_surprisal_packet_median": 0.7794, + "causal_surprisal_packet_trimmed10_mean": 0.8618, + "causal_surprisal_total": 0.12780000000000002, + "consistency_total": 0.8637, + "curvature_flow": 0.5146999999999999, + "curvature_packet": 0.6569, + "curvature_total": 0.55, + "direction_drift_flow": 0.0031999999999999806, + "direction_drift_packet_max": 0.6355999999999999, + "direction_drift_packet_mean": 0.32399999999999995, + "direction_drift_packet_median": 0.5496, + "direction_drift_packet_trimmed10_mean": 0.34419999999999995, + "direction_drift_total": 0.5709, + "flow_consistency": 0.8528, + "kappa2_speed2norm_packet_mean": 0.16169999999999995, + "kappa2_speed2norm_packet_median": 0.1894, + "kappa2_speed2norm_packet_trimmed10_mean": 0.15269999999999995, + "kinetic_energy": 0.5503, + "kinetic_flow": 0.9955999999999999, + "kinetic_packet": 0.5146, + "packet_consistency": 0.9329, + "pna_flow": 0.018000000000000016, + "pna_packet_max": 0.6347, + "pna_packet_mean": 0.16169999999999995, + "pna_packet_median": 0.1894, + "pna_packet_trimmed10_mean": 0.15269999999999995, + "terminal_flow": 0.9623, + "terminal_norm": 0.40280000000000005, + "terminal_packet": 0.3328, + "velocity_flow": 0.9922000000000001, + "velocity_packet": 0.9369999999999999, + "velocity_total": 0.9081999999999999 + }, + "Infiltration": { + "_n": 7.0, + "arc_length": 0.8634571428571429, + "causal_surprisal_flow": 0.23034285714285718, + "causal_surprisal_packet_max": 0.8906571428571429, + "causal_surprisal_packet_mean": 0.8143714285714286, + "causal_surprisal_packet_median": 0.39031428571428567, + "causal_surprisal_packet_trimmed10_mean": 0.6348142857142858, + "causal_surprisal_total": 0.15037142857142854, + "consistency_total": 0.8326571428571429, + "curvature_flow": 0.6701571428571428, + "curvature_packet": 0.8963571428571429, + "curvature_total": 0.8814285714285715, + "direction_drift_flow": 0.05622857142857143, + "direction_drift_packet_max": 0.7756285714285714, + "direction_drift_packet_mean": 0.7542285714285714, + "direction_drift_packet_median": 0.7662571428571429, + "direction_drift_packet_trimmed10_mean": 0.7447857142857144, + "direction_drift_total": 0.7730285714285714, + "flow_consistency": 0.8247, + "kappa2_speed2norm_packet_mean": 0.7576714285714286, + "kappa2_speed2norm_packet_median": 0.7243, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7424000000000001, + "kinetic_energy": 0.8633428571428572, + "kinetic_flow": 0.9260142857142857, + "kinetic_packet": 0.857, + "packet_consistency": 0.8376857142857143, + "pna_flow": 0.2784714285714286, + "pna_packet_max": 0.7874, + "pna_packet_mean": 0.7576714285714286, + "pna_packet_median": 0.7243, + "pna_packet_trimmed10_mean": 0.7424000000000001, + "terminal_flow": 0.8702, + "terminal_norm": 0.6275428571428572, + "terminal_packet": 0.6935857142857142, + "velocity_flow": 0.9334285714285714, + "velocity_packet": 0.7793142857142856, + "velocity_total": 0.6535428571428572 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "arc_length": 0.9896496996996996, + "causal_surprisal_flow": 0.08374984984984984, + "causal_surprisal_packet_max": 0.3985858858858859, + "causal_surprisal_packet_mean": 0.5755716216216216, + "causal_surprisal_packet_median": 0.8563160660660663, + "causal_surprisal_packet_trimmed10_mean": 0.7224763513513514, + "causal_surprisal_total": 0.45752394894894893, + "consistency_total": 0.4894164414414414, + "curvature_flow": 0.12644286786786788, + "curvature_packet": 0.6990774024024025, + "curvature_total": 0.3658788288288289, + "direction_drift_flow": 0.47295120120120115, + "direction_drift_packet_max": 0.32943333333333336, + "direction_drift_packet_mean": 0.5763051801801802, + "direction_drift_packet_median": 0.6304593093093094, + "direction_drift_packet_trimmed10_mean": 0.6020066066066067, + "direction_drift_total": 0.3085343843843844, + "flow_consistency": 0.47074669669669666, + "kappa2_speed2norm_packet_mean": 0.2537255255255255, + "kappa2_speed2norm_packet_median": 0.272775, + "kappa2_speed2norm_packet_trimmed10_mean": 0.27493498498498503, + "kinetic_energy": 0.9896132132132132, + "kinetic_flow": 0.6683063063063064, + "kinetic_packet": 0.9854749249249249, + "packet_consistency": 0.6426403903903904, + "pna_flow": 0.15507972972972972, + "pna_packet_max": 0.1918385885885886, + "pna_packet_mean": 0.2537255255255255, + "pna_packet_median": 0.272775, + "pna_packet_trimmed10_mean": 0.27493498498498503, + "terminal_flow": 0.5199174174174174, + "terminal_norm": 0.9904731231231231, + "terminal_packet": 0.9933644144144144, + "velocity_flow": 0.6651954954954955, + "velocity_packet": 0.6703432432432432, + "velocity_total": 0.9625780780780782 + }, + "Portscan": { + "_n": 666.0, + "arc_length": 0.9947495495495495, + "causal_surprisal_flow": 0.07216861861861862, + "causal_surprisal_packet_max": 0.4872677177177177, + "causal_surprisal_packet_mean": 0.6924572072072072, + "causal_surprisal_packet_median": 0.9374356606606606, + "causal_surprisal_packet_trimmed10_mean": 0.819880930930931, + "causal_surprisal_total": 0.5521037537537538, + "consistency_total": 0.398327927927928, + "curvature_flow": 0.3813869369369369, + "curvature_packet": 0.6369042042042042, + "curvature_total": 0.3287783783783783, + "direction_drift_flow": 0.583843918918919, + "direction_drift_packet_max": 0.15690915915915918, + "direction_drift_packet_mean": 0.2497280780780781, + "direction_drift_packet_median": 0.30832162162162163, + "direction_drift_packet_trimmed10_mean": 0.2733204954954955, + "direction_drift_total": 0.04293918918918919, + "flow_consistency": 0.37828633633633635, + "kappa2_speed2norm_packet_mean": 0.11034151651651652, + "kappa2_speed2norm_packet_median": 0.153678003003003, + "kappa2_speed2norm_packet_trimmed10_mean": 0.1250006756756757, + "kinetic_energy": 0.9947873123123124, + "kinetic_flow": 0.698896096096096, + "kinetic_packet": 0.9889298798798799, + "packet_consistency": 0.6880617867867868, + "pna_flow": 0.3454784534534534, + "pna_packet_max": 0.0948978978978979, + "pna_packet_mean": 0.11034151651651652, + "pna_packet_median": 0.153678003003003, + "pna_packet_trimmed10_mean": 0.1250006756756757, + "terminal_flow": 0.36366741741741737, + "terminal_norm": 0.9890394894894895, + "terminal_packet": 0.9960249249249249, + "velocity_flow": 0.6629397897897897, + "velocity_packet": 0.7345199699699699, + "velocity_total": 0.9883776276276277 + }, + "SSH-Patator": { + "_n": 666.0, + "arc_length": 0.032352702702702706, + "causal_surprisal_flow": 0.7389507507507507, + "causal_surprisal_packet_max": 0.8517484984984985, + "causal_surprisal_packet_mean": 0.6696597597597598, + "causal_surprisal_packet_median": 0.05590255255255255, + "causal_surprisal_packet_trimmed10_mean": 0.2706301801801802, + "causal_surprisal_total": 0.047672972972972974, + "consistency_total": 0.8586807807807808, + "curvature_flow": 0.9101213213213213, + "curvature_packet": 0.46398243243243237, + "curvature_total": 0.443521996996997, + "direction_drift_flow": 0.044854054054054064, + "direction_drift_packet_max": 0.8683768018018018, + "direction_drift_packet_mean": 0.9024246996996996, + "direction_drift_packet_median": 0.9049105855855856, + "direction_drift_packet_trimmed10_mean": 0.9213054804804803, + "direction_drift_total": 0.9478651651651652, + "flow_consistency": 0.8745370870870871, + "kappa2_speed2norm_packet_mean": 0.34853085585585586, + "kappa2_speed2norm_packet_median": 0.402643993993994, + "kappa2_speed2norm_packet_trimmed10_mean": 0.34012042042042046, + "kinetic_energy": 0.028734534534534534, + "kinetic_flow": 0.9631237237237237, + "kinetic_packet": 0.1535897897897898, + "packet_consistency": 0.6566503003003004, + "pna_flow": 0.6152963963963963, + "pna_packet_max": 0.5210857357357358, + "pna_packet_mean": 0.34853085585585586, + "pna_packet_median": 0.402643993993994, + "pna_packet_trimmed10_mean": 0.34012042042042046, + "terminal_flow": 0.8540983483483483, + "terminal_norm": 0.18398911411411412, + "terminal_packet": 0.18701193693693696, + "velocity_flow": 0.9654382882882884, + "velocity_packet": 0.6531298798798798, + "velocity_total": 0.41245818318318317 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "arc_length": 0.25243150684931503, + "causal_surprisal_flow": 0.0546890410958904, + "causal_surprisal_packet_max": 0.8921821917808218, + "causal_surprisal_packet_mean": 0.8270027397260273, + "causal_surprisal_packet_median": 0.32580958904109586, + "causal_surprisal_packet_trimmed10_mean": 0.7038739726027397, + "causal_surprisal_total": 0.09657260273972602, + "consistency_total": 0.8050547945205478, + "curvature_flow": 0.6108561643835616, + "curvature_packet": 0.5981513698630136, + "curvature_total": 0.5073616438356164, + "direction_drift_flow": 0.001393150684931504, + "direction_drift_packet_max": 0.6884664383561644, + "direction_drift_packet_mean": 0.15993972602739726, + "direction_drift_packet_median": 0.11347123287671233, + "direction_drift_packet_trimmed10_mean": 0.12074109589041096, + "direction_drift_total": 0.3280260273972603, + "flow_consistency": 0.7994780821917807, + "kappa2_speed2norm_packet_mean": 0.12032739726027397, + "kappa2_speed2norm_packet_median": 0.17761506849315067, + "kappa2_speed2norm_packet_trimmed10_mean": 0.1326082191780822, + "kinetic_energy": 0.22515890410958903, + "kinetic_flow": 0.9990356164383563, + "kinetic_packet": 0.16088630136986298, + "packet_consistency": 0.8917383561643836, + "pna_flow": 0.03055205479452055, + "pna_packet_max": 0.2683643835616438, + "pna_packet_mean": 0.12032739726027397, + "pna_packet_median": 0.17761506849315067, + "pna_packet_trimmed10_mean": 0.1326082191780822, + "terminal_flow": 0.7766958904109589, + "terminal_norm": 0.1312876712328767, + "terminal_packet": 0.13074657534246575, + "velocity_flow": 0.9989890410958905, + "velocity_packet": 0.937586301369863, + "velocity_total": 0.930758904109589 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "arc_length": 0.6137692307692308, + "causal_surprisal_flow": 0.5951230769230769, + "causal_surprisal_packet_max": 0.701976923076923, + "causal_surprisal_packet_mean": 0.6975, + "causal_surprisal_packet_median": 0.29712307692307693, + "causal_surprisal_packet_trimmed10_mean": 0.30812307692307694, + "causal_surprisal_total": 0.2798538461538461, + "consistency_total": 0.6677923076923077, + "curvature_flow": 0.03927692307692307, + "curvature_packet": 0.7642076923076924, + "curvature_total": 0.5974692307692309, + "direction_drift_flow": 0.33810769230769233, + "direction_drift_packet_max": 0.6486000000000001, + "direction_drift_packet_mean": 0.6034846153846154, + "direction_drift_packet_median": 0.6014384615384616, + "direction_drift_packet_trimmed10_mean": 0.4948461538461538, + "direction_drift_total": 0.6842384615384616, + "flow_consistency": 0.6021461538461539, + "kappa2_speed2norm_packet_mean": 0.5799846153846154, + "kappa2_speed2norm_packet_median": 0.6510692307692307, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4770615384615385, + "kinetic_energy": 0.6101, + "kinetic_flow": 0.5084307692307692, + "kinetic_packet": 0.7565461538461539, + "packet_consistency": 0.7587384615384616, + "pna_flow": 0.06310769230769231, + "pna_packet_max": 0.6701692307692307, + "pna_packet_mean": 0.5799846153846154, + "pna_packet_median": 0.6510692307692307, + "pna_packet_trimmed10_mean": 0.4770615384615385, + "terminal_flow": 0.8340923076923077, + "terminal_norm": 0.9641384615384615, + "terminal_packet": 0.8155153846153846, + "velocity_flow": 0.5297769230769231, + "velocity_packet": 0.7737692307692308, + "velocity_total": 0.5622384615384615 + }, + "Web Attack - XSS": { + "_n": 18.0, + "arc_length": 0.5037055555555556, + "causal_surprisal_flow": 0.036288888888888884, + "causal_surprisal_packet_max": 0.9056833333333334, + "causal_surprisal_packet_mean": 0.8463111111111111, + "causal_surprisal_packet_median": 0.4751277777777778, + "causal_surprisal_packet_trimmed10_mean": 0.7666055555555555, + "causal_surprisal_total": 0.11757777777777778, + "consistency_total": 0.8207111111111112, + "curvature_flow": 0.45826111111111106, + "curvature_packet": 0.7316444444444445, + "curvature_total": 0.6516111111111111, + "direction_drift_flow": 0.0, + "direction_drift_packet_max": 0.48235, + "direction_drift_packet_mean": 0.08246666666666667, + "direction_drift_packet_median": 0.24782777777777776, + "direction_drift_packet_trimmed10_mean": 0.08094444444444443, + "direction_drift_total": 0.17455555555555555, + "flow_consistency": 0.8064611111111111, + "kappa2_speed2norm_packet_mean": 0.08358888888888888, + "kappa2_speed2norm_packet_median": 0.15066388888888887, + "kappa2_speed2norm_packet_trimmed10_mean": 0.09239444444444445, + "kinetic_energy": 0.4840111111111111, + "kinetic_flow": 1.0, + "kinetic_packet": 0.32498333333333335, + "packet_consistency": 0.9348555555555556, + "pna_flow": 0.007088888888888916, + "pna_packet_max": 0.37462500000000004, + "pna_packet_mean": 0.08358888888888888, + "pna_packet_median": 0.15066388888888887, + "pna_packet_trimmed10_mean": 0.09239444444444445, + "terminal_flow": 0.7740388888888889, + "terminal_norm": 0.1537111111111111, + "terminal_packet": 0.1810111111111111, + "velocity_flow": 0.9998888888888888, + "velocity_packet": 0.9787388888888888, + "velocity_total": 0.9809666666666665 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicids2017.log b/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicids2017.log new file mode 100644 index 0000000..39de6b3 --- /dev/null +++ b/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicids2017.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=52 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 2,025,564 target rows; label distribution top: + normal 1,521,748 + Portscan 159,040 + DoS Hulk 158,454 + DDoS 95,144 + Infiltration - Portscan 71,714 +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 20.1s +[eval] scoring attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done in 13.8s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicids2017.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicids2017.npz + +=== overall AUROC top-10 === + terminal_norm AUROC=0.7763 AUPRC=0.7410 + terminal_packet AUROC=0.7527 AUPRC=0.7331 + terminal_flow AUROC=0.7429 AUPRC=0.5540 + consistency_total AUROC=0.7338 AUPRC=0.5502 + kinetic_packet AUROC=0.7331 AUPRC=0.6966 + causal_surprisal_packet_mean AUROC=0.7305 AUPRC=0.5288 + velocity_packet AUROC=0.7270 AUPRC=0.5065 + packet_consistency AUROC=0.7238 AUPRC=0.5008 + curvature_packet AUROC=0.7231 AUPRC=0.5419 + flow_consistency AUROC=0.7220 AUPRC=0.5486 diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicids2017.npz b/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicids2017.npz new file mode 100644 index 0000000..3aa9d1d Binary files /dev/null and b/artifacts/route_comparison/cross/route_b_spectral_seed43_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicddos2019.json b/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicddos2019.json new file mode 100644 index 0000000..015eefd --- /dev/null +++ b/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicddos2019.json @@ -0,0 +1,818 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.8064475776965265, + "auprc": 0.785259901931492 + }, + "causal_surprisal_flow": { + "auroc": 0.136334206784481, + "auprc": 0.3348083106408613 + }, + "causal_surprisal_packet_max": { + "auroc": 0.18546566118220598, + "auprc": 0.33678920160151005 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.1787093794434288, + "auprc": 0.3339038551889312 + }, + "causal_surprisal_packet_median": { + "auroc": 0.415151990656104, + "auprc": 0.4160690420992498 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.17074993398334348, + "auprc": 0.3335184724413271 + }, + "causal_surprisal_total": { + "auroc": 0.10403871622994108, + "auprc": 0.3171332400592999 + }, + "consistency_total": { + "auroc": 0.6959767215112735, + "auprc": 0.5793761294639597 + }, + "curvature_flow": { + "auroc": 0.23275524578509038, + "auprc": 0.35808839418685706 + }, + "curvature_packet": { + "auroc": 0.8802576477757464, + "auprc": 0.9141246691490731 + }, + "curvature_total": { + "auroc": 0.7272965214300224, + "auprc": 0.7049492437781639 + }, + "direction_drift_flow": { + "auroc": 0.4005966433069266, + "auprc": 0.4069478463384252 + }, + "direction_drift_packet_max": { + "auroc": 0.26092009953280515, + "auprc": 0.3845595150062187 + }, + "direction_drift_packet_mean": { + "auroc": 0.3741333231769247, + "auprc": 0.404628118245524 + }, + "direction_drift_packet_median": { + "auroc": 0.39514733394271784, + "auprc": 0.41323490438131427 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.37512697034328657, + "auprc": 0.40367255136350394 + }, + "direction_drift_total": { + "auroc": 0.22299598821856592, + "auprc": 0.35429675920046405 + }, + "flow_consistency": { + "auroc": 0.6502401939874061, + "auprc": 0.5542906952111377 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.5446774832419257, + "auprc": 0.5917632142186009 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.5570651685963843, + "auprc": 0.5943278389163028 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.5539180682510665, + "auprc": 0.5951752590667314 + }, + "kinetic_energy": { + "auroc": 0.8038012238472475, + "auprc": 0.7810483921880141 + }, + "kinetic_flow": { + "auroc": 0.6887975066016657, + "auprc": 0.5578047729994247 + }, + "kinetic_packet": { + "auroc": 0.7175569469835466, + "auprc": 0.6895414908623031 + }, + "packet_consistency": { + "auroc": 0.8070416565102579, + "auprc": 0.7823741167020353 + }, + "pna_flow": { + "auroc": 0.186270155393053, + "auprc": 0.3362212575544573 + }, + "pna_packet_max": { + "auroc": 0.3953386045094454, + "auprc": 0.4721063206568368 + }, + "pna_packet_mean": { + "auroc": 0.5446774832419257, + "auprc": 0.5917632142186009 + }, + "pna_packet_median": { + "auroc": 0.5570651685963843, + "auprc": 0.5943278389163028 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.5539180682510665, + "auprc": 0.5951752590667314 + }, + "terminal_flow": { + "auroc": 0.5330805911029859, + "auprc": 0.4949507543245555 + }, + "terminal_norm": { + "auroc": 0.6709644271785498, + "auprc": 0.6220095377685018 + }, + "terminal_packet": { + "auroc": 0.5857414940077188, + "auprc": 0.5433538707525217 + }, + "velocity_flow": { + "auroc": 0.6628080997359334, + "auprc": 0.5363433477131041 + }, + "velocity_packet": { + "auroc": 0.8881020566727604, + "auprc": 0.8762100310637638 + }, + "velocity_total": { + "auroc": 0.8998990402193785, + "auprc": 0.9039152969041273 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "arc_length": 0.97656768707483, + "causal_surprisal_flow": 0.03829863945578231, + "causal_surprisal_packet_max": 0.05817891156462585, + "causal_surprisal_packet_mean": 0.06058639455782313, + "causal_surprisal_packet_median": 0.4229739795918368, + "causal_surprisal_packet_trimmed10_mean": 0.07110425170068028, + "causal_surprisal_total": 0.023315306122448975, + "consistency_total": 0.7457996598639456, + "curvature_flow": 0.10302074829931973, + "curvature_packet": 0.970762925170068, + "curvature_total": 0.7228923469387756, + "direction_drift_flow": 0.5330891156462585, + "direction_drift_packet_max": 0.06241989795918367, + "direction_drift_packet_mean": 0.17531037414965983, + "direction_drift_packet_median": 0.2128697278911565, + "direction_drift_packet_trimmed10_mean": 0.1861348639455782, + "direction_drift_total": 0.05462125850340136, + "flow_consistency": 0.6415465986394557, + "kappa2_speed2norm_packet_mean": 0.17056828231292517, + "kappa2_speed2norm_packet_median": 0.1904078231292517, + "kappa2_speed2norm_packet_trimmed10_mean": 0.18048205782312926, + "kinetic_energy": 0.9751170068027212, + "kinetic_flow": 0.6727857142857143, + "kinetic_packet": 0.956736394557823, + "packet_consistency": 0.9818964285714287, + "pna_flow": 0.09347100340136054, + "pna_packet_max": 0.10040127551020409, + "pna_packet_mean": 0.17056828231292517, + "pna_packet_median": 0.1904078231292517, + "pna_packet_trimmed10_mean": 0.18048205782312926, + "terminal_flow": 0.7076602040816328, + "terminal_norm": 0.9157897959183674, + "terminal_packet": 0.668593537414966, + "velocity_flow": 0.6302971088435374, + "velocity_packet": 0.9941517006802721, + "velocity_total": 0.9988982993197278 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "arc_length": 0.9868651360544217, + "causal_surprisal_flow": 0.036380612244897956, + "causal_surprisal_packet_max": 0.05953333333333333, + "causal_surprisal_packet_mean": 0.0608906462585034, + "causal_surprisal_packet_median": 0.4280875850340136, + "causal_surprisal_packet_trimmed10_mean": 0.07129404761904762, + "causal_surprisal_total": 0.017838265306122446, + "consistency_total": 0.7477049319727891, + "curvature_flow": 0.09947755102040817, + "curvature_packet": 0.9723313775510204, + "curvature_total": 0.7190509353741497, + "direction_drift_flow": 0.5407244897959184, + "direction_drift_packet_max": 0.05971232993197279, + "direction_drift_packet_mean": 0.17183988095238095, + "direction_drift_packet_median": 0.20910025510204083, + "direction_drift_packet_trimmed10_mean": 0.1821390306122449, + "direction_drift_total": 0.05416394557823129, + "flow_consistency": 0.6375426870748299, + "kappa2_speed2norm_packet_mean": 0.14236496598639453, + "kappa2_speed2norm_packet_median": 0.16198486394557823, + "kappa2_speed2norm_packet_trimmed10_mean": 0.15132091836734693, + "kinetic_energy": 0.9855335034013605, + "kinetic_flow": 0.6702791666666665, + "kinetic_packet": 0.9723664965986395, + "packet_consistency": 0.9960892857142857, + "pna_flow": 0.08957465986394558, + "pna_packet_max": 0.08576360544217687, + "pna_packet_mean": 0.14236496598639453, + "pna_packet_median": 0.16198486394557823, + "pna_packet_trimmed10_mean": 0.15132091836734693, + "terminal_flow": 0.7202784013605441, + "terminal_norm": 0.9351248299319728, + "terminal_packet": 0.6736202380952381, + "velocity_flow": 0.6245704081632654, + "velocity_packet": 0.9988437074829931, + "velocity_total": 0.9994102040816327 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "arc_length": 0.8742016156462584, + "causal_surprisal_flow": 0.015317857142857137, + "causal_surprisal_packet_max": 0.05582482993197278, + "causal_surprisal_packet_mean": 0.057568877551020414, + "causal_surprisal_packet_median": 0.3834591836734694, + "causal_surprisal_packet_trimmed10_mean": 0.06655136054421769, + "causal_surprisal_total": 0.015956802721088435, + "consistency_total": 0.736417006802721, + "curvature_flow": 0.1270345238095238, + "curvature_packet": 0.9959887755102041, + "curvature_total": 0.8417447278911565, + "direction_drift_flow": 0.4783545068027211, + "direction_drift_packet_max": 0.10755824829931973, + "direction_drift_packet_mean": 0.25920552721088436, + "direction_drift_packet_median": 0.29372125850340136, + "direction_drift_packet_trimmed10_mean": 0.2726678571428572, + "direction_drift_total": 0.06759880952380952, + "flow_consistency": 0.7009413265306123, + "kappa2_speed2norm_packet_mean": 0.6475228741496597, + "kappa2_speed2norm_packet_median": 0.6705398809523809, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6696194727891156, + "kinetic_energy": 0.8713147108843537, + "kinetic_flow": 0.731431887755102, + "kinetic_packet": 0.7540198129251701, + "packet_consistency": 0.8769144557823129, + "pna_flow": 0.10852125850340136, + "pna_packet_max": 0.3394984693877551, + "pna_packet_mean": 0.6475228741496597, + "pna_packet_median": 0.6705398809523809, + "pna_packet_trimmed10_mean": 0.6696194727891156, + "terminal_flow": 0.6086659863945578, + "terminal_norm": 0.708176955782313, + "terminal_packet": 0.5742598639455783, + "velocity_flow": 0.7486693027210884, + "velocity_packet": 0.9727627551020408, + "velocity_total": 0.9960331632653062 + }, + "DrDoS_NTP": { + "_n": 588.0, + "arc_length": 0.5775119047619047, + "causal_surprisal_flow": 0.8087813775510204, + "causal_surprisal_packet_max": 0.7249353741496598, + "causal_surprisal_packet_mean": 0.36757653061224493, + "causal_surprisal_packet_median": 0.14755357142857142, + "causal_surprisal_packet_trimmed10_mean": 0.09166411564625851, + "causal_surprisal_total": 0.3497928571428572, + "consistency_total": 0.9174144557823128, + "curvature_flow": 0.4294552721088435, + "curvature_packet": 0.9726758503401361, + "curvature_total": 0.9680406462585034, + "direction_drift_flow": 0.21909566326530613, + "direction_drift_packet_max": 0.889974829931973, + "direction_drift_packet_mean": 0.6511466836734694, + "direction_drift_packet_median": 0.5929796768707483, + "direction_drift_packet_trimmed10_mean": 0.6004986394557823, + "direction_drift_total": 0.8148457482993198, + "flow_consistency": 0.9007649659863946, + "kappa2_speed2norm_packet_mean": 0.9529451530612244, + "kappa2_speed2norm_packet_median": 0.949549149659864, + "kappa2_speed2norm_packet_trimmed10_mean": 0.9495100340136053, + "kinetic_energy": 0.5808822278911564, + "kinetic_flow": 0.7292666666666667, + "kinetic_packet": 0.6476994897959183, + "packet_consistency": 0.9135364795918368, + "pna_flow": 0.29217474489795914, + "pna_packet_max": 0.9343685374149661, + "pna_packet_mean": 0.9529451530612244, + "pna_packet_median": 0.949549149659864, + "pna_packet_trimmed10_mean": 0.9495100340136053, + "terminal_flow": 0.8972086734693876, + "terminal_norm": 0.6647664115646258, + "terminal_packet": 0.5993520408163265, + "velocity_flow": 0.7813545918367346, + "velocity_packet": 0.9303391156462585, + "velocity_total": 0.6157210034013605 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "arc_length": 0.7898513605442178, + "causal_surprisal_flow": 0.011139455782312919, + "causal_surprisal_packet_max": 0.05034676870748299, + "causal_surprisal_packet_mean": 0.050206802721088434, + "causal_surprisal_packet_median": 0.3053287414965986, + "causal_surprisal_packet_trimmed10_mean": 0.056368197278911555, + "causal_surprisal_total": 0.01330289115646257, + "consistency_total": 0.7269532312925169, + "curvature_flow": 0.17604183673469387, + "curvature_packet": 0.9423799319727891, + "curvature_total": 0.7257781462585035, + "direction_drift_flow": 0.4036374149659864, + "direction_drift_packet_max": 0.1416109693877551, + "direction_drift_packet_mean": 0.33781573129251696, + "direction_drift_packet_median": 0.3700820578231293, + "direction_drift_packet_trimmed10_mean": 0.35373324829931974, + "direction_drift_total": 0.08200289115646259, + "flow_consistency": 0.7675145408163264, + "kappa2_speed2norm_packet_mean": 0.7163537414965986, + "kappa2_speed2norm_packet_median": 0.7375414115646259, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7390423469387755, + "kinetic_energy": 0.7865709183673469, + "kinetic_flow": 0.7667767857142858, + "kinetic_packet": 0.5753352040816326, + "packet_consistency": 0.569562925170068, + "pna_flow": 0.1486389455782313, + "pna_packet_max": 0.4420141156462585, + "pna_packet_mean": 0.7163537414965986, + "pna_packet_median": 0.7375414115646259, + "pna_packet_trimmed10_mean": 0.7390423469387755, + "terminal_flow": 0.16759566326530612, + "terminal_norm": 0.465666156462585, + "terminal_packet": 0.4727270408163265, + "velocity_flow": 0.6291517857142858, + "velocity_packet": 0.8052545918367345, + "velocity_total": 0.9426250850340137 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "arc_length": 0.9816250850340136, + "causal_surprisal_flow": 0.031565391156462584, + "causal_surprisal_packet_max": 0.05763486394557822, + "causal_surprisal_packet_mean": 0.059807482993197277, + "causal_surprisal_packet_median": 0.41688350340136054, + "causal_surprisal_packet_trimmed10_mean": 0.06995901360544218, + "causal_surprisal_total": 0.008499319727891154, + "consistency_total": 0.743865476190476, + "curvature_flow": 0.10540187074829933, + "curvature_packet": 0.9712137755102042, + "curvature_total": 0.7246037414965987, + "direction_drift_flow": 0.5335920918367347, + "direction_drift_packet_max": 0.0641811224489796, + "direction_drift_packet_mean": 0.1795671768707483, + "direction_drift_packet_median": 0.21556454081632656, + "direction_drift_packet_trimmed10_mean": 0.19035357142857143, + "direction_drift_total": 0.05539404761904762, + "flow_consistency": 0.6424994897959183, + "kappa2_speed2norm_packet_mean": 0.17206020408163264, + "kappa2_speed2norm_packet_median": 0.19170408163265307, + "kappa2_speed2norm_packet_trimmed10_mean": 0.1817545918367347, + "kinetic_energy": 0.9802055272108844, + "kinetic_flow": 0.6758169217687076, + "kinetic_packet": 0.953442006802721, + "packet_consistency": 0.9761806122448979, + "pna_flow": 0.09219319727891158, + "pna_packet_max": 0.10536683673469387, + "pna_packet_mean": 0.17206020408163264, + "pna_packet_median": 0.19170408163265307, + "pna_packet_trimmed10_mean": 0.1817545918367347, + "terminal_flow": 0.6878044217687076, + "terminal_norm": 0.9090330782312924, + "terminal_packet": 0.6664530612244899, + "velocity_flow": 0.6339340986394558, + "velocity_packet": 0.9897370748299319, + "velocity_total": 0.9973947278911565 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "arc_length": 0.6750900510204081, + "causal_surprisal_flow": 0.14528384353741497, + "causal_surprisal_packet_max": 0.26960059523809526, + "causal_surprisal_packet_mean": 0.21025850340136054, + "causal_surprisal_packet_median": 0.33546955782312926, + "causal_surprisal_packet_trimmed10_mean": 0.17084268707482994, + "causal_surprisal_total": 0.10463341836734694, + "consistency_total": 0.5998309523809523, + "curvature_flow": 0.41823656462585035, + "curvature_packet": 0.9919755102040816, + "curvature_total": 0.9075034013605444, + "direction_drift_flow": 0.3718625, + "direction_drift_packet_max": 0.32863010204081633, + "direction_drift_packet_mean": 0.38649217687074827, + "direction_drift_packet_median": 0.3917294217687075, + "direction_drift_packet_trimmed10_mean": 0.36664166666666664, + "direction_drift_total": 0.27246624149659865, + "flow_consistency": 0.5111017857142857, + "kappa2_speed2norm_packet_mean": 0.8469548469387755, + "kappa2_speed2norm_packet_median": 0.8496536564625851, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8526090136054422, + "kinetic_energy": 0.6707243197278911, + "kinetic_flow": 0.6535892006802719, + "kinetic_packet": 0.5207562074829932, + "packet_consistency": 0.8178146258503403, + "pna_flow": 0.32456692176870744, + "pna_packet_max": 0.6579795918367346, + "pna_packet_mean": 0.8469548469387755, + "pna_packet_median": 0.8496536564625851, + "pna_packet_trimmed10_mean": 0.8526090136054422, + "terminal_flow": 0.44570578231292524, + "terminal_norm": 0.43085272108843536, + "terminal_packet": 0.3929702380952381, + "velocity_flow": 0.661185544217687, + "velocity_packet": 0.9216, + "velocity_total": 0.8585647959183673 + }, + "DrDoS_UDP": { + "_n": 588.0, + "arc_length": 0.6729770408163265, + "causal_surprisal_flow": 0.1458372448979592, + "causal_surprisal_packet_max": 0.26143078231292516, + "causal_surprisal_packet_mean": 0.2147307823129252, + "causal_surprisal_packet_median": 0.35115340136054424, + "causal_surprisal_packet_trimmed10_mean": 0.19813248299319727, + "causal_surprisal_total": 0.1041891156462585, + "consistency_total": 0.5746965986394558, + "curvature_flow": 0.4414869897959184, + "curvature_packet": 0.9915799319727892, + "curvature_total": 0.9114552721088435, + "direction_drift_flow": 0.34399506802721086, + "direction_drift_packet_max": 0.328743962585034, + "direction_drift_packet_mean": 0.38257627551020407, + "direction_drift_packet_median": 0.38660765306122447, + "direction_drift_packet_trimmed10_mean": 0.37399812925170073, + "direction_drift_total": 0.25684625850340137, + "flow_consistency": 0.4775607142857143, + "kappa2_speed2norm_packet_mean": 0.8656462585034014, + "kappa2_speed2norm_packet_median": 0.8668910714285716, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8729052721088435, + "kinetic_energy": 0.6688429421768707, + "kinetic_flow": 0.6579573979591837, + "kinetic_packet": 0.5086353741496599, + "packet_consistency": 0.8055630952380952, + "pna_flow": 0.33702193877551023, + "pna_packet_max": 0.6710142857142856, + "pna_packet_mean": 0.8656462585034014, + "pna_packet_median": 0.8668910714285716, + "pna_packet_trimmed10_mean": 0.8729052721088435, + "terminal_flow": 0.4007109693877551, + "terminal_norm": 0.3901891156462586, + "terminal_packet": 0.380744387755102, + "velocity_flow": 0.6610839285714285, + "velocity_packet": 0.9219775510204082, + "velocity_total": 0.8603789115646259 + }, + "LDAP": { + "_n": 588.0, + "arc_length": 0.9886544217687074, + "causal_surprisal_flow": 0.031995748299319726, + "causal_surprisal_packet_max": 0.05941054421768707, + "causal_surprisal_packet_mean": 0.061939625850340144, + "causal_surprisal_packet_median": 0.4260494897959184, + "causal_surprisal_packet_trimmed10_mean": 0.07281496598639456, + "causal_surprisal_total": 0.014074659863945578, + "consistency_total": 0.7495613945578231, + "curvature_flow": 0.09640348639455783, + "curvature_packet": 0.9696739795918369, + "curvature_total": 0.7105609693877551, + "direction_drift_flow": 0.5426386904761905, + "direction_drift_packet_max": 0.05916955782312926, + "direction_drift_packet_mean": 0.16543469387755105, + "direction_drift_packet_median": 0.203640731292517, + "direction_drift_packet_trimmed10_mean": 0.17589557823129254, + "direction_drift_total": 0.053500850340136054, + "flow_consistency": 0.6402658163265306, + "kappa2_speed2norm_packet_mean": 0.13457857142857144, + "kappa2_speed2norm_packet_median": 0.15281156462585033, + "kappa2_speed2norm_packet_trimmed10_mean": 0.14305935374149661, + "kinetic_energy": 0.9874423469387756, + "kinetic_flow": 0.6740955782312925, + "kinetic_packet": 0.9732886054421769, + "packet_consistency": 0.9957784013605443, + "pna_flow": 0.08611904761904762, + "pna_packet_max": 0.08360238095238096, + "pna_packet_mean": 0.13457857142857144, + "pna_packet_median": 0.15281156462585033, + "pna_packet_trimmed10_mean": 0.14305935374149661, + "terminal_flow": 0.7209336734693877, + "terminal_norm": 0.9367749149659865, + "terminal_packet": 0.67699481292517, + "velocity_flow": 0.6206964285714286, + "velocity_packet": 0.9987187074829932, + "velocity_total": 0.9993982993197278 + }, + "MSSQL": { + "_n": 588.0, + "arc_length": 0.8633183673469388, + "causal_surprisal_flow": 0.018474659863945572, + "causal_surprisal_packet_max": 0.0566891156462585, + "causal_surprisal_packet_mean": 0.05745527210884354, + "causal_surprisal_packet_median": 0.38642789115646253, + "causal_surprisal_packet_trimmed10_mean": 0.06653231292517006, + "causal_surprisal_total": 0.018203231292517004, + "consistency_total": 0.7364127551020409, + "curvature_flow": 0.1329719387755102, + "curvature_packet": 0.9960318027210884, + "curvature_total": 0.8451273809523809, + "direction_drift_flow": 0.4712548469387755, + "direction_drift_packet_max": 0.11845110544217688, + "direction_drift_packet_mean": 0.2770989795918367, + "direction_drift_packet_median": 0.30979175170068024, + "direction_drift_packet_trimmed10_mean": 0.2910066326530612, + "direction_drift_total": 0.07313707482993198, + "flow_consistency": 0.7035125850340136, + "kappa2_speed2norm_packet_mean": 0.6650022108843537, + "kappa2_speed2norm_packet_median": 0.6869012755102041, + "kappa2_speed2norm_packet_trimmed10_mean": 0.686383418367347, + "kinetic_energy": 0.8603990646258504, + "kinetic_flow": 0.7268977040816328, + "kinetic_packet": 0.7392282312925171, + "packet_consistency": 0.8703130952380952, + "pna_flow": 0.11575076530612244, + "pna_packet_max": 0.3640698129251701, + "pna_packet_mean": 0.6650022108843537, + "pna_packet_median": 0.6869012755102041, + "pna_packet_trimmed10_mean": 0.686383418367347, + "terminal_flow": 0.6059549319727892, + "terminal_norm": 0.6940180272108843, + "terminal_packet": 0.5682702380952381, + "velocity_flow": 0.7446892857142857, + "velocity_packet": 0.9716965986394558, + "velocity_total": 0.9952916666666667 + }, + "NetBIOS": { + "_n": 588.0, + "arc_length": 0.7843352891156462, + "causal_surprisal_flow": 0.019073639455782308, + "causal_surprisal_packet_max": 0.050272789115646255, + "causal_surprisal_packet_mean": 0.05024948979591837, + "causal_surprisal_packet_median": 0.3064969387755102, + "causal_surprisal_packet_trimmed10_mean": 0.05643775510204081, + "causal_surprisal_total": 0.0241018707482993, + "consistency_total": 0.7292319727891157, + "curvature_flow": 0.19145357142857145, + "curvature_packet": 0.9435100340136054, + "curvature_total": 0.7285079081632653, + "direction_drift_flow": 0.40871488095238095, + "direction_drift_packet_max": 0.15294668367346936, + "direction_drift_packet_mean": 0.35424659863945573, + "direction_drift_packet_median": 0.38572738095238096, + "direction_drift_packet_trimmed10_mean": 0.37068214285714285, + "direction_drift_total": 0.08911454081632653, + "flow_consistency": 0.7709981292517006, + "kappa2_speed2norm_packet_mean": 0.7354650510204082, + "kappa2_speed2norm_packet_median": 0.7551319727891157, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7570312074829934, + "kinetic_energy": 0.7808633503401361, + "kinetic_flow": 0.7497506802721089, + "kinetic_packet": 0.5739678571428573, + "packet_consistency": 0.5654522959183673, + "pna_flow": 0.16454591836734694, + "pna_packet_max": 0.46443945578231294, + "pna_packet_mean": 0.7354650510204082, + "pna_packet_median": 0.7551319727891157, + "pna_packet_trimmed10_mean": 0.7570312074829934, + "terminal_flow": 0.1774330782312925, + "terminal_norm": 0.476159693877551, + "terminal_packet": 0.47132193877551015, + "velocity_flow": 0.6228333333333333, + "velocity_packet": 0.8033761904761906, + "velocity_total": 0.9354856292517008 + }, + "Portmap": { + "_n": 588.0, + "arc_length": 0.7886024659863946, + "causal_surprisal_flow": 0.019539115646258497, + "causal_surprisal_packet_max": 0.05130918367346938, + "causal_surprisal_packet_mean": 0.05235136054421769, + "causal_surprisal_packet_median": 0.3043795068027211, + "causal_surprisal_packet_trimmed10_mean": 0.0589312925170068, + "causal_surprisal_total": 0.025788095238095225, + "consistency_total": 0.7290920068027211, + "curvature_flow": 0.1666017006802721, + "curvature_packet": 0.9394982993197278, + "curvature_total": 0.7180551020408164, + "direction_drift_flow": 0.4091821428571429, + "direction_drift_packet_max": 0.15948299319727893, + "direction_drift_packet_mean": 0.35720714285714283, + "direction_drift_packet_median": 0.38843486394557825, + "direction_drift_packet_trimmed10_mean": 0.3736776360544217, + "direction_drift_total": 0.0867549319727891, + "flow_consistency": 0.7704993197278912, + "kappa2_speed2norm_packet_mean": 0.7219621598639455, + "kappa2_speed2norm_packet_median": 0.7424962585034012, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7440637755102041, + "kinetic_energy": 0.7853528911564626, + "kinetic_flow": 0.7604281462585034, + "kinetic_packet": 0.5828340136054422, + "packet_consistency": 0.5667573979591838, + "pna_flow": 0.1406988945578231, + "pna_packet_max": 0.45364481292517006, + "pna_packet_mean": 0.7219621598639455, + "pna_packet_median": 0.7424962585034012, + "pna_packet_trimmed10_mean": 0.7440637755102041, + "terminal_flow": 0.19074889455782312, + "terminal_norm": 0.4882707482993197, + "terminal_packet": 0.47988928571428574, + "velocity_flow": 0.6245146258503401, + "velocity_packet": 0.804104081632653, + "velocity_total": 0.9358421768707482 + }, + "Syn": { + "_n": 588.0, + "arc_length": 0.8151779761904763, + "causal_surprisal_flow": 0.24802602040816327, + "causal_surprisal_packet_max": 0.2819358843537415, + "causal_surprisal_packet_mean": 0.45598069727891155, + "causal_surprisal_packet_median": 0.751453231292517, + "causal_surprisal_packet_trimmed10_mean": 0.5216953231292517, + "causal_surprisal_total": 0.3204178571428572, + "consistency_total": 0.6919608843537415, + "curvature_flow": 0.0981812925170068, + "curvature_packet": 0.2137875850340136, + "curvature_total": 0.10489863945578232, + "direction_drift_flow": 0.32693647959183675, + "direction_drift_packet_max": 0.4263869897959184, + "direction_drift_packet_mean": 0.6623673469387755, + "direction_drift_packet_median": 0.7184360544217686, + "direction_drift_packet_trimmed10_mean": 0.6648020408163265, + "direction_drift_total": 0.42198715986394564, + "flow_consistency": 0.6881669217687075, + "kappa2_speed2norm_packet_mean": 0.03366360544217688, + "kappa2_speed2norm_packet_median": 0.04264132653061224, + "kappa2_speed2norm_packet_trimmed10_mean": 0.030608248299319726, + "kinetic_energy": 0.812499149659864, + "kinetic_flow": 0.5673310374149659, + "kinetic_packet": 0.8696064625850342, + "packet_consistency": 0.7605221088435375, + "pna_flow": 0.1040765306122449, + "pna_packet_max": 0.04408775510204082, + "pna_packet_mean": 0.03366360544217688, + "pna_packet_median": 0.04264132653061224, + "pna_packet_trimmed10_mean": 0.030608248299319726, + "terminal_flow": 0.6829080782312925, + "terminal_norm": 0.9342057823129253, + "terminal_packet": 0.9729465986394558, + "velocity_flow": 0.5722365646258504, + "velocity_packet": 0.7814556122448978, + "velocity_total": 0.835970918367347 + }, + "TFTP": { + "_n": 588.0, + "arc_length": 0.7387694727891156, + "causal_surprisal_flow": 0.1556642857142857, + "causal_surprisal_packet_max": 0.21450952380952382, + "causal_surprisal_packet_mean": 0.20524676870748298, + "causal_surprisal_packet_median": 0.3979669217687075, + "causal_surprisal_packet_trimmed10_mean": 0.2068176870748299, + "causal_surprisal_total": 0.12615068027210885, + "consistency_total": 0.5931144557823129, + "curvature_flow": 0.4166778911564626, + "curvature_packet": 0.9911790816326531, + "curvature_total": 0.9178870748299321, + "direction_drift_flow": 0.3212656462585034, + "direction_drift_packet_max": 0.28897244897959184, + "direction_drift_packet_mean": 0.4171043367346939, + "direction_drift_packet_median": 0.40466930272108836, + "direction_drift_packet_trimmed10_mean": 0.420325, + "direction_drift_total": 0.30228154761904763, + "flow_consistency": 0.4861506802721088, + "kappa2_speed2norm_packet_mean": 0.8165473639455781, + "kappa2_speed2norm_packet_median": 0.8147355442176871, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8240777210884354, + "kinetic_energy": 0.7346682823129252, + "kinetic_flow": 0.7266125, + "kinetic_packet": 0.6248867346938776, + "packet_consistency": 0.8853595238095239, + "pna_flow": 0.2926938775510204, + "pna_packet_max": 0.6001600340136054, + "pna_packet_mean": 0.8165473639455781, + "pna_packet_median": 0.8147355442176871, + "pna_packet_trimmed10_mean": 0.8240777210884354, + "terminal_flow": 0.6259420068027212, + "terminal_norm": 0.6144318027210884, + "terminal_packet": 0.48285926870748297, + "velocity_flow": 0.7781411564625851, + "velocity_packet": 0.9653409863945579, + "velocity_total": 0.8724365646258503 + }, + "UDP": { + "_n": 588.0, + "arc_length": 0.6625749149659864, + "causal_surprisal_flow": 0.15658894557823128, + "causal_surprisal_packet_max": 0.28442959183673466, + "causal_surprisal_packet_mean": 0.23108129251700676, + "causal_surprisal_packet_median": 0.34910748299319727, + "causal_surprisal_packet_trimmed10_mean": 0.20699285714285715, + "causal_surprisal_total": 0.11683673469387755, + "consistency_total": 0.5718921768707483, + "curvature_flow": 0.460018537414966, + "curvature_packet": 0.9898120748299319, + "curvature_total": 0.9096473639455781, + "direction_drift_flow": 0.3452829931972789, + "direction_drift_packet_max": 0.3223595238095238, + "direction_drift_packet_mean": 0.3687366496598639, + "direction_drift_packet_median": 0.3740087585034014, + "direction_drift_packet_trimmed10_mean": 0.35508256802721083, + "direction_drift_total": 0.258690306122449, + "flow_consistency": 0.47194047619047613, + "kappa2_speed2norm_packet_mean": 0.8662109693877551, + "kappa2_speed2norm_packet_median": 0.8668038265306122, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8726360544217687, + "kinetic_energy": 0.6579401360544217, + "kinetic_flow": 0.6495967687074831, + "kinetic_packet": 0.49986947278911564, + "packet_consistency": 0.8068989795918368, + "pna_flow": 0.3514972789115647, + "pna_packet_max": 0.6834795068027211, + "pna_packet_mean": 0.8662109693877551, + "pna_packet_median": 0.8668038265306122, + "pna_packet_trimmed10_mean": 0.8726360544217687, + "terminal_flow": 0.40118027210884355, + "terminal_norm": 0.3892375850340136, + "terminal_packet": 0.3744670068027211, + "velocity_flow": 0.6540332482993197, + "velocity_packet": 0.9205522108843538, + "velocity_total": 0.85209268707483 + }, + "UDPLag": { + "_n": 588.0, + "arc_length": 0.8018881802721088, + "causal_surprisal_flow": 0.23800884353741494, + "causal_surprisal_packet_max": 0.30233681972789117, + "causal_surprisal_packet_mean": 0.4419312925170068, + "causal_surprisal_packet_median": 0.729269387755102, + "causal_surprisal_packet_trimmed10_mean": 0.4957488095238095, + "causal_surprisal_total": 0.2972261054421769, + "consistency_total": 0.6739986394557822, + "curvature_flow": 0.15759166666666663, + "curvature_packet": 0.3441118197278912, + "curvature_total": 0.2343046768707483, + "direction_drift_flow": 0.3018866496598639, + "direction_drift_packet_max": 0.4477642006802721, + "direction_drift_packet_mean": 0.6835203231292517, + "direction_drift_packet_median": 0.7079683673469388, + "direction_drift_packet_trimmed10_mean": 0.6850073979591836, + "direction_drift_total": 0.45774413265306124, + "flow_consistency": 0.6570988095238094, + "kappa2_speed2norm_packet_mean": 0.13421768707482992, + "kappa2_speed2norm_packet_median": 0.14023265306122448, + "kappa2_speed2norm_packet_trimmed10_mean": 0.13114149659863944, + "kinetic_energy": 0.7986267857142857, + "kinetic_flow": 0.5835153911564626, + "kinetic_packet": 0.8166527210884353, + "packet_consistency": 0.7713119047619047, + "pna_flow": 0.15470612244897958, + "pna_packet_max": 0.11673401360544218, + "pna_packet_mean": 0.13421768707482992, + "pna_packet_median": 0.14023265306122448, + "pna_packet_trimmed10_mean": 0.13114149659863944, + "terminal_flow": 0.6553044217687077, + "terminal_norm": 0.8793688775510203, + "terminal_packet": 0.9010093537414966, + "velocity_flow": 0.5945431972789116, + "velocity_packet": 0.7960132653061224, + "velocity_total": 0.8466270408163264 + }, + "WebDDoS": { + "_n": 438.0, + "arc_length": 0.7059643835616438, + "causal_surprisal_flow": 0.21872351598173514, + "causal_surprisal_packet_max": 0.3587399543378995, + "causal_surprisal_packet_mean": 0.4760497716894977, + "causal_surprisal_packet_median": 0.6841438356164383, + "causal_surprisal_packet_trimmed10_mean": 0.5065164383561644, + "causal_surprisal_total": 0.21719817351598172, + "consistency_total": 0.5183429223744291, + "curvature_flow": 0.3724099315068493, + "curvature_packet": 0.7293773972602742, + "curvature_total": 0.6557243150684932, + "direction_drift_flow": 0.2100109589041096, + "direction_drift_packet_max": 0.5513714611872146, + "direction_drift_packet_mean": 0.5841799086757992, + "direction_drift_packet_median": 0.6059487442922374, + "direction_drift_packet_trimmed10_mean": 0.5622472602739726, + "direction_drift_total": 0.4469005707762557, + "flow_consistency": 0.5639710045662101, + "kappa2_speed2norm_packet_mean": 0.6692257990867579, + "kappa2_speed2norm_packet_median": 0.6819364155251142, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6565416666666667, + "kinetic_energy": 0.7015542237442921, + "kinetic_flow": 0.721860502283105, + "kinetic_packet": 0.5988642694063926, + "packet_consistency": 0.4750698630136987, + "pna_flow": 0.299133105022831, + "pna_packet_max": 0.6353623287671233, + "pna_packet_mean": 0.6692257990867579, + "pna_packet_median": 0.6819364155251142, + "pna_packet_trimmed10_mean": 0.6565416666666667, + "terminal_flow": 0.309229794520548, + "terminal_norm": 0.5412343607305936, + "terminal_packet": 0.6063953196347033, + "velocity_flow": 0.6936780821917807, + "velocity_packet": 0.3963686073059361, + "velocity_total": 0.7068705479452055 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicddos2019.log b/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicddos2019.log new file mode 100644 index 0000000..326a4ed --- /dev/null +++ b/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicddos2019.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=52 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 8,993,376 target rows; label distribution top: + Syn 1,495,248 + NetBIOS 702,760 + UDP 611,999 + MSSQL 523,845 + LDAP 509,665 +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 19.6s +[eval] scoring attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done in 18.5s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicddos2019.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicddos2019.npz + +=== overall AUROC top-10 === + velocity_total AUROC=0.8999 AUPRC=0.9039 + velocity_packet AUROC=0.8881 AUPRC=0.8762 + curvature_packet AUROC=0.8803 AUPRC=0.9141 + packet_consistency AUROC=0.8070 AUPRC=0.7824 + arc_length AUROC=0.8064 AUPRC=0.7853 + kinetic_energy AUROC=0.8038 AUPRC=0.7810 + curvature_total AUROC=0.7273 AUPRC=0.7049 + kinetic_packet AUROC=0.7176 AUPRC=0.6895 + consistency_total AUROC=0.6960 AUPRC=0.5794 + kinetic_flow AUROC=0.6888 AUPRC=0.5578 diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicddos2019.npz new file mode 100644 index 0000000..168675b Binary files /dev/null and b/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicids2017.json b/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicids2017.json new file mode 100644 index 0000000..c910410 --- /dev/null +++ b/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicids2017.json @@ -0,0 +1,740 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 36, + "overall": { + "arc_length": { + "auroc": 0.6387389988186651, + "auprc": 0.6013932763322701 + }, + "causal_surprisal_flow": { + "auroc": 0.5052128617838159, + "auprc": 0.4403691687756337 + }, + "causal_surprisal_packet_max": { + "auroc": 0.6172108904311873, + "auprc": 0.4504714406741245 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.552891531305375, + "auprc": 0.4758734783113324 + }, + "causal_surprisal_packet_median": { + "auroc": 0.5476231024808034, + "auprc": 0.5170350422845911 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.460408970761961, + "auprc": 0.46165616069311194 + }, + "causal_surprisal_total": { + "auroc": 0.41008801683402246, + "auprc": 0.3344835677407111 + }, + "consistency_total": { + "auroc": 0.7218725930301241, + "auprc": 0.5451594251873446 + }, + "curvature_flow": { + "auroc": 0.3167511075014766, + "auprc": 0.30364113008981175 + }, + "curvature_packet": { + "auroc": 0.6028919152392203, + "auprc": 0.4516760257594111 + }, + "curvature_total": { + "auroc": 0.47992477849970466, + "auprc": 0.3609982775445621 + }, + "direction_drift_flow": { + "auroc": 0.27688827525103366, + "auprc": 0.2862134301747715 + }, + "direction_drift_packet_max": { + "auroc": 0.6593273995865327, + "auprc": 0.5611528435969386 + }, + "direction_drift_packet_mean": { + "auroc": 0.6041870717660957, + "auprc": 0.4898090947172533 + }, + "direction_drift_packet_median": { + "auroc": 0.5864938422917897, + "auprc": 0.4558361983311487 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.5756514102185469, + "auprc": 0.45061363919483105 + }, + "direction_drift_total": { + "auroc": 0.6107492321323096, + "auprc": 0.5601369638100568 + }, + "flow_consistency": { + "auroc": 0.6949828189604251, + "auprc": 0.5267371491259409 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.30306509893679856, + "auprc": 0.29362305684009465 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.29945930301240403, + "auprc": 0.29256971489971684 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.28088231689308923, + "auprc": 0.28680322292486693 + }, + "kinetic_energy": { + "auroc": 0.6324151137034849, + "auprc": 0.5991876784526128 + }, + "kinetic_flow": { + "auroc": 0.7423553676904903, + "auprc": 0.5538856931754246 + }, + "kinetic_packet": { + "auroc": 0.6924752731836975, + "auprc": 0.6292380135123959 + }, + "packet_consistency": { + "auroc": 0.7473014249852333, + "auprc": 0.5197873185961662 + }, + "pna_flow": { + "auroc": 0.26544091110454815, + "auprc": 0.28346207711025606 + }, + "pna_packet_max": { + "auroc": 0.4231305005906675, + "auprc": 0.3631964473181023 + }, + "pna_packet_mean": { + "auroc": 0.30306509893679856, + "auprc": 0.29362305684009465 + }, + "pna_packet_median": { + "auroc": 0.29945930301240403, + "auprc": 0.29256971489971684 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.28088231689308923, + "auprc": 0.28680322292486693 + }, + "terminal_flow": { + "auroc": 0.7373330773774366, + "auprc": 0.5497231972301686 + }, + "terminal_norm": { + "auroc": 0.7345055522740698, + "auprc": 0.6534101092379284 + }, + "terminal_packet": { + "auroc": 0.7161983904311873, + "auprc": 0.6609041238713689 + }, + "velocity_flow": { + "auroc": 0.7298246308328411, + "auprc": 0.5486515176586676 + }, + "velocity_packet": { + "auroc": 0.7335781896042528, + "auprc": 0.5200402541703372 + }, + "velocity_total": { + "auroc": 0.7030718325457768, + "auprc": 0.5961188504282653 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "arc_length": 0.8019506756756757, + "causal_surprisal_flow": 0.9747630630630632, + "causal_surprisal_packet_max": 0.5004783783783784, + "causal_surprisal_packet_mean": 0.2751081081081081, + "causal_surprisal_packet_median": 0.21711471471471472, + "causal_surprisal_packet_trimmed10_mean": 0.10318783783783783, + "causal_surprisal_total": 0.8617993993993994, + "consistency_total": 0.6654822822822823, + "curvature_flow": 0.12612072072072072, + "curvature_packet": 0.8065478978978978, + "curvature_total": 0.6044060810810812, + "direction_drift_flow": 0.5716856606606606, + "direction_drift_packet_max": 0.9371033033033034, + "direction_drift_packet_mean": 0.9291657657657657, + "direction_drift_packet_median": 0.8473483483483484, + "direction_drift_packet_trimmed10_mean": 0.8320069069069069, + "direction_drift_total": 0.9570586336336335, + "flow_consistency": 0.5992804804804805, + "kappa2_speed2norm_packet_mean": 0.666051126126126, + "kappa2_speed2norm_packet_median": 0.6231445945945946, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5957807057057056, + "kinetic_energy": 0.8123421171171171, + "kinetic_flow": 0.47739744744744744, + "kinetic_packet": 0.9024603603603604, + "packet_consistency": 0.7374982732732731, + "pna_flow": 0.18323693693693693, + "pna_packet_max": 0.7516778528528529, + "pna_packet_mean": 0.666051126126126, + "pna_packet_median": 0.6231445945945946, + "pna_packet_trimmed10_mean": 0.5957807057057056, + "terminal_flow": 0.7421593093093094, + "terminal_norm": 0.7999327327327328, + "terminal_packet": 0.8901577327327328, + "velocity_flow": 0.4449068318318318, + "velocity_packet": 0.6914168168168169, + "velocity_total": 0.4282177177177177 + }, + "DDoS": { + "_n": 666.0, + "arc_length": 0.8020890390390388, + "causal_surprisal_flow": 0.3764118618618618, + "causal_surprisal_packet_max": 0.6238387387387387, + "causal_surprisal_packet_mean": 0.5650190690690691, + "causal_surprisal_packet_median": 0.6121518018018018, + "causal_surprisal_packet_trimmed10_mean": 0.40758941441441443, + "causal_surprisal_total": 0.23464984984984988, + "consistency_total": 0.720578003003003, + "curvature_flow": 0.17622199699699698, + "curvature_packet": 0.8025765765765766, + "curvature_total": 0.6447834834834836, + "direction_drift_flow": 0.32425180180180185, + "direction_drift_packet_max": 0.7652052552552553, + "direction_drift_packet_mean": 0.7105111111111111, + "direction_drift_packet_median": 0.6892628378378379, + "direction_drift_packet_trimmed10_mean": 0.6562177177177176, + "direction_drift_total": 0.8188460960960962, + "flow_consistency": 0.6369321321321322, + "kappa2_speed2norm_packet_mean": 0.39338573573573576, + "kappa2_speed2norm_packet_median": 0.41075487987987985, + "kappa2_speed2norm_packet_trimmed10_mean": 0.34460585585585585, + "kinetic_energy": 0.8002674924924925, + "kinetic_flow": 0.7091835585585585, + "kinetic_packet": 0.873010885885886, + "packet_consistency": 0.8156587087087086, + "pna_flow": 0.14962755255255256, + "pna_packet_max": 0.5554515765765766, + "pna_packet_mean": 0.39338573573573576, + "pna_packet_median": 0.41075487987987985, + "pna_packet_trimmed10_mean": 0.34460585585585585, + "terminal_flow": 0.8107073573573572, + "terminal_norm": 0.8893437687687689, + "terminal_packet": 0.9228453453453453, + "velocity_flow": 0.674439039039039, + "velocity_packet": 0.8095124624624624, + "velocity_total": 0.6943717717717718 + }, + "DoS GoldenEye": { + "_n": 666.0, + "arc_length": 0.5188735735735736, + "causal_surprisal_flow": 0.3360220720720721, + "causal_surprisal_packet_max": 0.6822695195195196, + "causal_surprisal_packet_mean": 0.68749009009009, + "causal_surprisal_packet_median": 0.7406405405405404, + "causal_surprisal_packet_trimmed10_mean": 0.6510382882882884, + "causal_surprisal_total": 0.2616448198198198, + "consistency_total": 0.6807304804804806, + "curvature_flow": 0.05049924924924925, + "curvature_packet": 0.7529736486486486, + "curvature_total": 0.6092635135135136, + "direction_drift_flow": 0.2657072822822823, + "direction_drift_packet_max": 0.6777525525525525, + "direction_drift_packet_mean": 0.5828814564564565, + "direction_drift_packet_median": 0.5696475975975976, + "direction_drift_packet_trimmed10_mean": 0.5554512012012012, + "direction_drift_total": 0.7083597597597598, + "flow_consistency": 0.6271701201201201, + "kappa2_speed2norm_packet_mean": 0.28105540540540536, + "kappa2_speed2norm_packet_median": 0.29607590090090086, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2526496996996997, + "kinetic_energy": 0.5080124624624626, + "kinetic_flow": 0.7590235735735735, + "kinetic_packet": 0.578471021021021, + "packet_consistency": 0.7594343093093092, + "pna_flow": 0.05814234234234235, + "pna_packet_max": 0.45120555555555564, + "pna_packet_mean": 0.28105540540540536, + "pna_packet_median": 0.29607590090090086, + "pna_packet_trimmed10_mean": 0.2526496996996997, + "terminal_flow": 0.8460343093093092, + "terminal_norm": 0.7315464714714717, + "terminal_packet": 0.6426391891891892, + "velocity_flow": 0.7496566816816818, + "velocity_packet": 0.7783922672672672, + "velocity_total": 0.6893997747747747 + }, + "DoS Hulk": { + "_n": 666.0, + "arc_length": 0.4213095345345345, + "causal_surprisal_flow": 0.47293228228228223, + "causal_surprisal_packet_max": 0.6913460960960962, + "causal_surprisal_packet_mean": 0.7370256756756757, + "causal_surprisal_packet_median": 0.6629276276276276, + "causal_surprisal_packet_trimmed10_mean": 0.6725026276276276, + "causal_surprisal_total": 0.3677187687687688, + "consistency_total": 0.8055916666666667, + "curvature_flow": 0.1578942192192192, + "curvature_packet": 0.7143623873873874, + "curvature_total": 0.5841672672672673, + "direction_drift_flow": 0.32736096096096096, + "direction_drift_packet_max": 0.7175681681681682, + "direction_drift_packet_mean": 0.5441677927927928, + "direction_drift_packet_median": 0.5451654654654654, + "direction_drift_packet_trimmed10_mean": 0.48980570570570575, + "direction_drift_total": 0.6507783033033032, + "flow_consistency": 0.7506216216216217, + "kappa2_speed2norm_packet_mean": 0.33016696696696696, + "kappa2_speed2norm_packet_median": 0.3037503753753754, + "kappa2_speed2norm_packet_trimmed10_mean": 0.26840510510510507, + "kinetic_energy": 0.41142439939939934, + "kinetic_flow": 0.67723003003003, + "kinetic_packet": 0.5306381381381381, + "packet_consistency": 0.8697896396396397, + "pna_flow": 0.18324789789789792, + "pna_packet_max": 0.570692042042042, + "pna_packet_mean": 0.33016696696696696, + "pna_packet_median": 0.3037503753753754, + "pna_packet_trimmed10_mean": 0.26840510510510507, + "terminal_flow": 0.7912825825825827, + "terminal_norm": 0.617825900900901, + "terminal_packet": 0.5536562312312312, + "velocity_flow": 0.6541594594594594, + "velocity_packet": 0.8787839339339341, + "velocity_total": 0.7411014264264265 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "arc_length": 0.7124335585585585, + "causal_surprisal_flow": 0.5383331831831832, + "causal_surprisal_packet_max": 0.6053996996996998, + "causal_surprisal_packet_mean": 0.6631369369369369, + "causal_surprisal_packet_median": 0.7574304804804803, + "causal_surprisal_packet_trimmed10_mean": 0.6140454954954955, + "causal_surprisal_total": 0.5115255255255255, + "consistency_total": 0.704666966966967, + "curvature_flow": 0.2720990990990991, + "curvature_packet": 0.7115637387387387, + "curvature_total": 0.573974024024024, + "direction_drift_flow": 0.22538445945945948, + "direction_drift_packet_max": 0.667025900900901, + "direction_drift_packet_mean": 0.5032034534534535, + "direction_drift_packet_median": 0.45957920420420423, + "direction_drift_packet_trimmed10_mean": 0.44340360360360365, + "direction_drift_total": 0.561715915915916, + "flow_consistency": 0.6952906156156157, + "kappa2_speed2norm_packet_mean": 0.22018258258258258, + "kappa2_speed2norm_packet_median": 0.20029286786786787, + "kappa2_speed2norm_packet_trimmed10_mean": 0.1721786036036036, + "kinetic_energy": 0.7015446696696696, + "kinetic_flow": 0.8008366366366366, + "kinetic_packet": 0.6920878378378379, + "packet_consistency": 0.7426776276276277, + "pna_flow": 0.15293836336336336, + "pna_packet_max": 0.36395082582582583, + "pna_packet_mean": 0.22018258258258258, + "pna_packet_median": 0.20029286786786787, + "pna_packet_trimmed10_mean": 0.1721786036036036, + "terminal_flow": 0.8542091591591592, + "terminal_norm": 0.8380522522522523, + "terminal_packet": 0.7309316816816817, + "velocity_flow": 0.7942069069069069, + "velocity_packet": 0.768435960960961, + "velocity_total": 0.8241388888888889 + }, + "DoS Slowloris": { + "_n": 666.0, + "arc_length": 0.6524987237237238, + "causal_surprisal_flow": 0.4005295795795796, + "causal_surprisal_packet_max": 0.6673561561561561, + "causal_surprisal_packet_mean": 0.7426451201201201, + "causal_surprisal_packet_median": 0.7654758258258259, + "causal_surprisal_packet_trimmed10_mean": 0.7041091591591592, + "causal_surprisal_total": 0.6104227477477479, + "consistency_total": 0.7820316816816817, + "curvature_flow": 0.24681441441441443, + "curvature_packet": 0.5551234234234235, + "curvature_total": 0.4762996246246246, + "direction_drift_flow": 0.1675258258258258, + "direction_drift_packet_max": 0.5141126876876877, + "direction_drift_packet_mean": 0.3389593093093093, + "direction_drift_packet_median": 0.3076378378378378, + "direction_drift_packet_trimmed10_mean": 0.29656013513513513, + "direction_drift_total": 0.27805765765765766, + "flow_consistency": 0.7867282282282281, + "kappa2_speed2norm_packet_mean": 0.16461201201201203, + "kappa2_speed2norm_packet_median": 0.16598018018018018, + "kappa2_speed2norm_packet_trimmed10_mean": 0.15631726726726727, + "kinetic_energy": 0.6409351351351351, + "kinetic_flow": 0.8182400900900901, + "kinetic_packet": 0.639896021021021, + "packet_consistency": 0.6826064564564565, + "pna_flow": 0.19578603603603606, + "pna_packet_max": 0.15091981981981983, + "pna_packet_mean": 0.16461201201201203, + "pna_packet_median": 0.16598018018018018, + "pna_packet_trimmed10_mean": 0.15631726726726727, + "terminal_flow": 0.7907566066066066, + "terminal_norm": 0.7711803303303304, + "terminal_packet": 0.6460045795795796, + "velocity_flow": 0.8097478978978979, + "velocity_packet": 0.7103320570570569, + "velocity_total": 0.8562814564564566 + }, + "FTP-Patator": { + "_n": 666.0, + "arc_length": 0.2585987237237237, + "causal_surprisal_flow": 0.9289869369369368, + "causal_surprisal_packet_max": 0.7207462462462462, + "causal_surprisal_packet_mean": 0.2492487987987988, + "causal_surprisal_packet_median": 0.049684984984984984, + "causal_surprisal_packet_trimmed10_mean": 0.0428966966966967, + "causal_surprisal_total": 0.411290990990991, + "consistency_total": 0.8950307807807807, + "curvature_flow": 0.6506037537537537, + "curvature_packet": 0.6227927177177177, + "curvature_total": 0.5904992492492492, + "direction_drift_flow": 0.19896824324324322, + "direction_drift_packet_max": 0.8948456456456456, + "direction_drift_packet_mean": 0.8490355105105104, + "direction_drift_packet_median": 0.794490015015015, + "direction_drift_packet_trimmed10_mean": 0.8166156156156155, + "direction_drift_total": 0.9616298048048049, + "flow_consistency": 0.903123048048048, + "kappa2_speed2norm_packet_mean": 0.5505649399399399, + "kappa2_speed2norm_packet_median": 0.5352912162162162, + "kappa2_speed2norm_packet_trimmed10_mean": 0.553803003003003, + "kinetic_energy": 0.2478162912912913, + "kinetic_flow": 0.7955000750750751, + "kinetic_packet": 0.4240152402402402, + "packet_consistency": 0.7237096096096096, + "pna_flow": 0.5685451951951952, + "pna_packet_max": 0.7290455705705705, + "pna_packet_mean": 0.5505649399399399, + "pna_packet_median": 0.5352912162162162, + "pna_packet_trimmed10_mean": 0.553803003003003, + "terminal_flow": 0.8255824324324325, + "terminal_norm": 0.4855351351351351, + "terminal_packet": 0.4794207207207207, + "velocity_flow": 0.8407735735735736, + "velocity_packet": 0.5262402402402403, + "velocity_total": 0.3638187687687688 + }, + "Heartbleed": { + "_n": 1.0, + "arc_length": 0.47330000000000005, + "causal_surprisal_flow": 0.25970000000000004, + "causal_surprisal_packet_max": 0.9717, + "causal_surprisal_packet_mean": 0.9007000000000001, + "causal_surprisal_packet_median": 0.7417, + "causal_surprisal_packet_trimmed10_mean": 0.8764, + "causal_surprisal_total": 0.37029999999999996, + "consistency_total": 0.8867999999999999, + "curvature_flow": 0.5841000000000001, + "curvature_packet": 0.7107, + "curvature_total": 0.6556000000000001, + "direction_drift_flow": 0.0014999999999999458, + "direction_drift_packet_max": 0.7021999999999999, + "direction_drift_packet_mean": 0.29359999999999997, + "direction_drift_packet_median": 0.3198, + "direction_drift_packet_trimmed10_mean": 0.3034, + "direction_drift_total": 0.46409999999999996, + "flow_consistency": 0.864, + "kappa2_speed2norm_packet_mean": 0.1713, + "kappa2_speed2norm_packet_median": 0.19520000000000004, + "kappa2_speed2norm_packet_trimmed10_mean": 0.15900000000000003, + "kinetic_energy": 0.4608, + "kinetic_flow": 0.9928, + "kinetic_packet": 0.44079999999999997, + "packet_consistency": 0.9574, + "pna_flow": 0.01419999999999999, + "pna_packet_max": 0.6104999999999999, + "pna_packet_mean": 0.1713, + "pna_packet_median": 0.19520000000000004, + "pna_packet_trimmed10_mean": 0.15900000000000003, + "terminal_flow": 0.9615, + "terminal_norm": 0.35129999999999995, + "terminal_packet": 0.2884, + "velocity_flow": 0.9878, + "velocity_packet": 0.9695, + "velocity_total": 0.9453 + }, + "Infiltration": { + "_n": 7.0, + "arc_length": 0.8105285714285714, + "causal_surprisal_flow": 0.33822857142857143, + "causal_surprisal_packet_max": 0.9195428571428571, + "causal_surprisal_packet_mean": 0.764, + "causal_surprisal_packet_median": 0.5080857142857143, + "causal_surprisal_packet_trimmed10_mean": 0.5394857142857142, + "causal_surprisal_total": 0.23191428571428568, + "consistency_total": 0.8709428571428571, + "curvature_flow": 0.6911714285714285, + "curvature_packet": 0.7945714285714286, + "curvature_total": 0.6970999999999999, + "direction_drift_flow": 0.08164285714285714, + "direction_drift_packet_max": 0.7920571428571428, + "direction_drift_packet_mean": 0.6909142857142857, + "direction_drift_packet_median": 0.6738285714285714, + "direction_drift_packet_trimmed10_mean": 0.6770285714285714, + "direction_drift_total": 0.7305428571428572, + "flow_consistency": 0.8600142857142857, + "kappa2_speed2norm_packet_mean": 0.5885857142857143, + "kappa2_speed2norm_packet_median": 0.5787714285714285, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5757714285714286, + "kinetic_energy": 0.8087142857142857, + "kinetic_flow": 0.9234142857142857, + "kinetic_packet": 0.7945, + "packet_consistency": 0.8477857142857143, + "pna_flow": 0.3690857142857143, + "pna_packet_max": 0.7794142857142857, + "pna_packet_mean": 0.5885857142857143, + "pna_packet_median": 0.5787714285714285, + "pna_packet_trimmed10_mean": 0.5757714285714286, + "terminal_flow": 0.8711714285714285, + "terminal_norm": 0.6646142857142857, + "terminal_packet": 0.7354285714285714, + "velocity_flow": 0.9205714285714286, + "velocity_packet": 0.7565, + "velocity_total": 0.7437285714285714 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "arc_length": 0.990534084084084, + "causal_surprisal_flow": 0.13227402402402402, + "causal_surprisal_packet_max": 0.20229819819819822, + "causal_surprisal_packet_mean": 0.37008130630630637, + "causal_surprisal_packet_median": 0.7010239489489489, + "causal_surprisal_packet_trimmed10_mean": 0.45813746246246245, + "causal_surprisal_total": 0.3106181681681682, + "consistency_total": 0.5685288288288288, + "curvature_flow": 0.1538918918918919, + "curvature_packet": 0.26974879879879876, + "curvature_total": 0.041768318318318315, + "direction_drift_flow": 0.33185112612612616, + "direction_drift_packet_max": 0.32242237237237237, + "direction_drift_packet_mean": 0.5491947447447447, + "direction_drift_packet_median": 0.5779591591591592, + "direction_drift_packet_trimmed10_mean": 0.5808697447447447, + "direction_drift_total": 0.22056193693693693, + "flow_consistency": 0.55176493993994, + "kappa2_speed2norm_packet_mean": 0.02605315315315315, + "kappa2_speed2norm_packet_median": 0.032393093093093094, + "kappa2_speed2norm_packet_trimmed10_mean": 0.027368468468468462, + "kinetic_energy": 0.9905037537537538, + "kinetic_flow": 0.6928451951951952, + "kinetic_packet": 0.9814321321321322, + "packet_consistency": 0.7148053303303304, + "pna_flow": 0.14906576576576575, + "pna_packet_max": 0.02683198198198198, + "pna_packet_mean": 0.02605315315315315, + "pna_packet_median": 0.032393093093093094, + "pna_packet_trimmed10_mean": 0.027368468468468462, + "terminal_flow": 0.48499294294294293, + "terminal_norm": 0.9882687687687688, + "terminal_packet": 0.993427927927928, + "velocity_flow": 0.6669984984984985, + "velocity_packet": 0.7265737237237238, + "velocity_total": 0.9670250750750751 + }, + "Portscan": { + "_n": 666.0, + "arc_length": 0.9937765765765767, + "causal_surprisal_flow": 0.23786261261261263, + "causal_surprisal_packet_max": 0.5801813063063063, + "causal_surprisal_packet_mean": 0.7793039039039039, + "causal_surprisal_packet_median": 0.9146117117117117, + "causal_surprisal_packet_trimmed10_mean": 0.8674312312312313, + "causal_surprisal_total": 0.5448924174174173, + "consistency_total": 0.45189084084084086, + "curvature_flow": 0.45282372372372376, + "curvature_packet": 0.28904294294294297, + "curvature_total": 0.12694774774774775, + "direction_drift_flow": 0.34828888888888887, + "direction_drift_packet_max": 0.179346996996997, + "direction_drift_packet_mean": 0.29267822822822825, + "direction_drift_packet_median": 0.3308472222222222, + "direction_drift_packet_trimmed10_mean": 0.3231777027027027, + "direction_drift_total": 0.03984474474474474, + "flow_consistency": 0.45056966966966966, + "kappa2_speed2norm_packet_mean": 0.012627777777777772, + "kappa2_speed2norm_packet_median": 0.015082882882882882, + "kappa2_speed2norm_packet_trimmed10_mean": 0.013323423423423415, + "kinetic_energy": 0.9937306306306306, + "kinetic_flow": 0.6961975225225224, + "kinetic_packet": 0.9904516516516517, + "packet_consistency": 0.7588794294294294, + "pna_flow": 0.48616313813813816, + "pna_packet_max": 0.018054354354354357, + "pna_packet_mean": 0.012627777777777772, + "pna_packet_median": 0.015082882882882882, + "pna_packet_trimmed10_mean": 0.013323423423423415, + "terminal_flow": 0.3601543543543544, + "terminal_norm": 0.9878481981981981, + "terminal_packet": 0.9954963963963964, + "velocity_flow": 0.6635465465465465, + "velocity_packet": 0.7704219219219219, + "velocity_total": 0.9891163663663664 + }, + "SSH-Patator": { + "_n": 666.0, + "arc_length": 0.2506854354354354, + "causal_surprisal_flow": 0.6844834834834834, + "causal_surprisal_packet_max": 0.8548268768768769, + "causal_surprisal_packet_mean": 0.42732034534534535, + "causal_surprisal_packet_median": 0.05534624624624625, + "causal_surprisal_packet_trimmed10_mean": 0.060541891891891894, + "causal_surprisal_total": 0.016742342342342346, + "consistency_total": 0.9337330330330329, + "curvature_flow": 0.8104325825825826, + "curvature_packet": 0.536290015015015, + "curvature_total": 0.5587833333333334, + "direction_drift_flow": 0.046915990990990995, + "direction_drift_packet_max": 0.9068141891891891, + "direction_drift_packet_mean": 0.8036135135135135, + "direction_drift_packet_median": 0.8071442942942944, + "direction_drift_packet_trimmed10_mean": 0.824098948948949, + "direction_drift_total": 0.9597578078078078, + "flow_consistency": 0.9430213213213213, + "kappa2_speed2norm_packet_mean": 0.4217846096096096, + "kappa2_speed2norm_packet_median": 0.4484518768768769, + "kappa2_speed2norm_packet_trimmed10_mean": 0.45770623123123116, + "kinetic_energy": 0.23414354354354353, + "kinetic_flow": 0.9609243243243243, + "kinetic_packet": 0.35753393393393396, + "packet_consistency": 0.6481974474474475, + "pna_flow": 0.5505836336336337, + "pna_packet_max": 0.6450470720720721, + "pna_packet_mean": 0.4217846096096096, + "pna_packet_median": 0.4484518768768769, + "pna_packet_trimmed10_mean": 0.45770623123123116, + "terminal_flow": 0.8620516516516517, + "terminal_norm": 0.31243025525525525, + "terminal_packet": 0.37071223723723723, + "velocity_flow": 0.9619415915915915, + "velocity_packet": 0.644035960960961, + "velocity_total": 0.44403055555555554 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "arc_length": 0.5105465753424658, + "causal_surprisal_flow": 0.28607534246575345, + "causal_surprisal_packet_max": 0.9460643835616439, + "causal_surprisal_packet_mean": 0.8134123287671233, + "causal_surprisal_packet_median": 0.5706068493150686, + "causal_surprisal_packet_trimmed10_mean": 0.6531178082191781, + "causal_surprisal_total": 0.20322465753424657, + "consistency_total": 0.8180191780821918, + "curvature_flow": 0.836045205479452, + "curvature_packet": 0.32813972602739727, + "curvature_total": 0.36531506849315065, + "direction_drift_flow": 0.000946575342465754, + "direction_drift_packet_max": 0.7586356164383562, + "direction_drift_packet_mean": 0.18067671232876714, + "direction_drift_packet_median": 0.12296849315068493, + "direction_drift_packet_trimmed10_mean": 0.15843561643835616, + "direction_drift_total": 0.2874082191780822, + "flow_consistency": 0.7706630136986301, + "kappa2_speed2norm_packet_mean": 0.021935616438356172, + "kappa2_speed2norm_packet_median": 0.028999999999999998, + "kappa2_speed2norm_packet_trimmed10_mean": 0.022046575342465756, + "kinetic_energy": 0.49521232876712323, + "kinetic_flow": 0.9987260273972602, + "kinetic_packet": 0.3531890410958904, + "packet_consistency": 0.8680273972602739, + "pna_flow": 0.13203013698630137, + "pna_packet_max": 0.17525342465753424, + "pna_packet_mean": 0.021935616438356172, + "pna_packet_median": 0.028999999999999998, + "pna_packet_trimmed10_mean": 0.022046575342465756, + "terminal_flow": 0.7526684931506848, + "terminal_norm": 0.16486712328767122, + "terminal_packet": 0.26622465753424657, + "velocity_flow": 0.9990602739726028, + "velocity_packet": 0.9441493150684931, + "velocity_total": 0.9397191780821917 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "arc_length": 0.65255, + "causal_surprisal_flow": 0.6092153846153846, + "causal_surprisal_packet_max": 0.3597076923076923, + "causal_surprisal_packet_mean": 0.2491153846153846, + "causal_surprisal_packet_median": 0.32264615384615386, + "causal_surprisal_packet_trimmed10_mean": 0.1453923076923077, + "causal_surprisal_total": 0.3986461538461539, + "consistency_total": 0.5123, + "curvature_flow": 0.10235384615384616, + "curvature_packet": 0.7820615384615385, + "curvature_total": 0.6003846153846154, + "direction_drift_flow": 0.3351615384615385, + "direction_drift_packet_max": 0.7571, + "direction_drift_packet_mean": 0.5148230769230769, + "direction_drift_packet_median": 0.4984692307692308, + "direction_drift_packet_trimmed10_mean": 0.4110153846153846, + "direction_drift_total": 0.569176923076923, + "flow_consistency": 0.4923153846153846, + "kappa2_speed2norm_packet_mean": 0.3083, + "kappa2_speed2norm_packet_median": 0.19691538461538463, + "kappa2_speed2norm_packet_trimmed10_mean": 0.25401538461538464, + "kinetic_energy": 0.6467153846153846, + "kinetic_flow": 0.6825230769230769, + "kinetic_packet": 0.7198230769230769, + "packet_consistency": 0.7813923076923077, + "pna_flow": 0.1299846153846154, + "pna_packet_max": 0.4194692307692308, + "pna_packet_mean": 0.3083, + "pna_packet_median": 0.19691538461538463, + "pna_packet_trimmed10_mean": 0.25401538461538464, + "terminal_flow": 0.8397615384615384, + "terminal_norm": 0.8862153846153846, + "terminal_packet": 0.7355076923076923, + "velocity_flow": 0.6614, + "velocity_packet": 0.8031769230769231, + "velocity_total": 0.6703576923076924 + }, + "Web Attack - XSS": { + "_n": 18.0, + "arc_length": 0.5227222222222222, + "causal_surprisal_flow": 0.2699944444444444, + "causal_surprisal_packet_max": 0.9368388888888889, + "causal_surprisal_packet_mean": 0.818138888888889, + "causal_surprisal_packet_median": 0.6149444444444445, + "causal_surprisal_packet_trimmed10_mean": 0.6890722222222223, + "causal_surprisal_total": 0.20307777777777775, + "consistency_total": 0.803238888888889, + "curvature_flow": 0.7991555555555555, + "curvature_packet": 0.3194222222222222, + "curvature_total": 0.33265555555555554, + "direction_drift_flow": 0.0, + "direction_drift_packet_max": 0.5418111111111111, + "direction_drift_packet_mean": 0.09283888888888889, + "direction_drift_packet_median": 0.13746111111111112, + "direction_drift_packet_trimmed10_mean": 0.07965, + "direction_drift_total": 0.09628333333333333, + "flow_consistency": 0.6579222222222222, + "kappa2_speed2norm_packet_mean": 0.009872222222222227, + "kappa2_speed2norm_packet_median": 0.012433333333333327, + "kappa2_speed2norm_packet_trimmed10_mean": 0.009438888888888886, + "kinetic_energy": 0.5064277777777778, + "kinetic_flow": 1.0, + "kinetic_packet": 0.3489777777777778, + "packet_consistency": 0.9133444444444445, + "pna_flow": 0.029649999999999996, + "pna_packet_max": 0.1139388888888889, + "pna_packet_mean": 0.009872222222222227, + "pna_packet_median": 0.012433333333333327, + "pna_packet_trimmed10_mean": 0.009438888888888886, + "terminal_flow": 0.7364638888888888, + "terminal_norm": 0.138, + "terminal_packet": 0.20103333333333334, + "velocity_flow": 0.9999944444444444, + "velocity_packet": 0.9778611111111112, + "velocity_total": 0.9667055555555555 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicids2017.log b/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicids2017.log new file mode 100644 index 0000000..b681a64 --- /dev/null +++ b/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicids2017.log @@ -0,0 +1,33 @@ +[model] T=64 flow_dim=52 packet_dim=9 preprocess=mixed_dequant +[model] flow_features in checkpoint order: ['log_duration', 'log_n_pkts', 'fwd_count', 'bwd_count', 'pkt_size_mean']... +[data] 2,025,564 target rows; label distribution top: + normal 1,521,748 + Portscan 159,040 + DoS Hulk 158,454 + DDoS 95,144 + Infiltration - Portscan 71,714 +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] scoring benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done in 19.8s +[eval] scoring attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done in 13.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicids2017.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicids2017.npz + +=== overall AUROC top-10 === + packet_consistency AUROC=0.7473 AUPRC=0.5198 + kinetic_flow AUROC=0.7424 AUPRC=0.5539 + terminal_flow AUROC=0.7373 AUPRC=0.5497 + terminal_norm AUROC=0.7345 AUPRC=0.6534 + velocity_packet AUROC=0.7336 AUPRC=0.5200 + velocity_flow AUROC=0.7298 AUPRC=0.5487 + consistency_total AUROC=0.7219 AUPRC=0.5452 + terminal_packet AUROC=0.7162 AUPRC=0.6609 + velocity_total AUROC=0.7031 AUPRC=0.5961 + flow_consistency AUROC=0.6950 AUPRC=0.5267 diff --git a/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicids2017.npz b/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicids2017.npz new file mode 100644 index 0000000..22fc979 Binary files /dev/null and b/artifacts/route_comparison/cross/route_b_spectral_seed44_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicddos2019.json b/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicddos2019.json new file mode 100644 index 0000000..22e038c --- /dev/null +++ b/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicddos2019.json @@ -0,0 +1,272 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.07549721206581354, + "auprc": 0.3195565134435567 + }, + "disc_nll_ch3": { + "auroc": 0.20635896303067233, + "auprc": 0.42343158973790135 + }, + "disc_nll_ch4": { + "auroc": 0.4237486187284176, + "auprc": 0.4246919154709915 + }, + "disc_nll_ch5": { + "auroc": 0.28788396810887673, + "auprc": 0.3784199008885237 + }, + "disc_nll_ch6": { + "auroc": 0.4367930073126142, + "auprc": 0.42335890309045154 + }, + "disc_nll_ch7": { + "auroc": 0.8619911690026407, + "auprc": 0.8461281992232323 + }, + "disc_nll_total": { + "auroc": 0.3802145135080235, + "auprc": 0.4698418456217444 + }, + "terminal_flow": { + "auroc": 0.8301189112329881, + "auprc": 0.7199648180048869 + }, + "terminal_norm": { + "auroc": 0.8317994363193175, + "auprc": 0.772129755643053 + }, + "terminal_packet": { + "auroc": 0.6859151025797279, + "auprc": 0.6406556740383095 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "disc_nll_ch2": 0.02972619047619051, + "disc_nll_ch3": 0.0012105442176870264, + "disc_nll_ch4": 0.3873994897959184, + "disc_nll_ch5": 0.043940476190476176, + "disc_nll_ch6": 0.42599540816326525, + "disc_nll_ch7": 0.9612366496598639, + "disc_nll_total": 0.3679606292517007, + "terminal_flow": 0.9085509353741497, + "terminal_norm": 0.9543112244897958, + "terminal_packet": 0.8563343537414967 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.026448979591836768, + "disc_nll_ch3": 0.0009719387755101525, + "disc_nll_ch4": 0.3858503401360544, + "disc_nll_ch5": 0.0164095238095238, + "disc_nll_ch6": 0.4252826530612244, + "disc_nll_ch7": 0.9655345238095238, + "disc_nll_total": 0.371959693877551, + "terminal_flow": 0.9144139455782314, + "terminal_norm": 0.958040306122449, + "terminal_packet": 0.8672904761904763 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.04437534013605442, + "disc_nll_ch3": 0.0010545918367346634, + "disc_nll_ch4": 0.40153503401360546, + "disc_nll_ch5": 0.37735884353741495, + "disc_nll_ch6": 0.4384920068027211, + "disc_nll_ch7": 0.9334219387755103, + "disc_nll_total": 0.361481462585034, + "terminal_flow": 0.859523469387755, + "terminal_norm": 0.9143496598639455, + "terminal_packet": 0.7405232993197279 + }, + "DrDoS_NTP": { + "_n": 588.0, + "disc_nll_ch2": 0.016172448979591827, + "disc_nll_ch3": 0.3362812925170068, + "disc_nll_ch4": 0.282581037414966, + "disc_nll_ch5": 0.040067687074829925, + "disc_nll_ch6": 0.2626671768707483, + "disc_nll_ch7": 0.5647746598639456, + "disc_nll_total": 0.035320918367346923, + "terminal_flow": 0.8936789115646259, + "terminal_norm": 0.4355251700680272, + "terminal_packet": 0.43092244897959187 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.05648129251700683, + "disc_nll_ch3": 0.0004613945578230824, + "disc_nll_ch4": 0.43730238095238094, + "disc_nll_ch5": 0.430801700680272, + "disc_nll_ch6": 0.4400433673469388, + "disc_nll_ch7": 0.9284658163265305, + "disc_nll_total": 0.3597365646258503, + "terminal_flow": 0.7320156462585035, + "terminal_norm": 0.8204062925170068, + "terminal_packet": 0.6390751700680273 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "disc_nll_ch2": 0.031114625850340173, + "disc_nll_ch3": 0.0004938775510203543, + "disc_nll_ch4": 0.3887044217687075, + "disc_nll_ch5": 0.039008673469387745, + "disc_nll_ch6": 0.42680136054421763, + "disc_nll_ch7": 0.9662122448979592, + "disc_nll_total": 0.3786001700680272, + "terminal_flow": 0.9036139455782313, + "terminal_norm": 0.9508724489795919, + "terminal_packet": 0.854397619047619 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "disc_nll_ch2": 0.03173554421768708, + "disc_nll_ch3": 0.17906904761904763, + "disc_nll_ch4": 0.27207176870748295, + "disc_nll_ch5": 0.21275187074829932, + "disc_nll_ch6": 0.4140350340136054, + "disc_nll_ch7": 0.7291591836734694, + "disc_nll_total": 0.19316479591836733, + "terminal_flow": 0.8000017006802721, + "terminal_norm": 0.737105612244898, + "terminal_packet": 0.483277380952381 + }, + "DrDoS_UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.03303996598639457, + "disc_nll_ch3": 0.1795659863945578, + "disc_nll_ch4": 0.27019081632653064, + "disc_nll_ch5": 0.2207287414965986, + "disc_nll_ch6": 0.4155596938775511, + "disc_nll_ch7": 0.7274357142857143, + "disc_nll_total": 0.1918445578231292, + "terminal_flow": 0.7979948979591837, + "terminal_norm": 0.7399357142857143, + "terminal_packet": 0.46436394557823135 + }, + "LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.02718418367346942, + "disc_nll_ch3": 0.002187755102040763, + "disc_nll_ch4": 0.38707295918367346, + "disc_nll_ch5": 0.018753741496598628, + "disc_nll_ch6": 0.42638078231292514, + "disc_nll_ch7": 0.9687989795918368, + "disc_nll_total": 0.3748585034013605, + "terminal_flow": 0.9148309523809525, + "terminal_norm": 0.9582001700680272, + "terminal_packet": 0.872156462585034 + }, + "MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.044558163265306115, + "disc_nll_ch3": 0.0003348639455782028, + "disc_nll_ch4": 0.4014654761904762, + "disc_nll_ch5": 0.3762600340136054, + "disc_nll_ch6": 0.43829829931972786, + "disc_nll_ch7": 0.9314418367346937, + "disc_nll_total": 0.35982772108843536, + "terminal_flow": 0.8573307823129251, + "terminal_norm": 0.9128829931972788, + "terminal_packet": 0.7313251700680272 + }, + "NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.0612011904761905, + "disc_nll_ch3": 0.00046326530612240626, + "disc_nll_ch4": 0.4350506802721088, + "disc_nll_ch5": 0.4180916666666667, + "disc_nll_ch6": 0.43897295918367346, + "disc_nll_ch7": 0.9191209183673469, + "disc_nll_total": 0.34903265306122444, + "terminal_flow": 0.7391401360544216, + "terminal_norm": 0.8239455782312926, + "terminal_packet": 0.6328965986394557 + }, + "Portmap": { + "_n": 588.0, + "disc_nll_ch2": 0.05657414965986397, + "disc_nll_ch3": 0.0038074829931972315, + "disc_nll_ch4": 0.4358481292517007, + "disc_nll_ch5": 0.4190636054421769, + "disc_nll_ch6": 0.4401996598639456, + "disc_nll_ch7": 0.9203829931972789, + "disc_nll_total": 0.35047789115646255, + "terminal_flow": 0.7372204081632654, + "terminal_norm": 0.8247632653061224, + "terminal_packet": 0.645977380952381 + }, + "Syn": { + "_n": 588.0, + "disc_nll_ch2": 0.2343794217687075, + "disc_nll_ch3": 0.9838363945578232, + "disc_nll_ch4": 0.7062748299319728, + "disc_nll_ch5": 0.7034744897959184, + "disc_nll_ch6": 0.5529260204081633, + "disc_nll_ch7": 0.9956416666666666, + "disc_nll_total": 0.9636273809523809, + "terminal_flow": 0.8771807823129251, + "terminal_norm": 0.9425153061224489, + "terminal_packet": 0.9794651360544218 + }, + "TFTP": { + "_n": 588.0, + "disc_nll_ch2": 0.024743197278911576, + "disc_nll_ch3": 0.22346258503401356, + "disc_nll_ch4": 0.3758197278911564, + "disc_nll_ch5": 0.18587312925170069, + "disc_nll_ch6": 0.3969428571428571, + "disc_nll_ch7": 0.7178715986394557, + "disc_nll_total": 0.17153299319727897, + "terminal_flow": 0.8772044217687074, + "terminal_norm": 0.8839904761904763, + "terminal_packet": 0.6301632653061225 + }, + "UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.03188877551020408, + "disc_nll_ch3": 0.1920181972789116, + "disc_nll_ch4": 0.2595134353741496, + "disc_nll_ch5": 0.20502227891156463, + "disc_nll_ch6": 0.41192806122448977, + "disc_nll_ch7": 0.7091760204081632, + "disc_nll_total": 0.17605544217687075, + "terminal_flow": 0.7978770408163265, + "terminal_norm": 0.7281920068027211, + "terminal_packet": 0.44959965986394557 + }, + "UDPLag": { + "_n": 588.0, + "disc_nll_ch2": 0.21401700680272112, + "disc_nll_ch3": 0.8952086734693877, + "disc_nll_ch4": 0.6563238095238095, + "disc_nll_ch5": 0.6099399659863945, + "disc_nll_ch6": 0.5099724489795919, + "disc_nll_ch7": 0.9602792517006803, + "disc_nll_total": 0.8287564625850341, + "terminal_flow": 0.8730295918367348, + "terminal_norm": 0.9232607142857142, + "terminal_packet": 0.925750850340136 + }, + "WebDDoS": { + "_n": 438.0, + "disc_nll_ch2": 0.4034816210045662, + "disc_nll_ch3": 0.6108647260273973, + "disc_nll_ch4": 0.8224254566210045, + "disc_nll_ch5": 0.6753156392694064, + "disc_nll_ch6": 0.6035142694063926, + "disc_nll_ch7": 0.7182194063926941, + "disc_nll_total": 0.7147494292237443, + "terminal_flow": 0.5593368721461187, + "terminal_norm": 0.5639695205479451, + "terminal_packet": 0.378654794520548 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicddos2019.log b/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicddos2019.log new file mode 100644 index 0000000..a33c512 --- /dev/null +++ b/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicddos2019.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,993,376 target rows +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.1s +[eval] attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done 3.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicddos2019.json diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicddos2019.npz new file mode 100644 index 0000000..7ec3d4e Binary files /dev/null and b/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicids2017.json b/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicids2017.json new file mode 100644 index 0000000..20b22e8 --- /dev/null +++ b/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicids2017.json @@ -0,0 +1,246 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.7324868281157708, + "auprc": 0.6318280697797283 + }, + "disc_nll_ch3": { + "auroc": 0.8885825162433549, + "auprc": 0.8052315768991852 + }, + "disc_nll_ch4": { + "auroc": 0.8669128027170704, + "auprc": 0.7103365273615515 + }, + "disc_nll_ch5": { + "auroc": 0.8080842808623745, + "auprc": 0.7811538468868688 + }, + "disc_nll_ch6": { + "auroc": 0.8522094063792084, + "auprc": 0.6970249999624697 + }, + "disc_nll_ch7": { + "auroc": 0.6112026137034848, + "auprc": 0.6258024134574296 + }, + "disc_nll_total": { + "auroc": 0.9180140357353811, + "auprc": 0.8426434847795171 + }, + "terminal_flow": { + "auroc": 0.8945234864146485, + "auprc": 0.7658155211247706 + }, + "terminal_norm": { + "auroc": 0.7842969802126403, + "auprc": 0.725785108216062 + }, + "terminal_packet": { + "auroc": 0.7908733165977554, + "auprc": 0.6922563497189859 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "disc_nll_ch2": 0.9494349849849849, + "disc_nll_ch3": 0.9422711711711712, + "disc_nll_ch4": 0.932027027027027, + "disc_nll_ch5": 0.8631037537537537, + "disc_nll_ch6": 0.8519409909909912, + "disc_nll_ch7": 0.4139891891891892, + "disc_nll_total": 0.9333304804804804, + "terminal_flow": 0.8008583333333334, + "terminal_norm": 0.9093325825825825, + "terminal_packet": 0.9232971471471472 + }, + "DDoS": { + "_n": 666.0, + "disc_nll_ch2": 0.8525727477477478, + "disc_nll_ch3": 0.8851546546546547, + "disc_nll_ch4": 0.9255891891891892, + "disc_nll_ch5": 0.9719707207207209, + "disc_nll_ch6": 0.9232847597597598, + "disc_nll_ch7": 0.46847117117117115, + "disc_nll_total": 0.9461211711711713, + "terminal_flow": 0.9705140390390391, + "terminal_norm": 0.9551423423423423, + "terminal_packet": 0.9071187687687688 + }, + "DoS GoldenEye": { + "_n": 666.0, + "disc_nll_ch2": 0.8843771771771771, + "disc_nll_ch3": 0.8686824324324325, + "disc_nll_ch4": 0.9239812312312312, + "disc_nll_ch5": 0.8111554054054053, + "disc_nll_ch6": 0.7658648648648648, + "disc_nll_ch7": 0.4892442942942943, + "disc_nll_total": 0.8941033033033033, + "terminal_flow": 0.9672536036036036, + "terminal_norm": 0.8841025525525525, + "terminal_packet": 0.8326773273273274 + }, + "DoS Hulk": { + "_n": 666.0, + "disc_nll_ch2": 0.7972175675675677, + "disc_nll_ch3": 0.8937984984984984, + "disc_nll_ch4": 0.9208771771771771, + "disc_nll_ch5": 0.946285960960961, + "disc_nll_ch6": 0.8545336336336337, + "disc_nll_ch7": 0.4934630630630631, + "disc_nll_total": 0.9203720720720721, + "terminal_flow": 0.954712162162162, + "terminal_norm": 0.8115842342342342, + "terminal_packet": 0.7769376126126126 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "disc_nll_ch2": 0.7309601351351351, + "disc_nll_ch3": 0.9128307807807808, + "disc_nll_ch4": 0.877587987987988, + "disc_nll_ch5": 0.7328024024024024, + "disc_nll_ch6": 0.8650996246246245, + "disc_nll_ch7": 0.7564570570570571, + "disc_nll_total": 0.8921784534534535, + "terminal_flow": 0.8781867867867869, + "terminal_norm": 0.8984689939939942, + "terminal_packet": 0.9090074324324324 + }, + "DoS Slowloris": { + "_n": 666.0, + "disc_nll_ch2": 0.6115100600600601, + "disc_nll_ch3": 0.8527208708708709, + "disc_nll_ch4": 0.7877617117117116, + "disc_nll_ch5": 0.9337617117117116, + "disc_nll_ch6": 0.8319873873873874, + "disc_nll_ch7": 0.913456906906907, + "disc_nll_total": 0.8142687687687686, + "terminal_flow": 0.8081187687687686, + "terminal_norm": 0.7899516516516517, + "terminal_packet": 0.7856069069069069 + }, + "FTP-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.9426465465465466, + "disc_nll_ch3": 0.8392663663663664, + "disc_nll_ch4": 0.754881981981982, + "disc_nll_ch5": 0.7002318318318319, + "disc_nll_ch6": 0.9675151651651652, + "disc_nll_ch7": 0.621551051051051, + "disc_nll_total": 0.9353725225225226, + "terminal_flow": 0.8391195195195194, + "terminal_norm": 0.4466942942942943, + "terminal_packet": 0.5556660660660661 + }, + "Heartbleed": { + "_n": 1.0, + "disc_nll_ch2": 0.40590000000000004, + "disc_nll_ch3": 0.7263, + "disc_nll_ch4": 0.6641, + "disc_nll_ch5": 0.7279, + "disc_nll_ch6": 0.8580000000000001, + "disc_nll_ch7": 0.37429999999999997, + "disc_nll_total": 0.6225, + "terminal_flow": 0.9941, + "terminal_norm": 0.538, + "terminal_packet": 0.2965 + }, + "Infiltration": { + "_n": 7.0, + "disc_nll_ch2": 0.8635999999999999, + "disc_nll_ch3": 0.7463142857142857, + "disc_nll_ch4": 0.6885714285714286, + "disc_nll_ch5": 0.4282285714285714, + "disc_nll_ch6": 0.9848428571428571, + "disc_nll_ch7": 0.2611142857142857, + "disc_nll_total": 0.9111857142857143, + "terminal_flow": 0.9596285714285714, + "terminal_norm": 0.8291714285714286, + "terminal_packet": 0.7959857142857143 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.23038993993993995, + "disc_nll_ch3": 0.9966306306306306, + "disc_nll_ch4": 0.9223069069069069, + "disc_nll_ch5": 0.9684800300300299, + "disc_nll_ch6": 0.7890151651651651, + "disc_nll_ch7": 0.9966291291291292, + "disc_nll_total": 0.9957321321321322, + "terminal_flow": 0.9450744744744743, + "terminal_norm": 0.9916243243243243, + "terminal_packet": 0.9676950450450451 + }, + "Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.3539256756756757, + "disc_nll_ch3": 0.9982558558558559, + "disc_nll_ch4": 0.863322072072072, + "disc_nll_ch5": 0.9964578078078077, + "disc_nll_ch6": 0.8582723723723724, + "disc_nll_ch7": 0.9926602102102101, + "disc_nll_total": 0.9965789789789792, + "terminal_flow": 0.9062274024024024, + "terminal_norm": 0.9908819819819821, + "terminal_packet": 0.987792942942943 + }, + "SSH-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.951398048048048, + "disc_nll_ch3": 0.7191753753753756, + "disc_nll_ch4": 0.8026316816816816, + "disc_nll_ch5": 0.1783463963963964, + "disc_nll_ch6": 0.8283950450450451, + "disc_nll_ch7": 0.005064714714714716, + "disc_nll_total": 0.8798313813813815, + "terminal_flow": 0.8599806306306306, + "terminal_norm": 0.1956303303303303, + "terminal_packet": 0.3142054054054054 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "disc_nll_ch2": 0.8754698630136987, + "disc_nll_ch3": 0.7295178082191781, + "disc_nll_ch4": 0.5459479452054794, + "disc_nll_ch5": 0.6745534246575343, + "disc_nll_ch6": 0.7457452054794521, + "disc_nll_ch7": 0.38515753424657534, + "disc_nll_total": 0.7267082191780823, + "terminal_flow": 0.991127397260274, + "terminal_norm": 0.5404, + "terminal_packet": 0.41013835616438354 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "disc_nll_ch2": 0.9474384615384615, + "disc_nll_ch3": 0.9229307692307691, + "disc_nll_ch4": 0.9572461538461539, + "disc_nll_ch5": 0.8382, + "disc_nll_ch6": 0.7148307692307693, + "disc_nll_ch7": 0.38427692307692307, + "disc_nll_total": 0.9329461538461539, + "terminal_flow": 0.950823076923077, + "terminal_norm": 0.9211384615384616, + "terminal_packet": 0.891 + }, + "Web Attack - XSS": { + "_n": 18.0, + "disc_nll_ch2": 0.7206333333333332, + "disc_nll_ch3": 0.7236388888888889, + "disc_nll_ch4": 0.6359444444444444, + "disc_nll_ch5": 0.6751833333333334, + "disc_nll_ch6": 0.8201444444444445, + "disc_nll_ch7": 0.3995944444444445, + "disc_nll_total": 0.6754444444444444, + "terminal_flow": 0.9932277777777778, + "terminal_norm": 0.5444277777777777, + "terminal_packet": 0.39108333333333334 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicids2017.log b/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicids2017.log new file mode 100644 index 0000000..17cafbd --- /dev/null +++ b/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicids2017.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 2,025,564 target rows +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.1s +[eval] attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done 2.5s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicids2017.json diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicids2017.npz b/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicids2017.npz new file mode 100644 index 0000000..6a21bd9 Binary files /dev/null and b/artifacts/route_comparison/cross/route_c_mixed_seed42_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicddos2019.json b/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicddos2019.json new file mode 100644 index 0000000..8bfbd84 --- /dev/null +++ b/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicddos2019.json @@ -0,0 +1,272 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.08944154478976235, + "auprc": 0.3216070726474584 + }, + "disc_nll_ch3": { + "auroc": 0.48729274324598826, + "auprc": 0.5141848072286339 + }, + "disc_nll_ch4": { + "auroc": 0.475999487101361, + "auprc": 0.46055607994798553 + }, + "disc_nll_ch5": { + "auroc": 0.4892038238878732, + "auprc": 0.45790948893523997 + }, + "disc_nll_ch6": { + "auroc": 0.5000004976640261, + "auprc": 0.45201773164080333 + }, + "disc_nll_ch7": { + "auroc": 0.8447782754418037, + "auprc": 0.8060287494199723 + }, + "disc_nll_total": { + "auroc": 0.37194358622790985, + "auprc": 0.44918235467710055 + }, + "terminal_flow": { + "auroc": 0.8365887060735325, + "auprc": 0.7251185190123194 + }, + "terminal_norm": { + "auroc": 0.8533267570587041, + "auprc": 0.7910497648942437 + }, + "terminal_packet": { + "auroc": 0.7657874822262848, + "auprc": 0.7639417601525665 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "disc_nll_ch2": 0.03634693877551019, + "disc_nll_ch3": 0.4101722789115646, + "disc_nll_ch4": 0.43656547619047614, + "disc_nll_ch5": 0.49095969387755106, + "disc_nll_ch6": 0.5111996598639456, + "disc_nll_ch7": 0.9269755952380954, + "disc_nll_total": 0.3675954081632653, + "terminal_flow": 0.9084607142857143, + "terminal_norm": 0.9556386904761907, + "terminal_packet": 0.9808614795918367 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.03743809523809522, + "disc_nll_ch3": 0.41083350340136054, + "disc_nll_ch4": 0.43592261904761903, + "disc_nll_ch5": 0.4892052721088436, + "disc_nll_ch6": 0.5140908163265306, + "disc_nll_ch7": 0.9305598639455781, + "disc_nll_total": 0.37198163265306117, + "terminal_flow": 0.9131722789115646, + "terminal_norm": 0.958364455782313, + "terminal_packet": 0.9951688775510203 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.04384387755102041, + "disc_nll_ch3": 0.4108714285714286, + "disc_nll_ch4": 0.4575921768707483, + "disc_nll_ch5": 0.5084085034013606, + "disc_nll_ch6": 0.503995068027211, + "disc_nll_ch7": 0.9165600340136055, + "disc_nll_total": 0.35750680272108837, + "terminal_flow": 0.8704051020408162, + "terminal_norm": 0.9348278061224491, + "terminal_packet": 0.8341795918367347 + }, + "DrDoS_NTP": { + "_n": 588.0, + "disc_nll_ch2": 0.04842551020408163, + "disc_nll_ch3": 0.42603367346938775, + "disc_nll_ch4": 0.13715221088435373, + "disc_nll_ch5": 0.09491292517006802, + "disc_nll_ch6": 0.3043767857142857, + "disc_nll_ch7": 0.6076083333333333, + "disc_nll_total": 0.024338605442176843, + "terminal_flow": 0.9011142857142856, + "terminal_norm": 0.5420892857142857, + "terminal_packet": 0.5482812074829932 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.046771938775510224, + "disc_nll_ch3": 0.4101079931972789, + "disc_nll_ch4": 0.4660569727891157, + "disc_nll_ch5": 0.5163522108843537, + "disc_nll_ch6": 0.49240952380952385, + "disc_nll_ch7": 0.9127852040816327, + "disc_nll_total": 0.34607704081632656, + "terminal_flow": 0.7425610544217688, + "terminal_norm": 0.8669171768707483, + "terminal_packet": 0.7261204081632654 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "disc_nll_ch2": 0.04097874149659866, + "disc_nll_ch3": 0.4108634353741497, + "disc_nll_ch4": 0.43933860544217684, + "disc_nll_ch5": 0.49384472789115647, + "disc_nll_ch6": 0.5153965986394557, + "disc_nll_ch7": 0.9322585034013605, + "disc_nll_total": 0.3779272108843537, + "terminal_flow": 0.9035778911564626, + "terminal_norm": 0.9532687074829932, + "terminal_packet": 0.985691836734694 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "disc_nll_ch2": 0.024515646258503408, + "disc_nll_ch3": 0.4254292517006803, + "disc_nll_ch4": 0.38558112244897963, + "disc_nll_ch5": 0.3816073979591837, + "disc_nll_ch6": 0.4505693877551021, + "disc_nll_ch7": 0.7319988095238095, + "disc_nll_total": 0.18935272108843532, + "terminal_flow": 0.8157797619047619, + "terminal_norm": 0.7534642857142857, + "terminal_packet": 0.5831622448979592 + }, + "DrDoS_UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.02408622448979593, + "disc_nll_ch3": 0.4241263605442177, + "disc_nll_ch4": 0.38802721088435377, + "disc_nll_ch5": 0.38613843537414966, + "disc_nll_ch6": 0.44991802721088436, + "disc_nll_ch7": 0.7318284013605442, + "disc_nll_total": 0.18648707482993193, + "terminal_flow": 0.8133299319727891, + "terminal_norm": 0.7529787414965987, + "terminal_packet": 0.5699397959183674 + }, + "LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.04101581632653059, + "disc_nll_ch3": 0.4117062925170068, + "disc_nll_ch4": 0.43815561224489796, + "disc_nll_ch5": 0.4916732993197279, + "disc_nll_ch6": 0.5165818027210884, + "disc_nll_ch7": 0.9328787414965987, + "disc_nll_total": 0.3752018707482993, + "terminal_flow": 0.9130386054421769, + "terminal_norm": 0.9587255102040817, + "terminal_packet": 0.9973772108843537 + }, + "MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.043506292517006814, + "disc_nll_ch3": 0.41095051020408163, + "disc_nll_ch4": 0.4569078231292517, + "disc_nll_ch5": 0.5077909863945579, + "disc_nll_ch6": 0.5022894557823129, + "disc_nll_ch7": 0.9145957482993198, + "disc_nll_total": 0.35408622448979593, + "terminal_flow": 0.8684178571428571, + "terminal_norm": 0.9330511904761905, + "terminal_packet": 0.8268205782312925 + }, + "NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.04529710884353744, + "disc_nll_ch3": 0.40978078231292514, + "disc_nll_ch4": 0.4627302721088436, + "disc_nll_ch5": 0.5054772108843537, + "disc_nll_ch6": 0.4881821428571429, + "disc_nll_ch7": 0.9013022108843537, + "disc_nll_total": 0.3284974489795918, + "terminal_flow": 0.749061224489796, + "terminal_norm": 0.8690447278911564, + "terminal_packet": 0.7146948979591837 + }, + "Portmap": { + "_n": 588.0, + "disc_nll_ch2": 0.046641666666666685, + "disc_nll_ch3": 0.41175527210884355, + "disc_nll_ch4": 0.4640025510204082, + "disc_nll_ch5": 0.5075896258503402, + "disc_nll_ch6": 0.4913181972789116, + "disc_nll_ch7": 0.9029967687074829, + "disc_nll_total": 0.33836496598639465, + "terminal_flow": 0.7480267006802721, + "terminal_norm": 0.8697382653061224, + "terminal_packet": 0.7214496598639456 + }, + "Syn": { + "_n": 588.0, + "disc_nll_ch2": 0.3460214285714286, + "disc_nll_ch3": 0.9881277210884353, + "disc_nll_ch4": 0.8475363945578231, + "disc_nll_ch5": 0.8574539115646259, + "disc_nll_ch6": 0.6564382653061225, + "disc_nll_ch7": 0.9852920068027211, + "disc_nll_total": 0.9390748299319728, + "terminal_flow": 0.8704318027210884, + "terminal_norm": 0.935765306122449, + "terminal_packet": 0.9013416666666666 + }, + "TFTP": { + "_n": 588.0, + "disc_nll_ch2": 0.0437807823129252, + "disc_nll_ch3": 0.41034693877551026, + "disc_nll_ch4": 0.3793942176870748, + "disc_nll_ch5": 0.2959489795918367, + "disc_nll_ch6": 0.43429387755102045, + "disc_nll_ch7": 0.6563066326530612, + "disc_nll_total": 0.16991037414965987, + "terminal_flow": 0.8881632653061224, + "terminal_norm": 0.9064615646258505, + "terminal_packet": 0.6282994897959183 + }, + "UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.021986394557823134, + "disc_nll_ch3": 0.42533197278911566, + "disc_nll_ch4": 0.38138928571428576, + "disc_nll_ch5": 0.3738531462585034, + "disc_nll_ch6": 0.44400204081632655, + "disc_nll_ch7": 0.714985544217687, + "disc_nll_total": 0.1716624149659864, + "terminal_flow": 0.813723299319728, + "terminal_norm": 0.742615306122449, + "terminal_packet": 0.5537039115646258 + }, + "UDPLag": { + "_n": 588.0, + "disc_nll_ch2": 0.2961243197278912, + "disc_nll_ch3": 0.9218396258503401, + "disc_nll_ch4": 0.7945704081632654, + "disc_nll_ch5": 0.7730481292517006, + "disc_nll_ch6": 0.6010636054421769, + "disc_nll_ch7": 0.947863775510204, + "disc_nll_total": 0.7957404761904762, + "terminal_flow": 0.8646017857142858, + "terminal_norm": 0.9157600340136054, + "terminal_packet": 0.8660736394557823 + }, + "WebDDoS": { + "_n": 438.0, + "disc_nll_ch2": 0.4173843607305936, + "disc_nll_ch3": 0.5925512557077626, + "disc_nll_ch4": 0.80499600456621, + "disc_nll_ch5": 0.6945966894977168, + "disc_nll_ch6": 0.6663087899543378, + "disc_nll_ch7": 0.6697962328767123, + "disc_nll_total": 0.7173496575342466, + "terminal_flow": 0.570181392694064, + "terminal_norm": 0.590897602739726, + "terminal_packet": 0.5233827625570777 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicddos2019.log b/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicddos2019.log new file mode 100644 index 0000000..b543c72 --- /dev/null +++ b/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicddos2019.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,993,376 target rows +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.1s +[eval] attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done 3.6s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicddos2019.json diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicddos2019.npz new file mode 100644 index 0000000..ea79c6a Binary files /dev/null and b/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicids2017.json b/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicids2017.json new file mode 100644 index 0000000..128481e --- /dev/null +++ b/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicids2017.json @@ -0,0 +1,246 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.6957200753101004, + "auprc": 0.5905282612055769 + }, + "disc_nll_ch3": { + "auroc": 0.8786799911399882, + "auprc": 0.7943915967864434 + }, + "disc_nll_ch4": { + "auroc": 0.8848398995865328, + "auprc": 0.7368483373958588 + }, + "disc_nll_ch5": { + "auroc": 0.82086154754873, + "auprc": 0.7958039020762631 + }, + "disc_nll_ch6": { + "auroc": 0.8630889766686356, + "auprc": 0.7150139749835102 + }, + "disc_nll_ch7": { + "auroc": 0.6461265283520379, + "auprc": 0.6250460731638714 + }, + "disc_nll_total": { + "auroc": 0.9068640726520969, + "auprc": 0.8231678938146745 + }, + "terminal_flow": { + "auroc": 0.829576993502658, + "auprc": 0.7163728955769298 + }, + "terminal_norm": { + "auroc": 0.7583228366804489, + "auprc": 0.7061782705598817 + }, + "terminal_packet": { + "auroc": 0.7750342070289428, + "auprc": 0.6598989030774167 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "disc_nll_ch2": 0.9547572072072071, + "disc_nll_ch3": 0.924801051051051, + "disc_nll_ch4": 0.9272662162162162, + "disc_nll_ch5": 0.8299366366366366, + "disc_nll_ch6": 0.8687103603603604, + "disc_nll_ch7": 0.42866801801801796, + "disc_nll_total": 0.9270936936936937, + "terminal_flow": 0.5967151651651651, + "terminal_norm": 0.9295063063063063, + "terminal_packet": 0.9517775525525525 + }, + "DDoS": { + "_n": 666.0, + "disc_nll_ch2": 0.9026906906906907, + "disc_nll_ch3": 0.911196996996997, + "disc_nll_ch4": 0.9138054054054053, + "disc_nll_ch5": 0.9815857357357357, + "disc_nll_ch6": 0.9407052552552553, + "disc_nll_ch7": 0.6445411411411411, + "disc_nll_total": 0.9547226726726726, + "terminal_flow": 0.9739222222222224, + "terminal_norm": 0.965054054054054, + "terminal_packet": 0.9275258258258259 + }, + "DoS GoldenEye": { + "_n": 666.0, + "disc_nll_ch2": 0.8443966216216217, + "disc_nll_ch3": 0.860143993993994, + "disc_nll_ch4": 0.925037987987988, + "disc_nll_ch5": 0.9124144144144144, + "disc_nll_ch6": 0.7941312312312312, + "disc_nll_ch7": 0.48397642642642646, + "disc_nll_total": 0.8944028528528529, + "terminal_flow": 0.9653012012012013, + "terminal_norm": 0.8694672672672673, + "terminal_packet": 0.8501355105105105 + }, + "DoS Hulk": { + "_n": 666.0, + "disc_nll_ch2": 0.7898629129129129, + "disc_nll_ch3": 0.8734644144144144, + "disc_nll_ch4": 0.904449099099099, + "disc_nll_ch5": 0.9692072072072073, + "disc_nll_ch6": 0.8299430930930931, + "disc_nll_ch7": 0.6670414414414414, + "disc_nll_total": 0.9136250750750751, + "terminal_flow": 0.9646965465465466, + "terminal_norm": 0.8017204204204205, + "terminal_packet": 0.7641258258258258 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "disc_nll_ch2": 0.6110771771771771, + "disc_nll_ch3": 0.9208662162162161, + "disc_nll_ch4": 0.9250663663663664, + "disc_nll_ch5": 0.812090990990991, + "disc_nll_ch6": 0.8663094594594595, + "disc_nll_ch7": 0.7065140390390391, + "disc_nll_total": 0.8730408408408409, + "terminal_flow": 0.7959612612612612, + "terminal_norm": 0.8580074324324324, + "terminal_packet": 0.9168040540540541 + }, + "DoS Slowloris": { + "_n": 666.0, + "disc_nll_ch2": 0.5371680180180181, + "disc_nll_ch3": 0.8356857357357359, + "disc_nll_ch4": 0.840095045045045, + "disc_nll_ch5": 0.9100438438438438, + "disc_nll_ch6": 0.7876424924924924, + "disc_nll_ch7": 0.8700033033033034, + "disc_nll_total": 0.7919183183183184, + "terminal_flow": 0.770544894894895, + "terminal_norm": 0.64218993993994, + "terminal_packet": 0.7607957957957957 + }, + "FTP-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.8319903903903902, + "disc_nll_ch3": 0.7941142642642643, + "disc_nll_ch4": 0.8106105105105105, + "disc_nll_ch5": 0.7072978978978979, + "disc_nll_ch6": 0.9518755255255256, + "disc_nll_ch7": 0.7209379879879879, + "disc_nll_total": 0.9123564564564565, + "terminal_flow": 0.5246171171171171, + "terminal_norm": 0.3936930930930931, + "terminal_packet": 0.4474563063063063 + }, + "Heartbleed": { + "_n": 1.0, + "disc_nll_ch2": 0.3257, + "disc_nll_ch3": 0.6477999999999999, + "disc_nll_ch4": 0.6262, + "disc_nll_ch5": 0.6933, + "disc_nll_ch6": 0.797, + "disc_nll_ch7": 0.45640000000000003, + "disc_nll_total": 0.39380000000000004, + "terminal_flow": 0.9940000000000001, + "terminal_norm": 0.5179, + "terminal_packet": 0.31710000000000005 + }, + "Infiltration": { + "_n": 7.0, + "disc_nll_ch2": 0.8235714285714286, + "disc_nll_ch3": 0.7278714285714286, + "disc_nll_ch4": 0.5596428571428572, + "disc_nll_ch5": 0.3602142857142857, + "disc_nll_ch6": 0.9797285714285714, + "disc_nll_ch7": 0.3201857142857143, + "disc_nll_total": 0.9096428571428572, + "terminal_flow": 0.9128428571428571, + "terminal_norm": 0.7396428571428573, + "terminal_packet": 0.7670928571428571 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.2809009009009009, + "disc_nll_ch3": 0.9976034534534534, + "disc_nll_ch4": 0.9599632132132133, + "disc_nll_ch5": 0.972883033033033, + "disc_nll_ch6": 0.9016462462462462, + "disc_nll_ch7": 0.9956096096096095, + "disc_nll_total": 0.9950103603603603, + "terminal_flow": 0.947268018018018, + "terminal_norm": 0.9901831831831832, + "terminal_packet": 0.916491891891892 + }, + "Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.28312792792792796, + "disc_nll_ch3": 0.9988891891891892, + "disc_nll_ch4": 0.9379512012012012, + "disc_nll_ch5": 0.9956258258258258, + "disc_nll_ch6": 0.8849499999999999, + "disc_nll_ch7": 0.9925096096096097, + "disc_nll_total": 0.9963006006006007, + "terminal_flow": 0.9151717717717718, + "terminal_norm": 0.9910084084084083, + "terminal_packet": 0.9672903903903904 + }, + "SSH-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.9325764264264265, + "disc_nll_ch3": 0.6992037537537538, + "disc_nll_ch4": 0.7697454954954955, + "disc_nll_ch5": 0.20460495495495495, + "disc_nll_ch6": 0.8071873123123124, + "disc_nll_ch7": 0.01438453453453454, + "disc_nll_total": 0.841287987987988, + "terminal_flow": 0.8160833333333334, + "terminal_norm": 0.1689433933933934, + "terminal_packet": 0.28919031531531536 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "disc_nll_ch2": 0.5980753424657534, + "disc_nll_ch3": 0.6736369863013698, + "disc_nll_ch4": 0.4189876712328767, + "disc_nll_ch5": 0.2080849315068493, + "disc_nll_ch6": 0.8449794520547944, + "disc_nll_ch7": 0.24874520547945206, + "disc_nll_total": 0.6893657534246576, + "terminal_flow": 0.9908547945205479, + "terminal_norm": 0.5452041095890411, + "terminal_packet": 0.46802191780821917 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "disc_nll_ch2": 0.9708615384615384, + "disc_nll_ch3": 0.9100923076923076, + "disc_nll_ch4": 0.9512692307692308, + "disc_nll_ch5": 0.8934461538461539, + "disc_nll_ch6": 0.7353307692307692, + "disc_nll_ch7": 0.45473076923076927, + "disc_nll_total": 0.9332692307692309, + "terminal_flow": 0.9460461538461539, + "terminal_norm": 0.9236461538461538, + "terminal_packet": 0.9041115384615384 + }, + "Web Attack - XSS": { + "_n": 18.0, + "disc_nll_ch2": 0.44398888888888893, + "disc_nll_ch3": 0.6797722222222222, + "disc_nll_ch4": 0.44010000000000005, + "disc_nll_ch5": 0.21803888888888887, + "disc_nll_ch6": 0.9053, + "disc_nll_ch7": 0.20518333333333333, + "disc_nll_total": 0.6459222222222222, + "terminal_flow": 0.9929444444444444, + "terminal_norm": 0.5416888888888889, + "terminal_packet": 0.42914444444444444 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicids2017.log b/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicids2017.log new file mode 100644 index 0000000..dc3b519 --- /dev/null +++ b/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicids2017.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 2,025,564 target rows +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.1s +[eval] attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done 2.5s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicids2017.json diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicids2017.npz b/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicids2017.npz new file mode 100644 index 0000000..66e6f61 Binary files /dev/null and b/artifacts/route_comparison/cross/route_c_mixed_seed43_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicddos2019.json b/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicddos2019.json new file mode 100644 index 0000000..4807727 --- /dev/null +++ b/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicddos2019.json @@ -0,0 +1,272 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store", + "n_benign": 10000, + "n_attack": 9846, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.0657313172862076, + "auprc": 0.31761793993627646 + }, + "disc_nll_ch3": { + "auroc": 0.2955770922201909, + "auprc": 0.45105105491371617 + }, + "disc_nll_ch4": { + "auroc": 0.40157114056469634, + "auprc": 0.41571802977351635 + }, + "disc_nll_ch5": { + "auroc": 0.4345400873451148, + "auprc": 0.4311616495429639 + }, + "disc_nll_ch6": { + "auroc": 0.4817974608978265, + "auprc": 0.4445963110317063 + }, + "disc_nll_ch7": { + "auroc": 0.8153429666869795, + "auprc": 0.7922900344497413 + }, + "disc_nll_total": { + "auroc": 0.38169670932358324, + "auprc": 0.47519976643088496 + }, + "terminal_flow": { + "auroc": 0.8321512492382693, + "auprc": 0.7425842459511139 + }, + "terminal_norm": { + "auroc": 0.8260321805809465, + "auprc": 0.7593544875559208 + }, + "terminal_packet": { + "auroc": 0.5416071247206988, + "auprc": 0.5361405404896791 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 588.0, + "disc_nll_ch2": 0.008009523809523782, + "disc_nll_ch3": 0.31278469387755103, + "disc_nll_ch4": 0.40110697278911567, + "disc_nll_ch5": 0.4693407312925171, + "disc_nll_ch6": 0.5418535714285715, + "disc_nll_ch7": 0.9360500850340137, + "disc_nll_total": 0.3875888605442177, + "terminal_flow": 0.9398333333333334, + "terminal_norm": 0.953793112244898, + "terminal_packet": 0.826932738095238 + }, + "DrDoS_LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.004221088435374118, + "disc_nll_ch3": 0.3277545918367347, + "disc_nll_ch4": 0.40118826530612245, + "disc_nll_ch5": 0.4736930272108844, + "disc_nll_ch6": 0.5496382653061224, + "disc_nll_ch7": 0.9418270408163265, + "disc_nll_total": 0.3921712585034014, + "terminal_flow": 0.9508639455782313, + "terminal_norm": 0.958976530612245, + "terminal_packet": 0.853102551020408 + }, + "DrDoS_MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.04246955782312927, + "disc_nll_ch3": 0.15217142857142854, + "disc_nll_ch4": 0.40612023809523806, + "disc_nll_ch5": 0.4632098639455782, + "disc_nll_ch6": 0.4865760204081632, + "disc_nll_ch7": 0.8884078231292518, + "disc_nll_total": 0.3608299319727891, + "terminal_flow": 0.8558894557823129, + "terminal_norm": 0.9060326530612245, + "terminal_packet": 0.4956568027210885 + }, + "DrDoS_NTP": { + "_n": 588.0, + "disc_nll_ch2": 0.02272755102040816, + "disc_nll_ch3": 0.14983639455782313, + "disc_nll_ch4": 0.08171564625850339, + "disc_nll_ch5": 0.054738095238095245, + "disc_nll_ch6": 0.3706801020408163, + "disc_nll_ch7": 0.514157993197279, + "disc_nll_total": 0.02598146258503401, + "terminal_flow": 0.8975421768707483, + "terminal_norm": 0.49786215986394555, + "terminal_packet": 0.4467430272108843 + }, + "DrDoS_NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.057517006802721114, + "disc_nll_ch3": 0.002631802721088394, + "disc_nll_ch4": 0.41651989795918365, + "disc_nll_ch5": 0.4684680272108843, + "disc_nll_ch6": 0.4358675170068027, + "disc_nll_ch7": 0.8742006802721088, + "disc_nll_total": 0.35592840136054416, + "terminal_flow": 0.7169028911564626, + "terminal_norm": 0.8079988095238094, + "terminal_packet": 0.28123877551020404 + }, + "DrDoS_SNMP": { + "_n": 588.0, + "disc_nll_ch2": 0.0066688775510204135, + "disc_nll_ch3": 0.3118743197278911, + "disc_nll_ch4": 0.4030889455782313, + "disc_nll_ch5": 0.48160119047619054, + "disc_nll_ch6": 0.5452969387755101, + "disc_nll_ch7": 0.9421581632653062, + "disc_nll_total": 0.3912498299319728, + "terminal_flow": 0.9351989795918367, + "terminal_norm": 0.9505093537414966, + "terminal_packet": 0.8159399659863945 + }, + "DrDoS_SSDP": { + "_n": 588.0, + "disc_nll_ch2": 0.025314115646258503, + "disc_nll_ch3": 0.19914081632653063, + "disc_nll_ch4": 0.246853231292517, + "disc_nll_ch5": 0.26233894557823123, + "disc_nll_ch6": 0.4181420068027211, + "disc_nll_ch7": 0.6568646258503401, + "disc_nll_total": 0.19203418367346936, + "terminal_flow": 0.7911978741496599, + "terminal_norm": 0.713770238095238, + "terminal_packet": 0.30485518707482995 + }, + "DrDoS_UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.02599013605442177, + "disc_nll_ch3": 0.19337210884353745, + "disc_nll_ch4": 0.24857414965986396, + "disc_nll_ch5": 0.2608552721088435, + "disc_nll_ch6": 0.4153362244897959, + "disc_nll_ch7": 0.6519727040816327, + "disc_nll_total": 0.18948860544217686, + "terminal_flow": 0.788261649659864, + "terminal_norm": 0.7139300170068028, + "terminal_packet": 0.2829684523809524 + }, + "LDAP": { + "_n": 588.0, + "disc_nll_ch2": 0.004841836734693839, + "disc_nll_ch3": 0.3326171768707483, + "disc_nll_ch4": 0.4028202380952381, + "disc_nll_ch5": 0.47621088435374154, + "disc_nll_ch6": 0.552177380952381, + "disc_nll_ch7": 0.9433744897959183, + "disc_nll_total": 0.3957909863945578, + "terminal_flow": 0.9535710884353741, + "terminal_norm": 0.9591232993197278, + "terminal_packet": 0.8573010204081631 + }, + "MSSQL": { + "_n": 588.0, + "disc_nll_ch2": 0.04280000000000002, + "disc_nll_ch3": 0.137325, + "disc_nll_ch4": 0.4058554421768707, + "disc_nll_ch5": 0.46078401360544224, + "disc_nll_ch6": 0.48340051020408165, + "disc_nll_ch7": 0.8865467687074831, + "disc_nll_total": 0.35876649659863946, + "terminal_flow": 0.853495918367347, + "terminal_norm": 0.9046537414965986, + "terminal_packet": 0.4825906462585034 + }, + "NetBIOS": { + "_n": 588.0, + "disc_nll_ch2": 0.05692738095238097, + "disc_nll_ch3": 0.0021602040816326136, + "disc_nll_ch4": 0.41493928571428573, + "disc_nll_ch5": 0.45553384353741494, + "disc_nll_ch6": 0.4329794217687074, + "disc_nll_ch7": 0.8640454081632652, + "disc_nll_total": 0.3452472789115646, + "terminal_flow": 0.7247474489795918, + "terminal_norm": 0.8118384353741498, + "terminal_packet": 0.2739605442176871 + }, + "Portmap": { + "_n": 588.0, + "disc_nll_ch2": 0.05780221088435376, + "disc_nll_ch3": 0.005648979591836693, + "disc_nll_ch4": 0.41624285714285714, + "disc_nll_ch5": 0.45619319727891156, + "disc_nll_ch6": 0.43440357142857144, + "disc_nll_ch7": 0.8653933673469387, + "disc_nll_total": 0.3468062925170068, + "terminal_flow": 0.7230460884353742, + "terminal_norm": 0.8120617346938775, + "terminal_packet": 0.28984030612244893 + }, + "Syn": { + "_n": 588.0, + "disc_nll_ch2": 0.2176639455782313, + "disc_nll_ch3": 0.9907821428571428, + "disc_nll_ch4": 0.6834869047619048, + "disc_nll_ch5": 0.703433163265306, + "disc_nll_ch6": 0.5356467687074831, + "disc_nll_ch7": 0.995258843537415, + "disc_nll_total": 0.9691654761904762, + "terminal_flow": 0.8620204081632653, + "terminal_norm": 0.9288595238095239, + "terminal_packet": 0.9183537414965985 + }, + "TFTP": { + "_n": 588.0, + "disc_nll_ch2": 0.024851530612244904, + "disc_nll_ch3": 0.29063979591836736, + "disc_nll_ch4": 0.35483724489795915, + "disc_nll_ch5": 0.4345384353741497, + "disc_nll_ch6": 0.42557738095238096, + "disc_nll_ch7": 0.6117498299319728, + "disc_nll_total": 0.1710681972789115, + "terminal_flow": 0.875211394557823, + "terminal_norm": 0.8800971088435374, + "terminal_packet": 0.4489365646258503 + }, + "UDP": { + "_n": 588.0, + "disc_nll_ch2": 0.024792006802721086, + "disc_nll_ch3": 0.20176156462585038, + "disc_nll_ch4": 0.23643996598639455, + "disc_nll_ch5": 0.2427918367346939, + "disc_nll_ch6": 0.4115489795918367, + "disc_nll_ch7": 0.633636224489796, + "disc_nll_total": 0.17559778911564625, + "terminal_flow": 0.7877926020408164, + "terminal_norm": 0.7024756802721088, + "terminal_packet": 0.2754172619047619 + }, + "UDPLag": { + "_n": 588.0, + "disc_nll_ch2": 0.18541122448979594, + "disc_nll_ch3": 0.9008134353741496, + "disc_nll_ch4": 0.6156714285714285, + "disc_nll_ch5": 0.6325624149659863, + "disc_nll_ch6": 0.5111401360544218, + "disc_nll_ch7": 0.9485615646258503, + "disc_nll_total": 0.8280562925170067, + "terminal_flow": 0.8594561224489796, + "terminal_norm": 0.9084959183673469, + "terminal_packet": 0.8547681972789116 + }, + "WebDDoS": { + "_n": 438.0, + "disc_nll_ch2": 0.3928809360730593, + "disc_nll_ch3": 0.588125913242009, + "disc_nll_ch4": 0.7904533105022831, + "disc_nll_ch5": 0.6444325342465753, + "disc_nll_ch6": 0.6945710045662101, + "disc_nll_ch7": 0.6693925799086758, + "disc_nll_total": 0.6788864155251142, + "terminal_flow": 0.5628373287671232, + "terminal_norm": 0.5656429223744293, + "terminal_packet": 0.48402636986301373 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicddos2019.log b/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicddos2019.log new file mode 100644 index 0000000..0f6b617 --- /dev/null +++ b/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicddos2019.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 8,993,376 target rows +[sample] benign=10,000 attack=9,846 (17 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.1s +[eval] attack... +[score] 256/9,846 +[score] 5,376/9,846 +[eval] attack done 3.7s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicddos2019.json diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicddos2019.npz b/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicddos2019.npz new file mode 100644 index 0000000..b540d36 Binary files /dev/null and b/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicddos2019.npz differ diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicids2017.json b/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicids2017.json new file mode 100644 index 0000000..4261918 --- /dev/null +++ b/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicids2017.json @@ -0,0 +1,246 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44", + "target_store": "/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/full_store", + "n_benign": 10000, + "n_attack": 6772, + "n_score_keys": 10, + "overall": { + "disc_nll_ch2": { + "auroc": 0.721226166568222, + "auprc": 0.6438003243120708 + }, + "disc_nll_ch3": { + "auroc": 0.8803367468989959, + "auprc": 0.7993802981894146 + }, + "disc_nll_ch4": { + "auroc": 0.8499252731836978, + "auprc": 0.6852476292955001 + }, + "disc_nll_ch5": { + "auroc": 0.7790654385705849, + "auprc": 0.7734159488805993 + }, + "disc_nll_ch6": { + "auroc": 0.8707654016538687, + "auprc": 0.7319800673889773 + }, + "disc_nll_ch7": { + "auroc": 0.708824874483166, + "auprc": 0.7076127083335281 + }, + "disc_nll_total": { + "auroc": 0.9113563644418193, + "auprc": 0.8475837278485943 + }, + "terminal_flow": { + "auroc": 0.8604392572356762, + "auprc": 0.7364894428682575 + }, + "terminal_norm": { + "auroc": 0.7757138068517424, + "auprc": 0.7127167990109975 + }, + "terminal_packet": { + "auroc": 0.7952383417011223, + "auprc": 0.6585253586580818 + } + }, + "per_class": { + "Botnet": { + "_n": 666.0, + "disc_nll_ch2": 0.9441352852852851, + "disc_nll_ch3": 0.939136936936937, + "disc_nll_ch4": 0.9320546546546546, + "disc_nll_ch5": 0.8425438438438437, + "disc_nll_ch6": 0.8789022522522523, + "disc_nll_ch7": 0.3937675675675676, + "disc_nll_total": 0.9381797297297297, + "terminal_flow": 0.5587656156156157, + "terminal_norm": 0.9249785285285285, + "terminal_packet": 0.9472845345345345 + }, + "DDoS": { + "_n": 666.0, + "disc_nll_ch2": 0.9583249249249249, + "disc_nll_ch3": 0.9245039039039039, + "disc_nll_ch4": 0.9202267267267268, + "disc_nll_ch5": 0.977489039039039, + "disc_nll_ch6": 0.9452163663663663, + "disc_nll_ch7": 0.8350258258258259, + "disc_nll_total": 0.9728818318318319, + "terminal_flow": 0.9680355855855856, + "terminal_norm": 0.9540322072072073, + "terminal_packet": 0.9130448948948948 + }, + "DoS GoldenEye": { + "_n": 666.0, + "disc_nll_ch2": 0.8268415915915915, + "disc_nll_ch3": 0.8275339339339339, + "disc_nll_ch4": 0.8486504504504505, + "disc_nll_ch5": 0.9029005255255256, + "disc_nll_ch6": 0.7802249249249249, + "disc_nll_ch7": 0.762905930930931, + "disc_nll_total": 0.8276355855855855, + "terminal_flow": 0.9606605105105105, + "terminal_norm": 0.8713415915915916, + "terminal_packet": 0.8428878378378379 + }, + "DoS Hulk": { + "_n": 666.0, + "disc_nll_ch2": 0.8313093093093094, + "disc_nll_ch3": 0.8980432432432432, + "disc_nll_ch4": 0.9095327327327327, + "disc_nll_ch5": 0.968627027027027, + "disc_nll_ch6": 0.8479318318318319, + "disc_nll_ch7": 0.6696888888888889, + "disc_nll_total": 0.9200092342342342, + "terminal_flow": 0.9546082582582582, + "terminal_norm": 0.8273364864864864, + "terminal_packet": 0.8118635135135136 + }, + "DoS Slowhttptest": { + "_n": 666.0, + "disc_nll_ch2": 0.7999496996996996, + "disc_nll_ch3": 0.9051998498498499, + "disc_nll_ch4": 0.8748124624624624, + "disc_nll_ch5": 0.7365998498498498, + "disc_nll_ch6": 0.9135474474474475, + "disc_nll_ch7": 0.938615915915916, + "disc_nll_total": 0.9078483483483483, + "terminal_flow": 0.7607924174174174, + "terminal_norm": 0.8652219219219219, + "terminal_packet": 0.9039448948948949 + }, + "DoS Slowloris": { + "_n": 666.0, + "disc_nll_ch2": 0.5421816816816817, + "disc_nll_ch3": 0.8396224474474474, + "disc_nll_ch4": 0.7794300300300301, + "disc_nll_ch5": 0.8559978978978979, + "disc_nll_ch6": 0.8673512012012012, + "disc_nll_ch7": 0.8990031531531532, + "disc_nll_total": 0.796731981981982, + "terminal_flow": 0.7743848348348348, + "terminal_norm": 0.745453978978979, + "terminal_packet": 0.759918993993994 + }, + "FTP-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.9129599099099098, + "disc_nll_ch3": 0.8254268768768769, + "disc_nll_ch4": 0.8312368618618619, + "disc_nll_ch5": 0.6288638138138138, + "disc_nll_ch6": 0.9738755255255255, + "disc_nll_ch7": 0.6244105105105107, + "disc_nll_total": 0.9421458708708709, + "terminal_flow": 0.8859996996996997, + "terminal_norm": 0.44217042042042043, + "terminal_packet": 0.6482048048048047 + }, + "Heartbleed": { + "_n": 1.0, + "disc_nll_ch2": 0.42469999999999997, + "disc_nll_ch3": 0.6919000000000001, + "disc_nll_ch4": 0.6655, + "disc_nll_ch5": 0.2721, + "disc_nll_ch6": 0.8169000000000001, + "disc_nll_ch7": 0.4324, + "disc_nll_total": 0.6154999999999999, + "terminal_flow": 0.9941, + "terminal_norm": 0.5276000000000001, + "terminal_packet": 0.3617 + }, + "Infiltration": { + "_n": 7.0, + "disc_nll_ch2": 0.7727142857142858, + "disc_nll_ch3": 0.7560285714285715, + "disc_nll_ch4": 0.5711857142857142, + "disc_nll_ch5": 0.41147142857142854, + "disc_nll_ch6": 0.9817000000000001, + "disc_nll_ch7": 0.33120000000000005, + "disc_nll_total": 0.9182714285714286, + "terminal_flow": 0.9633714285714285, + "terminal_norm": 0.8117428571428571, + "terminal_packet": 0.823857142857143 + }, + "Infiltration - Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.22816036036036036, + "disc_nll_ch3": 0.9965462462462462, + "disc_nll_ch4": 0.8831762762762764, + "disc_nll_ch5": 0.957186036036036, + "disc_nll_ch6": 0.8162939939939942, + "disc_nll_ch7": 0.9965767267267266, + "disc_nll_total": 0.9955268768768769, + "terminal_flow": 0.9415906906906908, + "terminal_norm": 0.9906103603603604, + "terminal_packet": 0.9442421921921922 + }, + "Portscan": { + "_n": 666.0, + "disc_nll_ch2": 0.20033513513513518, + "disc_nll_ch3": 0.9988211711711711, + "disc_nll_ch4": 0.7957084084084084, + "disc_nll_ch5": 0.9931672672672672, + "disc_nll_ch6": 0.8624409909909909, + "disc_nll_ch7": 0.9954174174174174, + "disc_nll_total": 0.9948244744744745, + "terminal_flow": 0.8927423423423424, + "terminal_norm": 0.9898776276276277, + "terminal_packet": 0.9499590840840841 + }, + "SSH-Patator": { + "_n": 666.0, + "disc_nll_ch2": 0.9639689189189189, + "disc_nll_ch3": 0.6796471471471472, + "disc_nll_ch4": 0.783706006006006, + "disc_nll_ch5": 0.03124894894894895, + "disc_nll_ch6": 0.828976126126126, + "disc_nll_ch7": 0.017314114114114112, + "disc_nll_total": 0.8499822822822822, + "terminal_flow": 0.8863914414414414, + "terminal_norm": 0.18870975975975976, + "terminal_packet": 0.2980905405405405 + }, + "Web Attack - Brute Force": { + "_n": 73.0, + "disc_nll_ch2": 0.7255561643835616, + "disc_nll_ch3": 0.6678739726027397, + "disc_nll_ch4": 0.40266027397260273, + "disc_nll_ch5": 0.03728356164383562, + "disc_nll_ch6": 0.8267452054794521, + "disc_nll_ch7": 0.4042986301369863, + "disc_nll_total": 0.677413698630137, + "terminal_flow": 0.990572602739726, + "terminal_norm": 0.4362109589041096, + "terminal_packet": 0.2828924657534247 + }, + "Web Attack - SQL Injection": { + "_n": 13.0, + "disc_nll_ch2": 0.9741692307692308, + "disc_nll_ch3": 0.8622384615384615, + "disc_nll_ch4": 0.9542999999999999, + "disc_nll_ch5": 0.9080615384615385, + "disc_nll_ch6": 0.7073538461538461, + "disc_nll_ch7": 0.7965615384615385, + "disc_nll_total": 0.9239769230769231, + "terminal_flow": 0.9269076923076923, + "terminal_norm": 0.9008461538461539, + "terminal_packet": 0.8517230769230769 + }, + "Web Attack - XSS": { + "_n": 18.0, + "disc_nll_ch2": 0.6689444444444445, + "disc_nll_ch3": 0.6626444444444445, + "disc_nll_ch4": 0.5136666666666667, + "disc_nll_ch5": 0.018472222222222223, + "disc_nll_ch6": 0.8642166666666667, + "disc_nll_ch7": 0.39703333333333335, + "disc_nll_total": 0.6732611111111111, + "terminal_flow": 0.9928, + "terminal_norm": 0.4859777777777778, + "terminal_packet": 0.36410555555555557 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicids2017.log b/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicids2017.log new file mode 100644 index 0000000..4309ccb --- /dev/null +++ b/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicids2017.log @@ -0,0 +1,14 @@ +[model] T=64 flow_dim=20 +[data] 2,025,564 target rows +[sample] benign=10,000 attack=6,772 (15 classes) +[read] benign... +[read] attack... +[eval] benign... +[score] 256/10,000 +[score] 5,376/10,000 +[eval] benign done 4.1s +[eval] attack... +[score] 256/6,772 +[score] 5,376/6,772 +[eval] attack done 2.5s +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicids2017.json diff --git a/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicids2017.npz b/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicids2017.npz new file mode 100644 index 0000000..5f2db41 Binary files /dev/null and b/artifacts/route_comparison/cross/route_c_mixed_seed44_to_cicids2017.npz differ diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/config.yaml b/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/config.yaml new file mode 100644 index 0000000..5339b81 --- /dev/null +++ b/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/config.yaml @@ -0,0 +1,38 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 42 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_flow: 0.3 +lambda_packet: 0.3 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packet_mask_ratio: 0.5 +packet_preprocess: mixed_dequant +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed42 +seed: 42 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/history.json b/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/history.json new file mode 100644 index 0000000..14c245b --- /dev/null +++ b/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/history.json @@ -0,0 +1,243 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 2.238033175468445, + 1.817226767539978, + 1.5662063849277985, + 1.4072587948579054, + 1.2752790573315742, + 1.193662432523874, + 1.1450371008652906, + 1.108898870455913, + 1.0735895817096417, + 1.0577895045280457, + 1.0277574918208978, + 1.0097160935401917, + 1.0282559639368303, + 0.9791105893942026, + 0.9649578837247995, + 0.961730590233436, + 0.9695770847491729, + 0.9714717742724296, + 0.9672623429542933, + 0.9409348597893348, + 0.9365118604439956, + 0.9300545774973356, + 0.9261657045437739, + 0.9244897747651125, + 0.9169063461132538, + 0.9217088543451749, + 0.9034078793647962, + 0.9067876721039797, + 0.9019015049323057, + 0.9011738957502903, + 0.9013244937627743, + 0.905858759696667, + 0.8977580024645879, + 0.8992780492855952, + 0.8850476772357256, + 0.8794918549366486, + 0.8763358073356824, + 0.886012457884275, + 0.885632044229752, + 0.8829396733870873, + 0.8864376927033449, + 0.8805588269845034, + 0.8680836894573309, + 0.8799888522197039, + 0.8749009294387622, + 0.8746596299684964, + 0.8759351250452873, + 0.8706518151821234, + 0.8762231438587873, + 0.8713403023206271 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.89016877, + "auroc_curvature_flow": 0.16083334500000002, + "auroc_curvature_packet": 0.2594521575, + "auroc_curvature_total": 0.1578464475, + "auroc_kappa2_speed2norm_packet_mean": 0.1170257475, + "auroc_kappa2_speed2norm_packet_median": 0.111569045, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.1117750975, + "auroc_kinetic_energy": 0.870426615, + "auroc_kinetic_flow": 0.8370735249999999, + "auroc_kinetic_packet": 0.7699609024999999, + "auroc_terminal_flow": 0.942128105, + "auroc_terminal_norm": 0.95513179, + "auroc_terminal_packet": 0.9271642925, + "auroc_velocity_flow": 0.8451948499999999, + "auroc_velocity_packet": 0.9142869274999998, + "auroc_velocity_total": 0.9287384075 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9295808825, + "auroc_curvature_flow": 0.36604904250000003, + "auroc_curvature_packet": 0.7491478775, + "auroc_curvature_total": 0.6810056500000001, + "auroc_kappa2_speed2norm_packet_mean": 0.5271311875, + "auroc_kappa2_speed2norm_packet_median": 0.4884809, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.502468845, + "auroc_kinetic_energy": 0.9305613799999999, + "auroc_kinetic_flow": 0.8733380924999999, + "auroc_kinetic_packet": 0.912147585, + "auroc_terminal_flow": 0.951145405, + "auroc_terminal_norm": 0.95907392, + "auroc_terminal_packet": 0.9398947325, + "auroc_velocity_flow": 0.858767335, + "auroc_velocity_packet": 0.9152972024999999, + "auroc_velocity_total": 0.9167598375000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9256591675000001, + "auroc_curvature_flow": 0.30659346249999997, + "auroc_curvature_packet": 0.807186145, + "auroc_curvature_total": 0.7234342125, + "auroc_kappa2_speed2norm_packet_mean": 0.5187725575, + "auroc_kappa2_speed2norm_packet_median": 0.51105995, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.510866605, + "auroc_kinetic_energy": 0.9258068925, + "auroc_kinetic_flow": 0.8419064525, + "auroc_kinetic_packet": 0.913442605, + "auroc_terminal_flow": 0.9356219825, + "auroc_terminal_norm": 0.9512484575, + "auroc_terminal_packet": 0.9371528425000001, + "auroc_velocity_flow": 0.8446832575, + "auroc_velocity_packet": 0.9078160300000001, + "auroc_velocity_total": 0.9110325025 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9405529125, + "auroc_curvature_flow": 0.51914609, + "auroc_curvature_packet": 0.896103405, + "auroc_curvature_total": 0.8667373224999999, + "auroc_kappa2_speed2norm_packet_mean": 0.6648346649999999, + "auroc_kappa2_speed2norm_packet_median": 0.6551209524999999, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.6720477300000001, + "auroc_kinetic_energy": 0.9408768750000001, + "auroc_kinetic_flow": 0.88762196, + "auroc_kinetic_packet": 0.9296425024999999, + "auroc_terminal_flow": 0.9495424400000001, + "auroc_terminal_norm": 0.9657553875, + "auroc_terminal_packet": 0.95738354, + "auroc_velocity_flow": 0.8715021325000001, + "auroc_velocity_packet": 0.9180623825, + "auroc_velocity_total": 0.9163482325000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9437390875, + "auroc_curvature_flow": 0.611316565, + "auroc_curvature_packet": 0.9110215624999999, + "auroc_curvature_total": 0.893133625, + "auroc_kappa2_speed2norm_packet_mean": 0.62567911, + "auroc_kappa2_speed2norm_packet_median": 0.615938555, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.6305359399999999, + "auroc_kinetic_energy": 0.9440673074999999, + "auroc_kinetic_flow": 0.8885647625, + "auroc_kinetic_packet": 0.93673223, + "auroc_terminal_flow": 0.9508251, + "auroc_terminal_norm": 0.965289415, + "auroc_terminal_packet": 0.9564943875, + "auroc_velocity_flow": 0.8721793, + "auroc_velocity_packet": 0.9228134725000001, + "auroc_velocity_total": 0.9175251774999998 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/model.pt b/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/model.pt new file mode 100644 index 0000000..1c9b835 Binary files /dev/null and b/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/model.pt differ diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/phase1.log b/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/phase1.log new file mode 100644 index 0000000..262c8e3 --- /dev/null +++ b/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/phase1.log @@ -0,0 +1,132 @@ +[config] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/config.yaml +[model] T=64 flow_dim=20 packet_dim=9 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets_source=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] using external flow features D=20 +[data] rows total=8,193,621 keep len>=2: 3,797,530 +[data] benign=97,045 attack=20,000 -> train=77,636 val=10,000 +[data] train=77,636 val=10,000 attack=20,000 +[eval] scoring val=5,000 and attack=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done in 11.9s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] attack done in 23.1s +[eval] score keys: 57 first 5: ['arc_length', 'causal_surprisal_flow', 'causal_surprisal_packet_max', 'causal_surprisal_packet_mean', 'causal_surprisal_packet_median'] +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/phase1_summary.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/phase1_scores.npz + +=== overall AUROC (sorted desc) === + terminal_norm AUROC=0.9644 AUPRC=0.9842 + terminal_packet AUROC=0.9573 AUPRC=0.9821 + terminal_flow AUROC=0.9493 AUPRC=0.9711 + kinetic_energy AUROC=0.9486 AUPRC=0.9715 + arc_length AUROC=0.9483 AUPRC=0.9711 + kinetic_packet AUROC=0.9449 AUPRC=0.9770 + consistency_total AUROC=0.9300 AUPRC=0.9566 + velocity_total_t09 AUROC=0.9299 AUPRC=0.9449 + velocity_packet_t05 AUROC=0.9242 AUPRC=0.9521 + velocity_packet AUROC=0.9231 AUPRC=0.9576 + velocity_packet_t07 AUROC=0.9216 AUPRC=0.9573 + velocity_packet_t09 AUROC=0.9200 AUPRC=0.9603 + flow_consistency AUROC=0.9198 AUPRC=0.9493 + velocity_total AUROC=0.9191 AUPRC=0.9342 + velocity_total_t07 AUROC=0.9181 AUPRC=0.9360 + velocity_packet_t03 AUROC=0.9164 AUPRC=0.9449 + velocity_total_t10 AUROC=0.9157 AUPRC=0.9323 + velocity_total_t05 AUROC=0.9076 AUPRC=0.9284 + curvature_packet AUROC=0.9041 AUPRC=0.9521 + velocity_packet_t01 AUROC=0.9014 AUPRC=0.9314 + velocity_total_t03 AUROC=0.8938 AUPRC=0.9204 + kinetic_flow AUROC=0.8906 AUPRC=0.8904 + velocity_total_t01 AUROC=0.8889 AUPRC=0.9165 + velocity_flow_t09 AUROC=0.8798 AUPRC=0.8813 + velocity_flow_t10 AUROC=0.8751 AUPRC=0.8785 + velocity_flow AUROC=0.8745 AUPRC=0.8782 + velocity_flow_t07 AUROC=0.8725 AUPRC=0.8781 + velocity_flow_t05 AUROC=0.8679 AUPRC=0.8769 + curvature_total AUROC=0.8668 AUPRC=0.9244 + velocity_flow_t03 AUROC=0.8657 AUPRC=0.8798 + velocity_packet_t10 AUROC=0.8648 AUPRC=0.9360 + packet_consistency AUROC=0.8611 AUPRC=0.9334 + velocity_flow_t01 AUROC=0.8584 AUPRC=0.8822 + jacobian_packet AUROC=0.6093 AUPRC=0.7807 + pna_packet_max AUROC=0.5997 AUPRC=0.7323 + causal_surprisal_total AUROC=0.5764 AUPRC=0.7190 + causal_surprisal_packet_median AUROC=0.5708 AUPRC=0.6633 + causal_surprisal_packet_trimmed10_mean AUROC=0.5631 AUPRC=0.6581 + causal_surprisal_packet_mean AUROC=0.5630 AUPRC=0.6520 + causal_surprisal_flow AUROC=0.5612 AUPRC=0.6737 + causal_surprisal_packet_max AUROC=0.5591 AUPRC=0.6385 + kappa2_speed2norm_packet_mean AUROC=0.5359 AUPRC=0.6999 + pna_packet_mean AUROC=0.5359 AUPRC=0.6999 + kappa2_speed2norm_packet_trimmed10_mean AUROC=0.5302 AUPRC=0.7020 + pna_packet_trimmed10_mean AUROC=0.5302 AUPRC=0.7020 + kappa2_speed2norm_packet_median AUROC=0.5196 AUPRC=0.6941 + pna_packet_median AUROC=0.5196 AUPRC=0.6941 + curvature_flow AUROC=0.4456 AUPRC=0.6319 + jacobian_total AUROC=0.3398 AUPRC=0.6105 + direction_drift_packet_max AUROC=0.2965 AUPRC=0.5506 + jacobian_flow AUROC=0.1698 AUPRC=0.4883 + direction_drift_packet_median AUROC=0.1640 AUPRC=0.4953 + direction_drift_packet_trimmed10_mean AUROC=0.1625 AUPRC=0.4947 + direction_drift_packet_mean AUROC=0.1590 AUPRC=0.4932 + direction_drift_flow AUROC=0.1190 AUPRC=0.4745 + direction_drift_total AUROC=0.1164 AUPRC=0.4758 + pna_flow AUROC=0.0970 AUPRC=0.4692 diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/phase1_scores.npz b/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/phase1_scores.npz new file mode 100644 index 0000000..2b35a71 Binary files /dev/null and b/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/phase1_summary.json b/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/phase1_summary.json new file mode 100644 index 0000000..cd61b66 --- /dev/null +++ b/artifacts/route_comparison/route_a_causal_ciciot2023_seed42/phase1_summary.json @@ -0,0 +1,2232 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed42", + "config": { + "T": 64, + "attack_cap": 20000, + "batch_size": 256, + "benign_label": "normal", + "d_model": 128, + "data_seed": 42, + "device": "auto", + "epochs": 50, + "eval_batch_size": 512, + "eval_every": 10, + "eval_n": 20000, + "eval_n_steps": 8, + "flow_features_align": "auto", + "flow_features_path": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet", + "flows_parquet": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet", + "grad_clip": 1.0, + "lambda_flow": 0.3, + "lambda_packet": 0.3, + "lr": 0.0003, + "min_len": 2, + "mlp_ratio": 4.0, + "n_heads": 4, + "n_layers": 4, + "n_train": 10000, + "num_workers": 0, + "packet_mask_ratio": 0.5, + "packet_preprocess": "mixed_dequant", + "reference_mode": "causal_packets", + "save_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed42", + "seed": 42, + "sigma": 0.1, + "source_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "time_dim": 64, + "token_dim": null, + "train_ratio": 0.8, + "use_ot": true, + "val_cap": 10000, + "weight_decay": 0.01 + }, + "n_val": 5000, + "n_atk": 10000, + "n_score_keys": 57, + "overall": { + "arc_length": { + "auroc": 0.9483120700000001, + "auprc": 0.9711035498387922 + }, + "causal_surprisal_flow": { + "auroc": 0.56117869, + "auprc": 0.6736588976273972 + }, + "causal_surprisal_packet_max": { + "auroc": 0.55909184, + "auprc": 0.6385407087220232 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.56300116, + "auprc": 0.6519939671624484 + }, + "causal_surprisal_packet_median": { + "auroc": 0.5707785599999999, + "auprc": 0.6632945724768369 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.56306018, + "auprc": 0.6580897002436098 + }, + "causal_surprisal_total": { + "auroc": 0.57641876, + "auprc": 0.7190406743522402 + }, + "consistency_total": { + "auroc": 0.93001015, + "auprc": 0.956607250744286 + }, + "curvature_flow": { + "auroc": 0.44560889000000004, + "auprc": 0.6319025782287306 + }, + "curvature_packet": { + "auroc": 0.90406246, + "auprc": 0.9521321680627937 + }, + "curvature_total": { + "auroc": 0.8667515699999999, + "auprc": 0.9243884499033443 + }, + "direction_drift_flow": { + "auroc": 0.11896999, + "auprc": 0.47453165745287035 + }, + "direction_drift_packet_max": { + "auroc": 0.29651837999999997, + "auprc": 0.5505530938062662 + }, + "direction_drift_packet_mean": { + "auroc": 0.15900763, + "auprc": 0.4932266548729386 + }, + "direction_drift_packet_median": { + "auroc": 0.16400551, + "auprc": 0.4952747627653803 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.16245846, + "auprc": 0.4946721791951939 + }, + "direction_drift_total": { + "auroc": 0.11640906, + "auprc": 0.47582623393518514 + }, + "flow_consistency": { + "auroc": 0.9197531300000001, + "auprc": 0.9493205562764371 + }, + "jacobian_flow": { + "auroc": 0.16979185, + "auprc": 0.4882571275576331 + }, + "jacobian_packet": { + "auroc": 0.60930124, + "auprc": 0.7807141747274846 + }, + "jacobian_total": { + "auroc": 0.3397729, + "auprc": 0.6104979496630795 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.5359015300000001, + "auprc": 0.6999477579105872 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.51955371, + "auprc": 0.694068574445785 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.5301992899999999, + "auprc": 0.7019877337473632 + }, + "kinetic_energy": { + "auroc": 0.9486123599999999, + "auprc": 0.9715134527519258 + }, + "kinetic_flow": { + "auroc": 0.8906272700000001, + "auprc": 0.8904036836353917 + }, + "kinetic_packet": { + "auroc": 0.9448590799999999, + "auprc": 0.9769951002736852 + }, + "packet_consistency": { + "auroc": 0.8610773399999999, + "auprc": 0.9334209427454521 + }, + "pna_flow": { + "auroc": 0.09698164000000001, + "auprc": 0.4692163378641103 + }, + "pna_packet_max": { + "auroc": 0.59965452, + "auprc": 0.7322959806520443 + }, + "pna_packet_mean": { + "auroc": 0.5359015300000001, + "auprc": 0.6999477579105872 + }, + "pna_packet_median": { + "auroc": 0.51955371, + "auprc": 0.694068574445785 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.5301992899999999, + "auprc": 0.7019877337473632 + }, + "terminal_flow": { + "auroc": 0.94929195, + "auprc": 0.9711084779304329 + }, + "terminal_norm": { + "auroc": 0.96438216, + "auprc": 0.9842188619688541 + }, + "terminal_packet": { + "auroc": 0.9573461200000001, + "auprc": 0.9821130292923566 + }, + "velocity_flow": { + "auroc": 0.8744725, + "auprc": 0.8782473723525012 + }, + "velocity_flow_t01": { + "auroc": 0.85839008, + "auprc": 0.8821723281699212 + }, + "velocity_flow_t03": { + "auroc": 0.86566772, + "auprc": 0.8798005665421813 + }, + "velocity_flow_t05": { + "auroc": 0.86785617, + "auprc": 0.8768995334693529 + }, + "velocity_flow_t07": { + "auroc": 0.87253195, + "auprc": 0.8781189146637459 + }, + "velocity_flow_t09": { + "auroc": 0.87976984, + "auprc": 0.8813437889314132 + }, + "velocity_flow_t10": { + "auroc": 0.87513699, + "auprc": 0.8784864419595203 + }, + "velocity_packet": { + "auroc": 0.92310921, + "auprc": 0.957603720502579 + }, + "velocity_packet_t01": { + "auroc": 0.90141044, + "auprc": 0.9314096318698968 + }, + "velocity_packet_t03": { + "auroc": 0.916434, + "auprc": 0.944937469561046 + }, + "velocity_packet_t05": { + "auroc": 0.92424588, + "auprc": 0.952107941162434 + }, + "velocity_packet_t07": { + "auroc": 0.92155078, + "auprc": 0.9573107168153498 + }, + "velocity_packet_t09": { + "auroc": 0.91998901, + "auprc": 0.9602801298189216 + }, + "velocity_packet_t10": { + "auroc": 0.8648142999999999, + "auprc": 0.9360220467609772 + }, + "velocity_total": { + "auroc": 0.9191459399999999, + "auprc": 0.9342400003606643 + }, + "velocity_total_t01": { + "auroc": 0.88889732, + "auprc": 0.9165392638368461 + }, + "velocity_total_t03": { + "auroc": 0.89381347, + "auprc": 0.9203678034484108 + }, + "velocity_total_t05": { + "auroc": 0.90757839, + "auprc": 0.9283918943095719 + }, + "velocity_total_t07": { + "auroc": 0.9180895899999999, + "auprc": 0.9360071401115722 + }, + "velocity_total_t09": { + "auroc": 0.92994744, + "auprc": 0.9448753615594254 + }, + "velocity_total_t10": { + "auroc": 0.91570785, + "auprc": 0.9322564853256998 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 9.0, + "arc_length": 0.8759333333333332, + "causal_surprisal_flow": 0.6503555555555556, + "causal_surprisal_packet_max": 0.5401555555555555, + "causal_surprisal_packet_mean": 0.4692666666666666, + "causal_surprisal_packet_median": 0.46919999999999995, + "causal_surprisal_packet_trimmed10_mean": 0.4588666666666667, + "causal_surprisal_total": 0.4726888888888889, + "consistency_total": 0.7702444444444444, + "curvature_flow": 0.6960444444444445, + "curvature_packet": 0.6732444444444444, + "curvature_total": 0.6828888888888889, + "direction_drift_flow": 0.11657777777777775, + "direction_drift_packet_max": 0.44326666666666664, + "direction_drift_packet_mean": 0.1967111111111111, + "direction_drift_packet_median": 0.24546666666666667, + "direction_drift_packet_trimmed10_mean": 0.2164888888888889, + "direction_drift_total": 0.1862888888888889, + "flow_consistency": 0.7509111111111111, + "jacobian_flow": 0.10922222222222222, + "jacobian_packet": 0.3814444444444444, + "jacobian_total": 0.1555111111111111, + "kappa2_speed2norm_packet_mean": 0.4870444444444444, + "kappa2_speed2norm_packet_median": 0.43611111111111117, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4962888888888889, + "kinetic_energy": 0.8716444444444444, + "kinetic_flow": 0.8861333333333333, + "kinetic_packet": 0.7699555555555555, + "packet_consistency": 0.6480666666666666, + "pna_flow": 0.1703333333333333, + "pna_packet_max": 0.6264222222222222, + "pna_packet_mean": 0.4870444444444444, + "pna_packet_median": 0.43611111111111117, + "pna_packet_trimmed10_mean": 0.4962888888888889, + "terminal_flow": 0.8623555555555555, + "terminal_norm": 0.8455777777777778, + "terminal_packet": 0.7920666666666667, + "velocity_flow": 0.8878666666666666, + "velocity_flow_t01": 0.8640666666666666, + "velocity_flow_t03": 0.8805777777777778, + "velocity_flow_t05": 0.8807333333333334, + "velocity_flow_t07": 0.8835111111111111, + "velocity_flow_t09": 0.9015333333333333, + "velocity_flow_t10": 0.9017999999999999, + "velocity_packet": 0.8471555555555554, + "velocity_packet_t01": 0.8454666666666666, + "velocity_packet_t03": 0.8422444444444445, + "velocity_packet_t05": 0.8353333333333333, + "velocity_packet_t07": 0.8024444444444444, + "velocity_packet_t09": 0.8328666666666666, + "velocity_packet_t10": 0.8163333333333334, + "velocity_total": 0.8811333333333333, + "velocity_total_t01": 0.8552666666666666, + "velocity_total_t03": 0.8585111111111111, + "velocity_total_t05": 0.8669777777777777, + "velocity_total_t07": 0.8694222222222222, + "velocity_total_t09": 0.8904222222222221, + "velocity_total_t10": 0.9136888888888889 + }, + "commandinjection": { + "_n": 11.0, + "arc_length": 0.7877272727272726, + "causal_surprisal_flow": 0.5304363636363636, + "causal_surprisal_packet_max": 0.3841272727272727, + "causal_surprisal_packet_mean": 0.3962727272727273, + "causal_surprisal_packet_median": 0.4157636363636364, + "causal_surprisal_packet_trimmed10_mean": 0.40387272727272727, + "causal_surprisal_total": 0.4958181818181818, + "consistency_total": 0.7280363636363636, + "curvature_flow": 0.6322363636363637, + "curvature_packet": 0.5466545454545455, + "curvature_total": 0.5977818181818182, + "direction_drift_flow": 0.18109090909090905, + "direction_drift_packet_max": 0.35856363636363636, + "direction_drift_packet_mean": 0.2781272727272727, + "direction_drift_packet_median": 0.2706727272727273, + "direction_drift_packet_trimmed10_mean": 0.29214545454545454, + "direction_drift_total": 0.22585454545454545, + "flow_consistency": 0.7590181818181818, + "jacobian_flow": 0.3695636363636363, + "jacobian_packet": 0.5001636363636364, + "jacobian_total": 0.4903818181818182, + "kappa2_speed2norm_packet_mean": 0.466890909090909, + "kappa2_speed2norm_packet_median": 0.4651818181818182, + "kappa2_speed2norm_packet_trimmed10_mean": 0.487090909090909, + "kinetic_energy": 0.7887272727272727, + "kinetic_flow": 0.7438545454545454, + "kinetic_packet": 0.7030545454545455, + "packet_consistency": 0.49174545454545454, + "pna_flow": 0.25136363636363634, + "pna_packet_max": 0.4669090909090909, + "pna_packet_mean": 0.466890909090909, + "pna_packet_median": 0.4651818181818182, + "pna_packet_trimmed10_mean": 0.487090909090909, + "terminal_flow": 0.8622727272727273, + "terminal_norm": 0.8026181818181818, + "terminal_packet": 0.6843818181818182, + "velocity_flow": 0.7464727272727272, + "velocity_flow_t01": 0.6582727272727272, + "velocity_flow_t03": 0.6690545454545455, + "velocity_flow_t05": 0.6717454545454545, + "velocity_flow_t07": 0.6873090909090909, + "velocity_flow_t09": 0.7750363636363636, + "velocity_flow_t10": 0.7823090909090908, + "velocity_packet": 0.6745454545454546, + "velocity_packet_t01": 0.652109090909091, + "velocity_packet_t03": 0.6407999999999999, + "velocity_packet_t05": 0.6412727272727272, + "velocity_packet_t07": 0.6326181818181817, + "velocity_packet_t09": 0.6517272727272727, + "velocity_packet_t10": 0.7178181818181819, + "velocity_total": 0.7723454545454546, + "velocity_total_t01": 0.6723818181818182, + "velocity_total_t03": 0.6743272727272728, + "velocity_total_t05": 0.6841090909090909, + "velocity_total_t07": 0.7085818181818182, + "velocity_total_t09": 0.7913636363636363, + "velocity_total_t10": 0.8060545454545455 + }, + "ddos-ack_fragmentation": { + "_n": 310.0, + "arc_length": 0.9811961290322581, + "causal_surprisal_flow": 0.40135612903225815, + "causal_surprisal_packet_max": 0.34295548387096775, + "causal_surprisal_packet_mean": 0.23344709677419356, + "causal_surprisal_packet_median": 0.2516212903225806, + "causal_surprisal_packet_trimmed10_mean": 0.2360490322580645, + "causal_surprisal_total": 0.3995696774193548, + "consistency_total": 0.9644400000000001, + "curvature_flow": 0.26479483870967746, + "curvature_packet": 0.9709212903225807, + "curvature_total": 0.9049864516129031, + "direction_drift_flow": 0.11284322580645162, + "direction_drift_packet_max": 0.20207032258064517, + "direction_drift_packet_mean": 0.13895354838709678, + "direction_drift_packet_median": 0.15531548387096775, + "direction_drift_packet_trimmed10_mean": 0.1618083870967742, + "direction_drift_total": 0.05660806451612903, + "flow_consistency": 0.9436303225806452, + "jacobian_flow": 0.03504387096774193, + "jacobian_packet": 0.9487064516129031, + "jacobian_total": 0.4747416129032258, + "kappa2_speed2norm_packet_mean": 0.40404903225806454, + "kappa2_speed2norm_packet_median": 0.4161516129032258, + "kappa2_speed2norm_packet_trimmed10_mean": 0.425701935483871, + "kinetic_energy": 0.9812129032258065, + "kinetic_flow": 0.9304612903225806, + "kinetic_packet": 0.9764567741935485, + "packet_consistency": 0.944238064516129, + "pna_flow": 0.03830387096774193, + "pna_packet_max": 0.31568516129032254, + "pna_packet_mean": 0.40404903225806454, + "pna_packet_median": 0.4161516129032258, + "pna_packet_trimmed10_mean": 0.425701935483871, + "terminal_flow": 0.9835722580645161, + "terminal_norm": 0.9859193548387097, + "terminal_packet": 0.9811167741935484, + "velocity_flow": 0.9194380645161291, + "velocity_flow_t01": 0.9493567741935482, + "velocity_flow_t03": 0.9392270967741936, + "velocity_flow_t05": 0.929165806451613, + "velocity_flow_t07": 0.9204509677419355, + "velocity_flow_t09": 0.9125051612903226, + "velocity_flow_t10": 0.9073277419354838, + "velocity_packet": 0.9716277419354838, + "velocity_packet_t01": 0.9717625806451612, + "velocity_packet_t03": 0.9740670967741936, + "velocity_packet_t05": 0.9715774193548387, + "velocity_packet_t07": 0.9699116129032259, + "velocity_packet_t09": 0.9697935483870969, + "velocity_packet_t10": 0.9273941935483869, + "velocity_total": 0.9752612903225807, + "velocity_total_t01": 0.9800090322580643, + "velocity_total_t03": 0.9791354838709677, + "velocity_total_t05": 0.9770632258064517, + "velocity_total_t07": 0.9761180645161288, + "velocity_total_t09": 0.974768064516129, + "velocity_total_t10": 0.9727380645161292 + }, + "ddos-http_flood": { + "_n": 918.0, + "arc_length": 0.9459503267973856, + "causal_surprisal_flow": 0.5811747276688454, + "causal_surprisal_packet_max": 0.6256538126361655, + "causal_surprisal_packet_mean": 0.6181703703703704, + "causal_surprisal_packet_median": 0.627517211328976, + "causal_surprisal_packet_trimmed10_mean": 0.6168862745098039, + "causal_surprisal_total": 0.5844954248366013, + "consistency_total": 0.9349699346405229, + "curvature_flow": 0.4824143790849673, + "curvature_packet": 0.9000664488017428, + "curvature_total": 0.8577607843137255, + "direction_drift_flow": 0.1348438997821351, + "direction_drift_packet_max": 0.397460348583878, + "direction_drift_packet_mean": 0.2768847494553377, + "direction_drift_packet_median": 0.28485925925925926, + "direction_drift_packet_trimmed10_mean": 0.292940522875817, + "direction_drift_total": 0.17113551198257082, + "flow_consistency": 0.8713217864923749, + "jacobian_flow": 0.25618540305010895, + "jacobian_packet": 0.6106795206971678, + "jacobian_total": 0.46409847494553375, + "kappa2_speed2norm_packet_mean": 0.6509943355119825, + "kappa2_speed2norm_packet_median": 0.655809586056645, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6636173202614379, + "kinetic_energy": 0.9469528322440086, + "kinetic_flow": 0.8726546840958607, + "kinetic_packet": 0.9557618736383443, + "packet_consistency": 0.8785514161220043, + "pna_flow": 0.09489716775599129, + "pna_packet_max": 0.6595488017429194, + "pna_packet_mean": 0.6509943355119825, + "pna_packet_median": 0.655809586056645, + "pna_packet_trimmed10_mean": 0.6636173202614379, + "terminal_flow": 0.9711799564270152, + "terminal_norm": 0.9903159041394336, + "terminal_packet": 0.9837647058823529, + "velocity_flow": 0.8626915032679738, + "velocity_flow_t01": 0.8416917211328977, + "velocity_flow_t03": 0.8495590413943356, + "velocity_flow_t05": 0.8555080610021786, + "velocity_flow_t07": 0.8597343137254901, + "velocity_flow_t09": 0.8655496732026143, + "velocity_flow_t10": 0.8648265795206971, + "velocity_packet": 0.9022183006535948, + "velocity_packet_t01": 0.9337091503267975, + "velocity_packet_t03": 0.9444091503267974, + "velocity_packet_t05": 0.9430479302832243, + "velocity_packet_t07": 0.9145553376906318, + "velocity_packet_t09": 0.8854032679738562, + "velocity_packet_t10": 0.7025712418300654, + "velocity_total": 0.9155923747276689, + "velocity_total_t01": 0.8746620915032678, + "velocity_total_t03": 0.8795874727668845, + "velocity_total_t05": 0.9087953159041395, + "velocity_total_t07": 0.917334422657952, + "velocity_total_t09": 0.9217481481481482, + "velocity_total_t10": 0.8929762527233115 + }, + "ddos-icmp_flood": { + "_n": 24.0, + "arc_length": 0.5581708333333333, + "causal_surprisal_flow": 0.5216416666666668, + "causal_surprisal_packet_max": 0.43033333333333335, + "causal_surprisal_packet_mean": 0.4079, + "causal_surprisal_packet_median": 0.4050083333333333, + "causal_surprisal_packet_trimmed10_mean": 0.39912499999999995, + "causal_surprisal_total": 0.46426666666666666, + "consistency_total": 0.5798833333333333, + "curvature_flow": 0.443525, + "curvature_packet": 0.4750166666666667, + "curvature_total": 0.5107333333333333, + "direction_drift_flow": 0.286475, + "direction_drift_packet_max": 0.5011083333333334, + "direction_drift_packet_mean": 0.48555833333333337, + "direction_drift_packet_median": 0.4747166666666667, + "direction_drift_packet_trimmed10_mean": 0.4990583333333334, + "direction_drift_total": 0.40536666666666665, + "flow_consistency": 0.6338333333333334, + "jacobian_flow": 0.3113, + "jacobian_packet": 0.40925, + "jacobian_total": 0.3925, + "kappa2_speed2norm_packet_mean": 0.4767, + "kappa2_speed2norm_packet_median": 0.4669416666666667, + "kappa2_speed2norm_packet_trimmed10_mean": 0.47595, + "kinetic_energy": 0.55795, + "kinetic_flow": 0.640425, + "kinetic_packet": 0.449425, + "packet_consistency": 0.34853333333333336, + "pna_flow": 0.41677499999999995, + "pna_packet_max": 0.4985333333333333, + "pna_packet_mean": 0.4767, + "pna_packet_median": 0.4669416666666667, + "pna_packet_trimmed10_mean": 0.47595, + "terminal_flow": 0.6615416666666667, + "terminal_norm": 0.6001666666666667, + "terminal_packet": 0.5651333333333334, + "velocity_flow": 0.5858, + "velocity_flow_t01": 0.5682333333333333, + "velocity_flow_t03": 0.5676916666666667, + "velocity_flow_t05": 0.5609000000000001, + "velocity_flow_t07": 0.5808333333333333, + "velocity_flow_t09": 0.6212083333333333, + "velocity_flow_t10": 0.6018, + "velocity_packet": 0.48629166666666673, + "velocity_packet_t01": 0.50405, + "velocity_packet_t03": 0.494925, + "velocity_packet_t05": 0.48919999999999997, + "velocity_packet_t07": 0.485125, + "velocity_packet_t09": 0.5261, + "velocity_packet_t10": 0.5056250000000001, + "velocity_total": 0.5305583333333334, + "velocity_total_t01": 0.523675, + "velocity_total_t03": 0.516475, + "velocity_total_t05": 0.5194499999999999, + "velocity_total_t07": 0.5384666666666666, + "velocity_total_t09": 0.5727499999999999, + "velocity_total_t10": 0.556475 + }, + "ddos-icmp_fragmentation": { + "_n": 37.0, + "arc_length": 0.7701567567567569, + "causal_surprisal_flow": 0.5737297297297298, + "causal_surprisal_packet_max": 0.4731405405405406, + "causal_surprisal_packet_mean": 0.4382162162162162, + "causal_surprisal_packet_median": 0.43056216216216214, + "causal_surprisal_packet_trimmed10_mean": 0.4299783783783784, + "causal_surprisal_total": 0.5250972972972973, + "consistency_total": 0.7083351351351351, + "curvature_flow": 0.3810486486486486, + "curvature_packet": 0.6373513513513515, + "curvature_total": 0.6145783783783785, + "direction_drift_flow": 0.1822810810810811, + "direction_drift_packet_max": 0.4580324324324324, + "direction_drift_packet_mean": 0.4056054054054054, + "direction_drift_packet_median": 0.3980108108108108, + "direction_drift_packet_trimmed10_mean": 0.42334594594594593, + "direction_drift_total": 0.3413675675675676, + "flow_consistency": 0.7246702702702703, + "jacobian_flow": 0.2226, + "jacobian_packet": 0.47301081081081087, + "jacobian_total": 0.35134054054054054, + "kappa2_speed2norm_packet_mean": 0.5839351351351352, + "kappa2_speed2norm_packet_median": 0.5524729729729729, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5935945945945945, + "kinetic_energy": 0.7698270270270271, + "kinetic_flow": 0.7222000000000001, + "kinetic_packet": 0.6464918918918918, + "packet_consistency": 0.4204162162162162, + "pna_flow": 0.20074054054054052, + "pna_packet_max": 0.5676810810810811, + "pna_packet_mean": 0.5839351351351352, + "pna_packet_median": 0.5524729729729729, + "pna_packet_trimmed10_mean": 0.5935945945945945, + "terminal_flow": 0.8343243243243245, + "terminal_norm": 0.8511513513513513, + "terminal_packet": 0.802291891891892, + "velocity_flow": 0.7383513513513514, + "velocity_flow_t01": 0.6804864864864866, + "velocity_flow_t03": 0.699572972972973, + "velocity_flow_t05": 0.7093351351351351, + "velocity_flow_t07": 0.7243729729729731, + "velocity_flow_t09": 0.7607027027027027, + "velocity_flow_t10": 0.761145945945946, + "velocity_packet": 0.663864864864865, + "velocity_packet_t01": 0.7034432432432433, + "velocity_packet_t03": 0.6899567567567567, + "velocity_packet_t05": 0.6764270270270271, + "velocity_packet_t07": 0.6383675675675675, + "velocity_packet_t09": 0.6566810810810811, + "velocity_packet_t10": 0.6407027027027026, + "velocity_total": 0.7625513513513513, + "velocity_total_t01": 0.7320162162162163, + "velocity_total_t03": 0.7266918918918919, + "velocity_total_t05": 0.7369513513513514, + "velocity_total_t07": 0.7571189189189189, + "velocity_total_t09": 0.7869405405405405, + "velocity_total_t10": 0.7547351351351351 + }, + "ddos-pshack_flood": { + "_n": 1030.0, + "arc_length": 0.9919671844660193, + "causal_surprisal_flow": 0.5888448543689321, + "causal_surprisal_packet_max": 0.5657034951456311, + "causal_surprisal_packet_mean": 0.579971067961165, + "causal_surprisal_packet_median": 0.5861990291262137, + "causal_surprisal_packet_trimmed10_mean": 0.5815267961165048, + "causal_surprisal_total": 0.5939576699029127, + "consistency_total": 0.9762640776699029, + "curvature_flow": 0.4866153398058252, + "curvature_packet": 0.9867236893203885, + "curvature_total": 0.967842718446602, + "direction_drift_flow": 0.04561475728155339, + "direction_drift_packet_max": 0.21661067961165048, + "direction_drift_packet_mean": 0.04217689320388349, + "direction_drift_packet_median": 0.040764271844660194, + "direction_drift_packet_trimmed10_mean": 0.04005902912621359, + "direction_drift_total": 0.03008932038834951, + "flow_consistency": 0.9721811650485438, + "jacobian_flow": 0.05561398058252426, + "jacobian_packet": 0.5308943689320389, + "jacobian_total": 0.14430679611650488, + "kappa2_speed2norm_packet_mean": 0.4180311650485437, + "kappa2_speed2norm_packet_median": 0.43752582524271844, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4157631067961165, + "kinetic_energy": 0.9921467961165048, + "kinetic_flow": 0.9515339805825244, + "kinetic_packet": 0.998415922330097, + "packet_consistency": 0.9546134951456311, + "pna_flow": 0.04550252427184466, + "pna_packet_max": 0.4021784466019417, + "pna_packet_mean": 0.4180311650485437, + "pna_packet_median": 0.43752582524271844, + "pna_packet_trimmed10_mean": 0.4157631067961165, + "terminal_flow": 0.962667281553398, + "terminal_norm": 0.9957196116504854, + "terminal_packet": 0.9974300970873786, + "velocity_flow": 0.937637281553398, + "velocity_flow_t01": 0.9537114563106796, + "velocity_flow_t03": 0.945506213592233, + "velocity_flow_t05": 0.9411722330097088, + "velocity_flow_t07": 0.9404132038834951, + "velocity_flow_t09": 0.9374986407766991, + "velocity_flow_t10": 0.9334087378640776, + "velocity_packet": 0.9900042718446602, + "velocity_packet_t01": 0.9829322330097088, + "velocity_packet_t03": 0.9881815533980582, + "velocity_packet_t05": 0.9892469902912621, + "velocity_packet_t07": 0.9892728155339806, + "velocity_packet_t09": 0.9908217475728155, + "velocity_packet_t10": 0.9767706796116506, + "velocity_total": 0.97182213592233, + "velocity_total_t01": 0.9669234951456311, + "velocity_total_t03": 0.9691864077669902, + "velocity_total_t05": 0.9703858252427184, + "velocity_total_t07": 0.9718652427184464, + "velocity_total_t09": 0.9785873786407767, + "velocity_total_t10": 0.9686403883495146 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "arc_length": 0.5876, + "causal_surprisal_flow": 0.9725, + "causal_surprisal_packet_max": 0.6496, + "causal_surprisal_packet_mean": 0.595, + "causal_surprisal_packet_median": 0.5922, + "causal_surprisal_packet_trimmed10_mean": 0.591, + "causal_surprisal_total": 0.5548, + "consistency_total": 0.5083, + "curvature_flow": 0.9108, + "curvature_packet": 0.7709, + "curvature_total": 0.7989999999999999, + "direction_drift_flow": 0.07020000000000004, + "direction_drift_packet_max": 0.7720999999999999, + "direction_drift_packet_mean": 0.1627, + "direction_drift_packet_median": 0.12390000000000001, + "direction_drift_packet_trimmed10_mean": 0.15849999999999997, + "direction_drift_total": 0.27649999999999997, + "flow_consistency": 0.5099, + "jacobian_flow": 0.019199999999999995, + "jacobian_packet": 0.0038000000000000256, + "jacobian_total": 0.0031999999999999806, + "kappa2_speed2norm_packet_mean": 0.5715, + "kappa2_speed2norm_packet_median": 0.5776, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5811999999999999, + "kinetic_energy": 0.5768, + "kinetic_flow": 0.9494999999999999, + "kinetic_packet": 0.5224, + "packet_consistency": 0.402, + "pna_flow": 0.1587, + "pna_packet_max": 0.7701, + "pna_packet_mean": 0.5715, + "pna_packet_median": 0.5776, + "pna_packet_trimmed10_mean": 0.5811999999999999, + "terminal_flow": 0.9671, + "terminal_norm": 0.8755000000000001, + "terminal_packet": 0.8417, + "velocity_flow": 0.9774999999999999, + "velocity_flow_t01": 0.9442, + "velocity_flow_t03": 0.9454, + "velocity_flow_t05": 0.9525, + "velocity_flow_t07": 0.9652999999999999, + "velocity_flow_t09": 0.9818, + "velocity_flow_t10": 0.9858, + "velocity_packet": 0.9369999999999999, + "velocity_packet_t01": 0.8823, + "velocity_packet_t03": 0.9105000000000001, + "velocity_packet_t05": 0.9099, + "velocity_packet_t07": 0.8924, + "velocity_packet_t09": 0.9674, + "velocity_packet_t10": 0.9456999999999999, + "velocity_total": 0.8692, + "velocity_total_t01": 0.8379, + "velocity_total_t03": 0.8316, + "velocity_total_t05": 0.8301999999999998, + "velocity_total_t07": 0.8512, + "velocity_total_t09": 0.9095000000000001, + "velocity_total_t10": 0.9071 + }, + "ddos-slowloris": { + "_n": 304.0, + "arc_length": 0.9107355263157896, + "causal_surprisal_flow": 0.7663075657894737, + "causal_surprisal_packet_max": 0.7028973684210527, + "causal_surprisal_packet_mean": 0.6983282894736843, + "causal_surprisal_packet_median": 0.6988276315789475, + "causal_surprisal_packet_trimmed10_mean": 0.6936217105263157, + "causal_surprisal_total": 0.7379276315789474, + "consistency_total": 0.893989802631579, + "curvature_flow": 0.35761315789473686, + "curvature_packet": 0.9046993421052631, + "curvature_total": 0.8687789473684211, + "direction_drift_flow": 0.15704736842105263, + "direction_drift_packet_max": 0.7035697368421052, + "direction_drift_packet_mean": 0.4785276315789474, + "direction_drift_packet_median": 0.4617032894736842, + "direction_drift_packet_trimmed10_mean": 0.43296940789473687, + "direction_drift_total": 0.504328947368421, + "flow_consistency": 0.9017177631578948, + "jacobian_flow": 0.1835934210526316, + "jacobian_packet": 0.22383157894736838, + "jacobian_total": 0.18442960526315788, + "kappa2_speed2norm_packet_mean": 0.8390190789473686, + "kappa2_speed2norm_packet_median": 0.8147032894736843, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8104190789473684, + "kinetic_energy": 0.9110361842105265, + "kinetic_flow": 0.864178947368421, + "kinetic_packet": 0.9064796052631579, + "packet_consistency": 0.6367144736842105, + "pna_flow": 0.08180921052631579, + "pna_packet_max": 0.8520592105263157, + "pna_packet_mean": 0.8390190789473686, + "pna_packet_median": 0.8147032894736843, + "pna_packet_trimmed10_mean": 0.8104190789473684, + "terminal_flow": 0.949679605263158, + "terminal_norm": 0.9641059210526316, + "terminal_packet": 0.9525414473684211, + "velocity_flow": 0.8503822368421052, + "velocity_flow_t01": 0.8173565789473684, + "velocity_flow_t03": 0.8286315789473685, + "velocity_flow_t05": 0.8359006578947369, + "velocity_flow_t07": 0.8435967105263159, + "velocity_flow_t09": 0.8608072368421053, + "velocity_flow_t10": 0.8613953947368421, + "velocity_packet": 0.8432098684210526, + "velocity_packet_t01": 0.8512796052631578, + "velocity_packet_t03": 0.8797151315789473, + "velocity_packet_t05": 0.8892157894736843, + "velocity_packet_t07": 0.8469447368421053, + "velocity_packet_t09": 0.8680828947368421, + "velocity_packet_t10": 0.7058519736842106, + "velocity_total": 0.8637592105263157, + "velocity_total_t01": 0.8303730263157896, + "velocity_total_t03": 0.83576875, + "velocity_total_t05": 0.8584625, + "velocity_total_t07": 0.8700506578947368, + "velocity_total_t09": 0.8786815789473684, + "velocity_total_t10": 0.8260657894736844 + }, + "ddos-syn_flood": { + "_n": 1195.0, + "arc_length": 0.9895769037656904, + "causal_surprisal_flow": 0.6057046025104603, + "causal_surprisal_packet_max": 0.5989661924686193, + "causal_surprisal_packet_mean": 0.6135698744769874, + "causal_surprisal_packet_median": 0.6366816736401674, + "causal_surprisal_packet_trimmed10_mean": 0.6115338912133891, + "causal_surprisal_total": 0.6397917991631799, + "consistency_total": 0.979302761506276, + "curvature_flow": 0.4309442677824268, + "curvature_packet": 0.9843631799163179, + "curvature_total": 0.9679318828451884, + "direction_drift_flow": 0.0949976569037657, + "direction_drift_packet_max": 0.15173271966527196, + "direction_drift_packet_mean": 0.07458225941422594, + "direction_drift_packet_median": 0.08170058577405859, + "direction_drift_packet_trimmed10_mean": 0.07328820083682008, + "direction_drift_total": 0.05050694560669457, + "flow_consistency": 0.974410711297071, + "jacobian_flow": 0.060095564853556487, + "jacobian_packet": 0.5515795815899581, + "jacobian_total": 0.15378979079497906, + "kappa2_speed2norm_packet_mean": 0.5628071129707113, + "kappa2_speed2norm_packet_median": 0.563597740585774, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5293056066945606, + "kinetic_energy": 0.9897526359832636, + "kinetic_flow": 0.9481969874476988, + "kinetic_packet": 0.9952435146443515, + "packet_consistency": 0.9848795815899581, + "pna_flow": 0.03870995815899582, + "pna_packet_max": 0.6170210878661088, + "pna_packet_mean": 0.5628071129707113, + "pna_packet_median": 0.563597740585774, + "pna_packet_trimmed10_mean": 0.5293056066945606, + "terminal_flow": 0.9920841841004183, + "terminal_norm": 0.9965939748953975, + "terminal_packet": 0.9950297907949791, + "velocity_flow": 0.9309410878661086, + "velocity_flow_t01": 0.951888870292887, + "velocity_flow_t03": 0.9460262761506276, + "velocity_flow_t05": 0.9407002510460252, + "velocity_flow_t07": 0.9337084518828451, + "velocity_flow_t09": 0.9273682008368201, + "velocity_flow_t10": 0.9239636820083682, + "velocity_packet": 0.9834366527196651, + "velocity_packet_t01": 0.9706702928870292, + "velocity_packet_t03": 0.9807563179916319, + "velocity_packet_t05": 0.9831720502092051, + "velocity_packet_t07": 0.9823104602510461, + "velocity_packet_t09": 0.9840405020920501, + "velocity_packet_t10": 0.9650097071129707, + "velocity_total": 0.9724090376569038, + "velocity_total_t01": 0.96019179916318, + "velocity_total_t03": 0.9670497071129706, + "velocity_total_t05": 0.97207230125523, + "velocity_total_t07": 0.9747564853556485, + "velocity_total_t09": 0.9759673640167364, + "velocity_total_t10": 0.9649770711297071 + }, + "ddos-synonymousip_flood": { + "_n": 164.0, + "arc_length": 0.9877146341463414, + "causal_surprisal_flow": 0.39884390243902434, + "causal_surprisal_packet_max": 0.022419512195121963, + "causal_surprisal_packet_mean": 0.0078109756097561, + "causal_surprisal_packet_median": 0.0075780487804877955, + "causal_surprisal_packet_trimmed10_mean": 0.007060975609756102, + "causal_surprisal_total": 0.005162195121951223, + "consistency_total": 0.9999878048780487, + "curvature_flow": 0.0, + "curvature_packet": 0.9861073170731708, + "curvature_total": 0.9801707317073172, + "direction_drift_flow": 0.007013414634146345, + "direction_drift_packet_max": 0.4787280487804878, + "direction_drift_packet_mean": 0.015315853658536587, + "direction_drift_packet_median": 0.017062195121951215, + "direction_drift_packet_trimmed10_mean": 0.012753658536585367, + "direction_drift_total": 0.032970731707317076, + "flow_consistency": 0.9999865853658537, + "jacobian_flow": 0.003385365853658537, + "jacobian_packet": 0.15089024390243902, + "jacobian_total": 0.08091463414634147, + "kappa2_speed2norm_packet_mean": 0.30228414634146344, + "kappa2_speed2norm_packet_median": 0.24689756097560975, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2502689024390244, + "kinetic_energy": 0.9880853658536586, + "kinetic_flow": 0.8865121951219511, + "kinetic_packet": 0.9998060975609756, + "packet_consistency": 0.7939195121951219, + "pna_flow": 1.219512195121817e-06, + "pna_packet_max": 0.8836609756097561, + "pna_packet_mean": 0.30228414634146344, + "pna_packet_median": 0.24689756097560975, + "pna_packet_trimmed10_mean": 0.2502689024390244, + "terminal_flow": 0.9999963414634147, + "terminal_norm": 0.9999963414634147, + "terminal_packet": 0.9992475609756097, + "velocity_flow": 0.8809256097560976, + "velocity_flow_t01": 0.852619512195122, + "velocity_flow_t03": 0.8499121951219513, + "velocity_flow_t05": 0.8514341463414633, + "velocity_flow_t07": 0.8782560975609758, + "velocity_flow_t09": 0.8943865853658536, + "velocity_flow_t10": 0.9043646341463414, + "velocity_packet": 0.9946475609756098, + "velocity_packet_t01": 0.9874621951219513, + "velocity_packet_t03": 0.9919146341463415, + "velocity_packet_t05": 0.9926487804878048, + "velocity_packet_t07": 0.9942939024390244, + "velocity_packet_t09": 0.9951365853658537, + "velocity_packet_t10": 0.9981365853658536, + "velocity_total": 0.9391853658536586, + "velocity_total_t01": 0.8906743902439024, + "velocity_total_t03": 0.9308012195121951, + "velocity_total_t05": 0.9357853658536585, + "velocity_total_t07": 0.9373926829268292, + "velocity_total_t09": 0.9574713414634147, + "velocity_total_t10": 0.9556268292682928 + }, + "ddos-tcp_flood": { + "_n": 1255.0, + "arc_length": 0.9915701992031872, + "causal_surprisal_flow": 0.5701290836653385, + "causal_surprisal_packet_max": 0.5831084462151396, + "causal_surprisal_packet_mean": 0.6027662151394423, + "causal_surprisal_packet_median": 0.6108070119521912, + "causal_surprisal_packet_trimmed10_mean": 0.6048685258964144, + "causal_surprisal_total": 0.5772307569721115, + "consistency_total": 0.9750629482071712, + "curvature_flow": 0.3484763346613546, + "curvature_packet": 0.9380474103585658, + "curvature_total": 0.855727250996016, + "direction_drift_flow": 0.048695378486055776, + "direction_drift_packet_max": 0.20100852589641435, + "direction_drift_packet_mean": 0.04176940239043825, + "direction_drift_packet_median": 0.044731633466135456, + "direction_drift_packet_trimmed10_mean": 0.04901737051792829, + "direction_drift_total": 0.02143394422310757, + "flow_consistency": 0.9717646215139443, + "jacobian_flow": 0.05691601593625497, + "jacobian_packet": 0.7234217529880478, + "jacobian_total": 0.2274860557768924, + "kappa2_speed2norm_packet_mean": 0.3121513944223107, + "kappa2_speed2norm_packet_median": 0.2919842231075697, + "kappa2_speed2norm_packet_trimmed10_mean": 0.319453545816733, + "kinetic_energy": 0.991651952191235, + "kinetic_flow": 0.9483877290836653, + "kinetic_packet": 0.9955703585657371, + "packet_consistency": 0.853732749003984, + "pna_flow": 0.030802868525896407, + "pna_packet_max": 0.45214326693227097, + "pna_packet_mean": 0.3121513944223107, + "pna_packet_median": 0.2919842231075697, + "pna_packet_trimmed10_mean": 0.319453545816733, + "terminal_flow": 0.9621150597609562, + "terminal_norm": 0.9922894023904383, + "terminal_packet": 0.9917066135458167, + "velocity_flow": 0.9326839043824701, + "velocity_flow_t01": 0.9510358565737052, + "velocity_flow_t03": 0.9417421513944223, + "velocity_flow_t05": 0.9365411952191236, + "velocity_flow_t07": 0.9340559362549801, + "velocity_flow_t09": 0.9303399203187251, + "velocity_flow_t10": 0.9260245418326694, + "velocity_packet": 0.9908208764940237, + "velocity_packet_t01": 0.9360239043824701, + "velocity_packet_t03": 0.9666701195219123, + "velocity_packet_t05": 0.9836541832669323, + "velocity_packet_t07": 0.9903593625498007, + "velocity_packet_t09": 0.9937136254980079, + "velocity_packet_t10": 0.992497689243028, + "velocity_total": 0.9769594422310757, + "velocity_total_t01": 0.9643668525896414, + "velocity_total_t03": 0.9679759362549801, + "velocity_total_t05": 0.9716694820717132, + "velocity_total_t07": 0.9759070916334662, + "velocity_total_t09": 0.9836151394422311, + "velocity_total_t10": 0.9815819920318725 + }, + "ddos-udp_flood": { + "_n": 15.0, + "arc_length": 0.9262933333333334, + "causal_surprisal_flow": 0.8285333333333333, + "causal_surprisal_packet_max": 0.20682666666666666, + "causal_surprisal_packet_mean": 0.18304, + "causal_surprisal_packet_median": 0.18217333333333335, + "causal_surprisal_packet_trimmed10_mean": 0.18113333333333334, + "causal_surprisal_total": 0.20298666666666662, + "consistency_total": 0.9337066666666667, + "curvature_flow": 0.4531333333333334, + "curvature_packet": 0.8894133333333333, + "curvature_total": 0.8658800000000001, + "direction_drift_flow": 0.05483999999999998, + "direction_drift_packet_max": 0.26604, + "direction_drift_packet_mean": 0.15511333333333333, + "direction_drift_packet_median": 0.14077333333333336, + "direction_drift_packet_trimmed10_mean": 0.15292, + "direction_drift_total": 0.18897333333333333, + "flow_consistency": 0.9632666666666667, + "jacobian_flow": 0.09805333333333334, + "jacobian_packet": 0.3257066666666667, + "jacobian_total": 0.17349333333333333, + "kappa2_speed2norm_packet_mean": 0.45924, + "kappa2_speed2norm_packet_median": 0.4598133333333333, + "kappa2_speed2norm_packet_trimmed10_mean": 0.47014666666666666, + "kinetic_energy": 0.9268266666666666, + "kinetic_flow": 0.93228, + "kinetic_packet": 0.9345066666666666, + "packet_consistency": 0.7094799999999999, + "pna_flow": 0.04184, + "pna_packet_max": 0.6174533333333333, + "pna_packet_mean": 0.45924, + "pna_packet_median": 0.4598133333333333, + "pna_packet_trimmed10_mean": 0.47014666666666666, + "terminal_flow": 0.9842133333333333, + "terminal_norm": 0.9825733333333333, + "terminal_packet": 0.9712133333333334, + "velocity_flow": 0.9268266666666667, + "velocity_flow_t01": 0.91412, + "velocity_flow_t03": 0.9181733333333334, + "velocity_flow_t05": 0.9186933333333334, + "velocity_flow_t07": 0.9134266666666666, + "velocity_flow_t09": 0.92648, + "velocity_flow_t10": 0.9214, + "velocity_packet": 0.8738266666666666, + "velocity_packet_t01": 0.9069999999999999, + "velocity_packet_t03": 0.89796, + "velocity_packet_t05": 0.8686, + "velocity_packet_t07": 0.8415333333333334, + "velocity_packet_t09": 0.8952666666666667, + "velocity_packet_t10": 0.8857466666666667, + "velocity_total": 0.8588133333333333, + "velocity_total_t01": 0.8730399999999999, + "velocity_total_t03": 0.86748, + "velocity_total_t05": 0.8478666666666667, + "velocity_total_t07": 0.8393866666666666, + "velocity_total_t09": 0.8597600000000001, + "velocity_total_t10": 0.8650533333333333 + }, + "ddos-udp_fragmentation": { + "_n": 21.0, + "arc_length": 0.7158761904761904, + "causal_surprisal_flow": 0.6024571428571428, + "causal_surprisal_packet_max": 0.4657523809523809, + "causal_surprisal_packet_mean": 0.4929523809523809, + "causal_surprisal_packet_median": 0.5059428571428571, + "causal_surprisal_packet_trimmed10_mean": 0.4953238095238095, + "causal_surprisal_total": 0.558447619047619, + "consistency_total": 0.8074476190476191, + "curvature_flow": 0.4673333333333333, + "curvature_packet": 0.6976380952380952, + "curvature_total": 0.6998476190476189, + "direction_drift_flow": 0.30174285714285715, + "direction_drift_packet_max": 0.5881047619047619, + "direction_drift_packet_mean": 0.6080571428571429, + "direction_drift_packet_median": 0.611352380952381, + "direction_drift_packet_trimmed10_mean": 0.6339999999999999, + "direction_drift_total": 0.5643333333333334, + "flow_consistency": 0.8351904761904761, + "jacobian_flow": 0.2034190476190476, + "jacobian_packet": 0.5757142857142857, + "jacobian_total": 0.4202857142857143, + "kappa2_speed2norm_packet_mean": 0.6323428571428571, + "kappa2_speed2norm_packet_median": 0.6477619047619048, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6492, + "kinetic_energy": 0.7164476190476189, + "kinetic_flow": 0.6808285714285714, + "kinetic_packet": 0.6676095238095238, + "packet_consistency": 0.4586571428571429, + "pna_flow": 0.3344571428571429, + "pna_packet_max": 0.5826761904761905, + "pna_packet_mean": 0.6323428571428571, + "pna_packet_median": 0.6477619047619048, + "pna_packet_trimmed10_mean": 0.6492, + "terminal_flow": 0.8132095238095238, + "terminal_norm": 0.7875333333333333, + "terminal_packet": 0.670552380952381, + "velocity_flow": 0.6785619047619048, + "velocity_flow_t01": 0.6785809523809523, + "velocity_flow_t03": 0.6970190476190476, + "velocity_flow_t05": 0.7021619047619048, + "velocity_flow_t07": 0.6987047619047618, + "velocity_flow_t09": 0.6752, + "velocity_flow_t10": 0.6701904761904762, + "velocity_packet": 0.6056380952380953, + "velocity_packet_t01": 0.6661904761904761, + "velocity_packet_t03": 0.6431142857142857, + "velocity_packet_t05": 0.6196952380952381, + "velocity_packet_t07": 0.5845333333333333, + "velocity_packet_t09": 0.6223428571428572, + "velocity_packet_t10": 0.5619333333333334, + "velocity_total": 0.6678, + "velocity_total_t01": 0.6952, + "velocity_total_t03": 0.6894857142857143, + "velocity_total_t05": 0.6855333333333333, + "velocity_total_t07": 0.6782380952380951, + "velocity_total_t09": 0.6509714285714285, + "velocity_total_t10": 0.6318285714285714 + }, + "dictionarybruteforce": { + "_n": 21.0, + "arc_length": 0.7727428571428572, + "causal_surprisal_flow": 0.7135714285714285, + "causal_surprisal_packet_max": 0.6636095238095238, + "causal_surprisal_packet_mean": 0.6396666666666666, + "causal_surprisal_packet_median": 0.6448952380952381, + "causal_surprisal_packet_trimmed10_mean": 0.645952380952381, + "causal_surprisal_total": 0.700952380952381, + "consistency_total": 0.7568952380952381, + "curvature_flow": 0.5650857142857143, + "curvature_packet": 0.7392285714285715, + "curvature_total": 0.751095238095238, + "direction_drift_flow": 0.1560190476190476, + "direction_drift_packet_max": 0.5271809523809523, + "direction_drift_packet_mean": 0.3964, + "direction_drift_packet_median": 0.40076190476190476, + "direction_drift_packet_trimmed10_mean": 0.42011428571428566, + "direction_drift_total": 0.34835238095238097, + "flow_consistency": 0.796542857142857, + "jacobian_flow": 0.23395238095238094, + "jacobian_packet": 0.4726761904761905, + "jacobian_total": 0.33178095238095234, + "kappa2_speed2norm_packet_mean": 0.6682857142857143, + "kappa2_speed2norm_packet_median": 0.6771904761904762, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6959142857142857, + "kinetic_energy": 0.7715428571428571, + "kinetic_flow": 0.7850571428571428, + "kinetic_packet": 0.6852380952380952, + "packet_consistency": 0.4978761904761904, + "pna_flow": 0.26154285714285713, + "pna_packet_max": 0.6647333333333333, + "pna_packet_mean": 0.6682857142857143, + "pna_packet_median": 0.6771904761904762, + "pna_packet_trimmed10_mean": 0.6959142857142857, + "terminal_flow": 0.8861238095238095, + "terminal_norm": 0.8563714285714286, + "terminal_packet": 0.7896190476190477, + "velocity_flow": 0.801695238095238, + "velocity_flow_t01": 0.7604095238095238, + "velocity_flow_t03": 0.7751142857142858, + "velocity_flow_t05": 0.7985904761904762, + "velocity_flow_t07": 0.7912380952380953, + "velocity_flow_t09": 0.7988761904761904, + "velocity_flow_t10": 0.7878857142857143, + "velocity_packet": 0.6659428571428572, + "velocity_packet_t01": 0.753104761904762, + "velocity_packet_t03": 0.7313714285714286, + "velocity_packet_t05": 0.7054285714285714, + "velocity_packet_t07": 0.6517523809523809, + "velocity_packet_t09": 0.709552380952381, + "velocity_packet_t10": 0.6429619047619047, + "velocity_total": 0.786304761904762, + "velocity_total_t01": 0.7617238095238095, + "velocity_total_t03": 0.7699333333333334, + "velocity_total_t05": 0.7730666666666667, + "velocity_total_t07": 0.7794, + "velocity_total_t09": 0.8115142857142856, + "velocity_total_t10": 0.7645904761904763 + }, + "dns_spoofing": { + "_n": 165.0, + "arc_length": 0.7334448484848485, + "causal_surprisal_flow": 0.5786230303030303, + "causal_surprisal_packet_max": 0.5234993939393939, + "causal_surprisal_packet_mean": 0.5015163636363636, + "causal_surprisal_packet_median": 0.4996290909090909, + "causal_surprisal_packet_trimmed10_mean": 0.49856727272727264, + "causal_surprisal_total": 0.5242569696969697, + "consistency_total": 0.7496254545454546, + "curvature_flow": 0.5973866666666666, + "curvature_packet": 0.679939393939394, + "curvature_total": 0.6817709090909091, + "direction_drift_flow": 0.25299151515151513, + "direction_drift_packet_max": 0.5276036363636364, + "direction_drift_packet_mean": 0.42592484848484846, + "direction_drift_packet_median": 0.438270303030303, + "direction_drift_packet_trimmed10_mean": 0.4285115151515151, + "direction_drift_total": 0.3846242424242424, + "flow_consistency": 0.7490957575757576, + "jacobian_flow": 0.24039636363636363, + "jacobian_packet": 0.5608, + "jacobian_total": 0.4044084848484848, + "kappa2_speed2norm_packet_mean": 0.5761769696969697, + "kappa2_speed2norm_packet_median": 0.5554060606060607, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5811260606060605, + "kinetic_energy": 0.733059393939394, + "kinetic_flow": 0.7048169696969696, + "kinetic_packet": 0.6323672727272727, + "packet_consistency": 0.6654557575757576, + "pna_flow": 0.3228581818181818, + "pna_packet_max": 0.5939527272727272, + "pna_packet_mean": 0.5761769696969697, + "pna_packet_median": 0.5554060606060607, + "pna_packet_trimmed10_mean": 0.5811260606060605, + "terminal_flow": 0.7268412121212121, + "terminal_norm": 0.7468266666666666, + "terminal_packet": 0.7219745454545454, + "velocity_flow": 0.7186072727272728, + "velocity_flow_t01": 0.6965769696969698, + "velocity_flow_t03": 0.7074593939393939, + "velocity_flow_t05": 0.7150351515151514, + "velocity_flow_t07": 0.7286909090909091, + "velocity_flow_t09": 0.7373018181818182, + "velocity_flow_t10": 0.7128387878787878, + "velocity_packet": 0.7057600000000002, + "velocity_packet_t01": 0.6868084848484848, + "velocity_packet_t03": 0.6998181818181818, + "velocity_packet_t05": 0.7062327272727272, + "velocity_packet_t07": 0.6902739393939393, + "velocity_packet_t09": 0.69428, + "velocity_packet_t10": 0.6851187878787879, + "velocity_total": 0.7301781818181818, + "velocity_total_t01": 0.705139393939394, + "velocity_total_t03": 0.7195345454545454, + "velocity_total_t05": 0.7305212121212121, + "velocity_total_t07": 0.735580606060606, + "velocity_total_t09": 0.7438690909090909, + "velocity_total_t10": 0.7170812121212121 + }, + "dos-http_flood": { + "_n": 716.0, + "arc_length": 0.9613245810055867, + "causal_surprisal_flow": 0.25961927374301674, + "causal_surprisal_packet_max": 0.5296504189944132, + "causal_surprisal_packet_mean": 0.5174363128491619, + "causal_surprisal_packet_median": 0.5217217877094973, + "causal_surprisal_packet_trimmed10_mean": 0.5139122905027933, + "causal_surprisal_total": 0.2899508379888268, + "consistency_total": 0.8931893854748603, + "curvature_flow": 0.3667120111731844, + "curvature_packet": 0.9025560055865923, + "curvature_total": 0.8059516759776536, + "direction_drift_flow": 0.12486829608938547, + "direction_drift_packet_max": 0.3621333798882682, + "direction_drift_packet_mean": 0.20289832402234637, + "direction_drift_packet_median": 0.2138191340782123, + "direction_drift_packet_trimmed10_mean": 0.21665293296089383, + "direction_drift_total": 0.1190268156424581, + "flow_consistency": 0.8541117318435754, + "jacobian_flow": 0.2961388268156424, + "jacobian_packet": 0.6928354748603351, + "jacobian_total": 0.56696843575419, + "kappa2_speed2norm_packet_mean": 0.6983236033519553, + "kappa2_speed2norm_packet_median": 0.7024952513966481, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7129717877094972, + "kinetic_energy": 0.9621724860335195, + "kinetic_flow": 0.868263966480447, + "kinetic_packet": 0.9656391061452514, + "packet_consistency": 0.9179645251396648, + "pna_flow": 0.08493212290502794, + "pna_packet_max": 0.7493307262569833, + "pna_packet_mean": 0.6983236033519553, + "pna_packet_median": 0.7024952513966481, + "pna_packet_trimmed10_mean": 0.7129717877094972, + "terminal_flow": 0.9696946927374301, + "terminal_norm": 0.9871477653631285, + "terminal_packet": 0.9808709497206705, + "velocity_flow": 0.8436061452513967, + "velocity_flow_t01": 0.8055988826815642, + "velocity_flow_t03": 0.8259486033519553, + "velocity_flow_t05": 0.8336611731843577, + "velocity_flow_t07": 0.8415946927374303, + "velocity_flow_t09": 0.8481036312849162, + "velocity_flow_t10": 0.8444120111731843, + "velocity_packet": 0.8993317039106146, + "velocity_packet_t01": 0.9264639664804468, + "velocity_packet_t03": 0.9393371508379889, + "velocity_packet_t05": 0.9425642458100557, + "velocity_packet_t07": 0.9250153631284915, + "velocity_packet_t09": 0.8943743016759776, + "velocity_packet_t10": 0.66051843575419, + "velocity_total": 0.9109555865921789, + "velocity_total_t01": 0.8475796089385474, + "velocity_total_t03": 0.8550437150837988, + "velocity_total_t05": 0.8940578212290502, + "velocity_total_t07": 0.9174698324022346, + "velocity_total_t09": 0.9235692737430167, + "velocity_total_t10": 0.8850379888268156 + }, + "dos-syn_flood": { + "_n": 844.0, + "arc_length": 0.9882246445497631, + "causal_surprisal_flow": 0.7242988151658767, + "causal_surprisal_packet_max": 0.6569659952606635, + "causal_surprisal_packet_mean": 0.689429383886256, + "causal_surprisal_packet_median": 0.6975319905213271, + "causal_surprisal_packet_trimmed10_mean": 0.6937663507109005, + "causal_surprisal_total": 0.7994234597156399, + "consistency_total": 0.9825341232227488, + "curvature_flow": 0.31122488151658767, + "curvature_packet": 0.9806632701421801, + "curvature_total": 0.9559898104265403, + "direction_drift_flow": 0.1187919431279621, + "direction_drift_packet_max": 0.42661563981042655, + "direction_drift_packet_mean": 0.15718744075829383, + "direction_drift_packet_median": 0.15931895734597157, + "direction_drift_packet_trimmed10_mean": 0.13812274881516587, + "direction_drift_total": 0.11438637440758294, + "flow_consistency": 0.9784734597156396, + "jacobian_flow": 0.154131990521327, + "jacobian_packet": 0.46875379146919427, + "jacobian_total": 0.2460118483412322, + "kappa2_speed2norm_packet_mean": 0.6565675355450237, + "kappa2_speed2norm_packet_median": 0.6567469194312796, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6375825829383887, + "kinetic_energy": 0.9885606635071091, + "kinetic_flow": 0.9233834123222749, + "kinetic_packet": 0.9958545023696682, + "packet_consistency": 0.9579701421800948, + "pna_flow": 0.04462061611374407, + "pna_packet_max": 0.6578947867298578, + "pna_packet_mean": 0.6565675355450237, + "pna_packet_median": 0.6567469194312796, + "pna_packet_trimmed10_mean": 0.6375825829383887, + "terminal_flow": 0.9908950236966825, + "terminal_norm": 0.996836018957346, + "terminal_packet": 0.997429383886256, + "velocity_flow": 0.9075308056872038, + "velocity_flow_t01": 0.9008201421800949, + "velocity_flow_t03": 0.9016388625592415, + "velocity_flow_t05": 0.9022085308056871, + "velocity_flow_t07": 0.9072917061611374, + "velocity_flow_t09": 0.9088941943127963, + "velocity_flow_t10": 0.9086914691943127, + "velocity_packet": 0.9806350710900474, + "velocity_packet_t01": 0.9514867298578199, + "velocity_packet_t03": 0.9707661137440757, + "velocity_packet_t05": 0.9822710900473932, + "velocity_packet_t07": 0.9847222748815166, + "velocity_packet_t09": 0.9746635071090046, + "velocity_packet_t10": 0.8994101895734598, + "velocity_total": 0.9469988151658768, + "velocity_total_t01": 0.9351424170616115, + "velocity_total_t03": 0.940400710900474, + "velocity_total_t05": 0.9436327014218009, + "velocity_total_t07": 0.9509451421800948, + "velocity_total_t09": 0.957685308056872, + "velocity_total_t10": 0.9453246445497631 + }, + "dos-tcp_flood": { + "_n": 1098.0, + "arc_length": 0.9911304189435337, + "causal_surprisal_flow": 0.7393784153005464, + "causal_surprisal_packet_max": 0.544754553734062, + "causal_surprisal_packet_mean": 0.5511333333333333, + "causal_surprisal_packet_median": 0.5526249544626595, + "causal_surprisal_packet_trimmed10_mean": 0.5518289617486339, + "causal_surprisal_total": 0.8321242258652095, + "consistency_total": 0.9766901639344262, + "curvature_flow": 0.7225727686703096, + "curvature_packet": 0.9837754098360656, + "curvature_total": 0.9618774134790529, + "direction_drift_flow": 0.0904563752276867, + "direction_drift_packet_max": 0.24770428051001825, + "direction_drift_packet_mean": 0.13538451730418943, + "direction_drift_packet_median": 0.1489219489981785, + "direction_drift_packet_trimmed10_mean": 0.15052531876138434, + "direction_drift_total": 0.06655282331511839, + "flow_consistency": 0.9714007285974499, + "jacobian_flow": 0.12485865209471766, + "jacobian_packet": 0.6870439890710383, + "jacobian_total": 0.3215372495446266, + "kappa2_speed2norm_packet_mean": 0.5712235883424407, + "kappa2_speed2norm_packet_median": 0.4454061930783243, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5401486338797814, + "kinetic_energy": 0.9913243169398908, + "kinetic_flow": 0.929953005464481, + "kinetic_packet": 0.9971664845173042, + "packet_consistency": 0.8646033697632058, + "pna_flow": 0.12783387978142075, + "pna_packet_max": 0.7676440801457194, + "pna_packet_mean": 0.5712235883424407, + "pna_packet_median": 0.4454061930783243, + "pna_packet_trimmed10_mean": 0.5401486338797814, + "terminal_flow": 0.9869289617486339, + "terminal_norm": 0.99768087431694, + "terminal_packet": 0.9983005464480874, + "velocity_flow": 0.9109898907103825, + "velocity_flow_t01": 0.9120227686703096, + "velocity_flow_t03": 0.9095621129326048, + "velocity_flow_t05": 0.9085980874316939, + "velocity_flow_t07": 0.9136615664845174, + "velocity_flow_t09": 0.9145196721311476, + "velocity_flow_t10": 0.9076748633879782, + "velocity_packet": 0.9854151183970856, + "velocity_packet_t01": 0.9092422586520946, + "velocity_packet_t03": 0.9361914389799636, + "velocity_packet_t05": 0.9609109289617486, + "velocity_packet_t07": 0.9799244080145719, + "velocity_packet_t09": 0.9885976320582878, + "velocity_packet_t10": 0.9880954462659381, + "velocity_total": 0.9616693989071038, + "velocity_total_t01": 0.9439060109289619, + "velocity_total_t03": 0.9459814207650273, + "velocity_total_t05": 0.9477214936247721, + "velocity_total_t07": 0.9564588342440801, + "velocity_total_t09": 0.9744227686703096, + "velocity_total_t10": 0.9723730418943535 + }, + "dos-udp_flood": { + "_n": 177.0, + "arc_length": 0.9843977401129944, + "causal_surprisal_flow": 0.8938971751412431, + "causal_surprisal_packet_max": 0.6531401129943504, + "causal_surprisal_packet_mean": 0.618109604519774, + "causal_surprisal_packet_median": 0.6106429378531074, + "causal_surprisal_packet_trimmed10_mean": 0.6141446327683616, + "causal_surprisal_total": 0.49354802259887004, + "consistency_total": 0.9919322033898305, + "curvature_flow": 0.7752271186440679, + "curvature_packet": 0.9767943502824858, + "curvature_total": 0.9724632768361583, + "direction_drift_flow": 0.042094915254237274, + "direction_drift_packet_max": 0.35602259887005644, + "direction_drift_packet_mean": 0.004259887005649728, + "direction_drift_packet_median": 0.005354802259887029, + "direction_drift_packet_trimmed10_mean": 0.004211299435028265, + "direction_drift_total": 0.008625988700564975, + "flow_consistency": 0.9896169491525424, + "jacobian_flow": 0.05838870056497175, + "jacobian_packet": 0.6532847457627119, + "jacobian_total": 0.22020790960451977, + "kappa2_speed2norm_packet_mean": 0.5342553672316384, + "kappa2_speed2norm_packet_median": 0.42725706214689263, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4994338983050847, + "kinetic_energy": 0.9852813559322033, + "kinetic_flow": 0.965050847457627, + "kinetic_packet": 0.9994067796610169, + "packet_consistency": 0.9960937853107343, + "pna_flow": 0.06450282485875707, + "pna_packet_max": 0.9680293785310735, + "pna_packet_mean": 0.5342553672316384, + "pna_packet_median": 0.42725706214689263, + "pna_packet_trimmed10_mean": 0.4994338983050847, + "terminal_flow": 0.9941819209039547, + "terminal_norm": 0.9986463276836158, + "terminal_packet": 0.9999932203389831, + "velocity_flow": 0.9793231638418078, + "velocity_flow_t01": 0.9750937853107344, + "velocity_flow_t03": 0.9762011299435028, + "velocity_flow_t05": 0.9755932203389831, + "velocity_flow_t07": 0.9798169491525424, + "velocity_flow_t09": 0.9825717514124294, + "velocity_flow_t10": 0.9820463276836158, + "velocity_packet": 0.991476836158192, + "velocity_packet_t01": 0.9934395480225988, + "velocity_packet_t03": 0.9926881355932203, + "velocity_packet_t05": 0.9920542372881356, + "velocity_packet_t07": 0.9919299435028248, + "velocity_packet_t09": 0.990832768361582, + "velocity_packet_t10": 0.9692305084745763, + "velocity_total": 0.934128813559322, + "velocity_total_t01": 0.9347401129943503, + "velocity_total_t03": 0.9350045197740113, + "velocity_total_t05": 0.9351265536723163, + "velocity_total_t07": 0.9351039548022598, + "velocity_total_t09": 0.9402180790960453, + "velocity_total_t10": 0.9165197740112995 + }, + "mirai-greeth_flood": { + "_n": 8.0, + "arc_length": 0.60485, + "causal_surprisal_flow": 0.55285, + "causal_surprisal_packet_max": 0.48265, + "causal_surprisal_packet_mean": 0.5019750000000001, + "causal_surprisal_packet_median": 0.511425, + "causal_surprisal_packet_trimmed10_mean": 0.50455, + "causal_surprisal_total": 0.53955, + "consistency_total": 0.7987, + "curvature_flow": 0.39087500000000003, + "curvature_packet": 0.513225, + "curvature_total": 0.46807499999999996, + "direction_drift_flow": 0.4353, + "direction_drift_packet_max": 0.366825, + "direction_drift_packet_mean": 0.371525, + "direction_drift_packet_median": 0.382575, + "direction_drift_packet_trimmed10_mean": 0.40085, + "direction_drift_total": 0.341125, + "flow_consistency": 0.833725, + "jacobian_flow": 0.259725, + "jacobian_packet": 0.548925, + "jacobian_total": 0.46972500000000006, + "kappa2_speed2norm_packet_mean": 0.42335, + "kappa2_speed2norm_packet_median": 0.402925, + "kappa2_speed2norm_packet_trimmed10_mean": 0.429475, + "kinetic_energy": 0.602625, + "kinetic_flow": 0.587, + "kinetic_packet": 0.5121, + "packet_consistency": 0.49492499999999995, + "pna_flow": 0.34335, + "pna_packet_max": 0.51745, + "pna_packet_mean": 0.42335, + "pna_packet_median": 0.402925, + "pna_packet_trimmed10_mean": 0.429475, + "terminal_flow": 0.6787, + "terminal_norm": 0.70775, + "terminal_packet": 0.6249, + "velocity_flow": 0.573075, + "velocity_flow_t01": 0.5919, + "velocity_flow_t03": 0.59075, + "velocity_flow_t05": 0.577675, + "velocity_flow_t07": 0.563675, + "velocity_flow_t09": 0.5845250000000001, + "velocity_flow_t10": 0.62275, + "velocity_packet": 0.559075, + "velocity_packet_t01": 0.534575, + "velocity_packet_t03": 0.539475, + "velocity_packet_t05": 0.519575, + "velocity_packet_t07": 0.5260750000000001, + "velocity_packet_t09": 0.5323500000000001, + "velocity_packet_t10": 0.62185, + "velocity_total": 0.5859, + "velocity_total_t01": 0.57955, + "velocity_total_t03": 0.586375, + "velocity_total_t05": 0.58095, + "velocity_total_t07": 0.575075, + "velocity_total_t09": 0.576625, + "velocity_total_t10": 0.618075 + }, + "mirai-greip_flood": { + "_n": 29.0, + "arc_length": 0.9215448275862068, + "causal_surprisal_flow": 0.598344827586207, + "causal_surprisal_packet_max": 0.4266344827586207, + "causal_surprisal_packet_mean": 0.3794068965517241, + "causal_surprisal_packet_median": 0.36171724137931033, + "causal_surprisal_packet_trimmed10_mean": 0.3592896551724138, + "causal_surprisal_total": 0.521048275862069, + "consistency_total": 0.8776068965517241, + "curvature_flow": 0.42526896551724136, + "curvature_packet": 0.7360827586206896, + "curvature_total": 0.7444275862068965, + "direction_drift_flow": 0.1290862068965517, + "direction_drift_packet_max": 0.396351724137931, + "direction_drift_packet_mean": 0.3166758620689655, + "direction_drift_packet_median": 0.3178068965517241, + "direction_drift_packet_trimmed10_mean": 0.32167586206896553, + "direction_drift_total": 0.2436, + "flow_consistency": 0.8889103448275861, + "jacobian_flow": 0.18310344827586206, + "jacobian_packet": 0.4625241379310345, + "jacobian_total": 0.32853793103448276, + "kappa2_speed2norm_packet_mean": 0.5583103448275862, + "kappa2_speed2norm_packet_median": 0.5491724137931036, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5616413793103449, + "kinetic_energy": 0.9203999999999999, + "kinetic_flow": 0.8540827586206896, + "kinetic_packet": 0.8303241379310345, + "packet_consistency": 0.6002206896551723, + "pna_flow": 0.12411034482758619, + "pna_packet_max": 0.540648275862069, + "pna_packet_mean": 0.5583103448275862, + "pna_packet_median": 0.5491724137931036, + "pna_packet_trimmed10_mean": 0.5616413793103449, + "terminal_flow": 0.9443586206896553, + "terminal_norm": 0.9548896551724139, + "terminal_packet": 0.8576137931034483, + "velocity_flow": 0.8513172413793104, + "velocity_flow_t01": 0.785848275862069, + "velocity_flow_t03": 0.8014965517241379, + "velocity_flow_t05": 0.8136689655172413, + "velocity_flow_t07": 0.8247931034482758, + "velocity_flow_t09": 0.8705586206896552, + "velocity_flow_t10": 0.8638413793103447, + "velocity_packet": 0.7759655172413793, + "velocity_packet_t01": 0.7579724137931034, + "velocity_packet_t03": 0.7562827586206896, + "velocity_packet_t05": 0.7551655172413793, + "velocity_packet_t07": 0.7598275862068966, + "velocity_packet_t09": 0.7871655172413793, + "velocity_packet_t10": 0.7693241379310346, + "velocity_total": 0.8894068965517241, + "velocity_total_t01": 0.8156275862068966, + "velocity_total_t03": 0.8196344827586206, + "velocity_total_t05": 0.8344620689655172, + "velocity_total_t07": 0.8598620689655172, + "velocity_total_t09": 0.9169862068965517, + "velocity_total_t10": 0.9182689655172414 + }, + "mirai-udpplain": { + "_n": 9.0, + "arc_length": 0.7908222222222221, + "causal_surprisal_flow": 0.6067777777777777, + "causal_surprisal_packet_max": 0.5861333333333333, + "causal_surprisal_packet_mean": 0.5780444444444445, + "causal_surprisal_packet_median": 0.5823555555555555, + "causal_surprisal_packet_trimmed10_mean": 0.5778222222222222, + "causal_surprisal_total": 0.5895555555555555, + "consistency_total": 0.7640666666666667, + "curvature_flow": 0.47397777777777783, + "curvature_packet": 0.8417777777777777, + "curvature_total": 0.7952444444444444, + "direction_drift_flow": 0.21826666666666666, + "direction_drift_packet_max": 0.4799777777777778, + "direction_drift_packet_mean": 0.47768888888888883, + "direction_drift_packet_median": 0.5107333333333333, + "direction_drift_packet_trimmed10_mean": 0.5013333333333334, + "direction_drift_total": 0.39217777777777774, + "flow_consistency": 0.7637111111111111, + "jacobian_flow": 0.14757777777777778, + "jacobian_packet": 0.5196222222222223, + "jacobian_total": 0.2732888888888889, + "kappa2_speed2norm_packet_mean": 0.7870666666666666, + "kappa2_speed2norm_packet_median": 0.7937333333333333, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7930222222222222, + "kinetic_energy": 0.7911777777777776, + "kinetic_flow": 0.7499777777777777, + "kinetic_packet": 0.7599111111111111, + "packet_consistency": 0.4164222222222222, + "pna_flow": 0.18731111111111112, + "pna_packet_max": 0.720111111111111, + "pna_packet_mean": 0.7870666666666666, + "pna_packet_median": 0.7937333333333333, + "pna_packet_trimmed10_mean": 0.7930222222222222, + "terminal_flow": 0.8622222222222221, + "terminal_norm": 0.9027999999999999, + "terminal_packet": 0.8700222222222223, + "velocity_flow": 0.7818444444444445, + "velocity_flow_t01": 0.7822888888888888, + "velocity_flow_t03": 0.7798, + "velocity_flow_t05": 0.7807111111111111, + "velocity_flow_t07": 0.7812222222222222, + "velocity_flow_t09": 0.7815333333333334, + "velocity_flow_t10": 0.7959555555555555, + "velocity_packet": 0.6966888888888889, + "velocity_packet_t01": 0.7836222222222221, + "velocity_packet_t03": 0.7884222222222222, + "velocity_packet_t05": 0.7662, + "velocity_packet_t07": 0.7316666666666667, + "velocity_packet_t09": 0.7174444444444444, + "velocity_packet_t10": 0.6049111111111112, + "velocity_total": 0.7896, + "velocity_total_t01": 0.8148666666666667, + "velocity_total_t03": 0.8089999999999999, + "velocity_total_t05": 0.8108444444444445, + "velocity_total_t07": 0.8081333333333333, + "velocity_total_t09": 0.7896666666666666, + "velocity_total_t10": 0.7557333333333334 + }, + "mitm-arpspoofing": { + "_n": 135.0, + "arc_length": 0.796951111111111, + "causal_surprisal_flow": 0.5315585185185184, + "causal_surprisal_packet_max": 0.40240000000000004, + "causal_surprisal_packet_mean": 0.3871896296296296, + "causal_surprisal_packet_median": 0.37561481481481473, + "causal_surprisal_packet_trimmed10_mean": 0.38240444444444444, + "causal_surprisal_total": 0.4878651851851852, + "consistency_total": 0.7269792592592592, + "curvature_flow": 0.6037540740740741, + "curvature_packet": 0.5877037037037037, + "curvature_total": 0.6341214814814814, + "direction_drift_flow": 0.2072577777777778, + "direction_drift_packet_max": 0.33953629629629634, + "direction_drift_packet_mean": 0.3138081481481481, + "direction_drift_packet_median": 0.31988, + "direction_drift_packet_trimmed10_mean": 0.335065925925926, + "direction_drift_total": 0.23222814814814816, + "flow_consistency": 0.7511762962962962, + "jacobian_flow": 0.2991851851851852, + "jacobian_packet": 0.47814222222222225, + "jacobian_total": 0.4555407407407408, + "kappa2_speed2norm_packet_mean": 0.5010681481481482, + "kappa2_speed2norm_packet_median": 0.5004548148148148, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5179066666666667, + "kinetic_energy": 0.796354074074074, + "kinetic_flow": 0.7338325925925926, + "kinetic_packet": 0.6549244444444445, + "packet_consistency": 0.41311851851851855, + "pna_flow": 0.2900962962962963, + "pna_packet_max": 0.49719555555555556, + "pna_packet_mean": 0.5010681481481482, + "pna_packet_median": 0.5004548148148148, + "pna_packet_trimmed10_mean": 0.5179066666666667, + "terminal_flow": 0.8207451851851852, + "terminal_norm": 0.8238103703703703, + "terminal_packet": 0.7229362962962963, + "velocity_flow": 0.7432844444444445, + "velocity_flow_t01": 0.6796414814814815, + "velocity_flow_t03": 0.7017066666666667, + "velocity_flow_t05": 0.7103466666666667, + "velocity_flow_t07": 0.7329896296296295, + "velocity_flow_t09": 0.7694725925925925, + "velocity_flow_t10": 0.7581296296296297, + "velocity_packet": 0.599957037037037, + "velocity_packet_t01": 0.6355703703703703, + "velocity_packet_t03": 0.6174488888888889, + "velocity_packet_t05": 0.6020177777777778, + "velocity_packet_t07": 0.5707748148148148, + "velocity_packet_t09": 0.58088, + "velocity_packet_t10": 0.6062488888888888, + "velocity_total": 0.7697837037037036, + "velocity_total_t01": 0.7134651851851851, + "velocity_total_t03": 0.7156044444444445, + "velocity_total_t05": 0.7307911111111112, + "velocity_total_t07": 0.7594785185185186, + "velocity_total_t09": 0.7907985185185186, + "velocity_total_t10": 0.7720103703703703 + }, + "recon-hostdiscovery": { + "_n": 165.0, + "arc_length": 0.8002715151515152, + "causal_surprisal_flow": 0.39845818181818177, + "causal_surprisal_packet_max": 0.5293369696969698, + "causal_surprisal_packet_mean": 0.5334121212121211, + "causal_surprisal_packet_median": 0.5361260606060606, + "causal_surprisal_packet_trimmed10_mean": 0.5364533333333333, + "causal_surprisal_total": 0.4869987878787878, + "consistency_total": 0.8021600000000001, + "curvature_flow": 0.5028642424242424, + "curvature_packet": 0.6566684848484848, + "curvature_total": 0.6518133333333334, + "direction_drift_flow": 0.27300242424242427, + "direction_drift_packet_max": 0.29018060606060603, + "direction_drift_packet_mean": 0.2847006060606061, + "direction_drift_packet_median": 0.2842969696969697, + "direction_drift_packet_trimmed10_mean": 0.2999418181818182, + "direction_drift_total": 0.23211030303030303, + "flow_consistency": 0.7998054545454546, + "jacobian_flow": 0.34579393939393943, + "jacobian_packet": 0.6842999999999999, + "jacobian_total": 0.6182181818181818, + "kappa2_speed2norm_packet_mean": 0.5050412121212121, + "kappa2_speed2norm_packet_median": 0.5138848484848484, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5244921212121212, + "kinetic_energy": 0.8002460606060606, + "kinetic_flow": 0.7287781818181818, + "kinetic_packet": 0.7513151515151516, + "packet_consistency": 0.7269272727272728, + "pna_flow": 0.29375636363636365, + "pna_packet_max": 0.4762715151515152, + "pna_packet_mean": 0.5050412121212121, + "pna_packet_median": 0.5138848484848484, + "pna_packet_trimmed10_mean": 0.5244921212121212, + "terminal_flow": 0.7851151515151515, + "terminal_norm": 0.8035248484848485, + "terminal_packet": 0.7781648484848485, + "velocity_flow": 0.7087612121212121, + "velocity_flow_t01": 0.6428448484848485, + "velocity_flow_t03": 0.6849624242424242, + "velocity_flow_t05": 0.6991187878787879, + "velocity_flow_t07": 0.7109442424242425, + "velocity_flow_t09": 0.7334109090909091, + "velocity_flow_t10": 0.7126, + "velocity_packet": 0.732220606060606, + "velocity_packet_t01": 0.706550303030303, + "velocity_packet_t03": 0.7178363636363636, + "velocity_packet_t05": 0.7244121212121212, + "velocity_packet_t07": 0.7181842424242424, + "velocity_packet_t09": 0.7215648484848485, + "velocity_packet_t10": 0.685270303030303, + "velocity_total": 0.7636327272727272, + "velocity_total_t01": 0.6880436363636364, + "velocity_total_t03": 0.7051309090909091, + "velocity_total_t05": 0.7433987878787879, + "velocity_total_t07": 0.7616472727272727, + "velocity_total_t09": 0.7807721212121213, + "velocity_total_t10": 0.770150303030303 + }, + "recon-osscan": { + "_n": 368.0, + "arc_length": 0.9041195652173915, + "causal_surprisal_flow": 0.37969891304347825, + "causal_surprisal_packet_max": 0.5577000000000001, + "causal_surprisal_packet_mean": 0.5732663043478259, + "causal_surprisal_packet_median": 0.5804097826086957, + "causal_surprisal_packet_trimmed10_mean": 0.5752114130434782, + "causal_surprisal_total": 0.4322864130434783, + "consistency_total": 0.8722940217391305, + "curvature_flow": 0.3903869565217391, + "curvature_packet": 0.7909119565217391, + "curvature_total": 0.7426842391304347, + "direction_drift_flow": 0.20301195652173915, + "direction_drift_packet_max": 0.2460396739130435, + "direction_drift_packet_mean": 0.17350434782608695, + "direction_drift_packet_median": 0.17809402173913044, + "direction_drift_packet_trimmed10_mean": 0.17786956521739133, + "direction_drift_total": 0.1372211956521739, + "flow_consistency": 0.8678603260869565, + "jacobian_flow": 0.3573070652173913, + "jacobian_packet": 0.7335505434782609, + "jacobian_total": 0.6535815217391303, + "kappa2_speed2norm_packet_mean": 0.5731771739130436, + "kappa2_speed2norm_packet_median": 0.5792663043478261, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5892396739130434, + "kinetic_energy": 0.9043190217391304, + "kinetic_flow": 0.815204347826087, + "kinetic_packet": 0.8951695652173914, + "packet_consistency": 0.8135176630434782, + "pna_flow": 0.15684782608695652, + "pna_packet_max": 0.5674070652173913, + "pna_packet_mean": 0.5731771739130436, + "pna_packet_median": 0.5792663043478261, + "pna_packet_trimmed10_mean": 0.5892396739130434, + "terminal_flow": 0.9144304347826088, + "terminal_norm": 0.9297315217391304, + "terminal_packet": 0.9193266304347827, + "velocity_flow": 0.779641304347826, + "velocity_flow_t01": 0.6893701086956522, + "velocity_flow_t03": 0.7319407608695652, + "velocity_flow_t05": 0.7491027173913044, + "velocity_flow_t07": 0.7704853260869565, + "velocity_flow_t09": 0.8098951086956522, + "velocity_flow_t10": 0.799453804347826, + "velocity_packet": 0.8638228260869565, + "velocity_packet_t01": 0.8145483695652173, + "velocity_packet_t03": 0.8341233695652174, + "velocity_packet_t05": 0.8470076086956522, + "velocity_packet_t07": 0.8496972826086957, + "velocity_packet_t09": 0.8579043478260868, + "velocity_packet_t10": 0.7984048913043478, + "velocity_total": 0.8611467391304347, + "velocity_total_t01": 0.7699048913043478, + "velocity_total_t03": 0.7759690217391304, + "velocity_total_t05": 0.824541304347826, + "velocity_total_t07": 0.854850543478261, + "velocity_total_t09": 0.8878978260869564, + "velocity_total_t10": 0.8741478260869564 + }, + "recon-pingsweep": { + "_n": 8.0, + "arc_length": 0.9406999999999999, + "causal_surprisal_flow": 0.6181, + "causal_surprisal_packet_max": 0.49855, + "causal_surprisal_packet_mean": 0.5198, + "causal_surprisal_packet_median": 0.539175, + "causal_surprisal_packet_trimmed10_mean": 0.52515, + "causal_surprisal_total": 0.6045, + "consistency_total": 0.84135, + "curvature_flow": 0.5441, + "curvature_packet": 0.790725, + "curvature_total": 0.7660250000000001, + "direction_drift_flow": 0.1685, + "direction_drift_packet_max": 0.308075, + "direction_drift_packet_mean": 0.20485000000000003, + "direction_drift_packet_median": 0.197425, + "direction_drift_packet_trimmed10_mean": 0.21339999999999998, + "direction_drift_total": 0.19317499999999999, + "flow_consistency": 0.8238000000000001, + "jacobian_flow": 0.3232625, + "jacobian_packet": 0.44057500000000005, + "jacobian_total": 0.3775, + "kappa2_speed2norm_packet_mean": 0.5413, + "kappa2_speed2norm_packet_median": 0.5279, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5448500000000001, + "kinetic_energy": 0.940125, + "kinetic_flow": 0.8448, + "kinetic_packet": 0.941225, + "packet_consistency": 0.739375, + "pna_flow": 0.16262499999999996, + "pna_packet_max": 0.523675, + "pna_packet_mean": 0.5413, + "pna_packet_median": 0.5279, + "pna_packet_trimmed10_mean": 0.5448500000000001, + "terminal_flow": 0.898575, + "terminal_norm": 0.96115, + "terminal_packet": 0.9708749999999999, + "velocity_flow": 0.8088500000000001, + "velocity_flow_t01": 0.75385, + "velocity_flow_t03": 0.760825, + "velocity_flow_t05": 0.76275, + "velocity_flow_t07": 0.77555, + "velocity_flow_t09": 0.8344750000000001, + "velocity_flow_t10": 0.8397999999999999, + "velocity_packet": 0.840325, + "velocity_packet_t01": 0.6888, + "velocity_packet_t03": 0.69105, + "velocity_packet_t05": 0.723325, + "velocity_packet_t07": 0.7746249999999999, + "velocity_packet_t09": 0.871375, + "velocity_packet_t10": 0.8490500000000001, + "velocity_total": 0.8537000000000001, + "velocity_total_t01": 0.78085, + "velocity_total_t03": 0.778725, + "velocity_total_t05": 0.784375, + "velocity_total_t07": 0.8301250000000001, + "velocity_total_t09": 0.8758250000000001, + "velocity_total_t10": 0.87565 + }, + "recon-portscan": { + "_n": 370.0, + "arc_length": 0.8988497297297297, + "causal_surprisal_flow": 0.33793243243243243, + "causal_surprisal_packet_max": 0.5558897297297297, + "causal_surprisal_packet_mean": 0.5741421621621621, + "causal_surprisal_packet_median": 0.5831291891891892, + "causal_surprisal_packet_trimmed10_mean": 0.5765005405405406, + "causal_surprisal_total": 0.39564216216216214, + "consistency_total": 0.8749664864864866, + "curvature_flow": 0.40306648648648646, + "curvature_packet": 0.8028670270270271, + "curvature_total": 0.7462875675675675, + "direction_drift_flow": 0.2058589189189189, + "direction_drift_packet_max": 0.25399675675675676, + "direction_drift_packet_mean": 0.1788172972972973, + "direction_drift_packet_median": 0.18497405405405407, + "direction_drift_packet_trimmed10_mean": 0.18156702702702704, + "direction_drift_total": 0.14846702702702702, + "flow_consistency": 0.8801713513513514, + "jacobian_flow": 0.3926502702702703, + "jacobian_packet": 0.7617513513513514, + "jacobian_total": 0.6934481081081081, + "kappa2_speed2norm_packet_mean": 0.5775464864864864, + "kappa2_speed2norm_packet_median": 0.5862918918918919, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5897037837837837, + "kinetic_energy": 0.899294054054054, + "kinetic_flow": 0.8201637837837839, + "kinetic_packet": 0.8873491891891891, + "packet_consistency": 0.8084572972972973, + "pna_flow": 0.1642427027027027, + "pna_packet_max": 0.5914254054054053, + "pna_packet_mean": 0.5775464864864864, + "pna_packet_median": 0.5862918918918919, + "pna_packet_trimmed10_mean": 0.5897037837837837, + "terminal_flow": 0.9170091891891893, + "terminal_norm": 0.9217016216216216, + "terminal_packet": 0.9082189189189189, + "velocity_flow": 0.7860902702702705, + "velocity_flow_t01": 0.6851821621621622, + "velocity_flow_t03": 0.7440654054054054, + "velocity_flow_t05": 0.7652443243243243, + "velocity_flow_t07": 0.7829081081081081, + "velocity_flow_t09": 0.8102416216216216, + "velocity_flow_t10": 0.7884886486486486, + "velocity_packet": 0.8697556756756757, + "velocity_packet_t01": 0.8314059459459459, + "velocity_packet_t03": 0.8518086486486488, + "velocity_packet_t05": 0.8640740540540541, + "velocity_packet_t07": 0.8630227027027028, + "velocity_packet_t09": 0.8648021621621621, + "velocity_packet_t10": 0.8174994594594595, + "velocity_total": 0.8643286486486487, + "velocity_total_t01": 0.7834216216216214, + "velocity_total_t03": 0.7926372972972974, + "velocity_total_t05": 0.8396205405405406, + "velocity_total_t07": 0.8665664864864866, + "velocity_total_t09": 0.8876351351351351, + "velocity_total_t10": 0.8611851351351352 + }, + "sqlinjection": { + "_n": 11.0, + "arc_length": 0.7015454545454545, + "causal_surprisal_flow": 0.48454545454545456, + "causal_surprisal_packet_max": 0.4168545454545454, + "causal_surprisal_packet_mean": 0.4356, + "causal_surprisal_packet_median": 0.4379454545454546, + "causal_surprisal_packet_trimmed10_mean": 0.43718181818181817, + "causal_surprisal_total": 0.5501454545454545, + "consistency_total": 0.6852363636363636, + "curvature_flow": 0.6302363636363637, + "curvature_packet": 0.5752909090909091, + "curvature_total": 0.621890909090909, + "direction_drift_flow": 0.34330909090909095, + "direction_drift_packet_max": 0.40550909090909093, + "direction_drift_packet_mean": 0.3804909090909091, + "direction_drift_packet_median": 0.3592727272727273, + "direction_drift_packet_trimmed10_mean": 0.3999636363636364, + "direction_drift_total": 0.2912181818181818, + "flow_consistency": 0.7504181818181819, + "jacobian_flow": 0.29045454545454547, + "jacobian_packet": 0.4137454545454545, + "jacobian_total": 0.38007272727272723, + "kappa2_speed2norm_packet_mean": 0.4990909090909091, + "kappa2_speed2norm_packet_median": 0.5206363636363636, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5161636363636364, + "kinetic_energy": 0.7020727272727272, + "kinetic_flow": 0.613, + "kinetic_packet": 0.6950545454545455, + "packet_consistency": 0.45187272727272726, + "pna_flow": 0.5127090909090909, + "pna_packet_max": 0.48341818181818186, + "pna_packet_mean": 0.4990909090909091, + "pna_packet_median": 0.5206363636363636, + "pna_packet_trimmed10_mean": 0.5161636363636364, + "terminal_flow": 0.7899818181818181, + "terminal_norm": 0.7476181818181818, + "terminal_packet": 0.5954727272727273, + "velocity_flow": 0.6260545454545454, + "velocity_flow_t01": 0.5916727272727272, + "velocity_flow_t03": 0.6117272727272727, + "velocity_flow_t05": 0.6102909090909091, + "velocity_flow_t07": 0.6081454545454545, + "velocity_flow_t09": 0.6656181818181818, + "velocity_flow_t10": 0.5995272727272727, + "velocity_packet": 0.6296181818181817, + "velocity_packet_t01": 0.6441818181818182, + "velocity_packet_t03": 0.6218909090909092, + "velocity_packet_t05": 0.6033636363636363, + "velocity_packet_t07": 0.5842909090909091, + "velocity_packet_t09": 0.5749818181818183, + "velocity_packet_t10": 0.6259818181818181, + "velocity_total": 0.6848000000000001, + "velocity_total_t01": 0.6243090909090909, + "velocity_total_t03": 0.6149818181818182, + "velocity_total_t05": 0.6437454545454545, + "velocity_total_t07": 0.6635090909090909, + "velocity_total_t09": 0.6837090909090908, + "velocity_total_t10": 0.6782545454545456 + }, + "uploading_attack": { + "_n": 3.0, + "arc_length": 0.9172666666666667, + "causal_surprisal_flow": 0.5828, + "causal_surprisal_packet_max": 0.40299999999999997, + "causal_surprisal_packet_mean": 0.3728, + "causal_surprisal_packet_median": 0.3826666666666667, + "causal_surprisal_packet_trimmed10_mean": 0.375, + "causal_surprisal_total": 0.6158666666666667, + "consistency_total": 0.9060666666666667, + "curvature_flow": 0.5673333333333334, + "curvature_packet": 0.6051333333333333, + "curvature_total": 0.688, + "direction_drift_flow": 0.1532, + "direction_drift_packet_max": 0.3688, + "direction_drift_packet_mean": 0.3118666666666666, + "direction_drift_packet_median": 0.3256, + "direction_drift_packet_trimmed10_mean": 0.25226666666666664, + "direction_drift_total": 0.2552, + "flow_consistency": 0.9344666666666667, + "jacobian_flow": 0.26293333333333335, + "jacobian_packet": 0.42266666666666663, + "jacobian_total": 0.3992, + "kappa2_speed2norm_packet_mean": 0.42999999999999994, + "kappa2_speed2norm_packet_median": 0.42579999999999996, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4028, + "kinetic_energy": 0.9148, + "kinetic_flow": 0.8322666666666666, + "kinetic_packet": 0.6799999999999999, + "packet_consistency": 0.33366666666666667, + "pna_flow": 0.14706666666666668, + "pna_packet_max": 0.5032666666666668, + "pna_packet_mean": 0.42999999999999994, + "pna_packet_median": 0.42579999999999996, + "pna_packet_trimmed10_mean": 0.4028, + "terminal_flow": 0.9723999999999999, + "terminal_norm": 0.9771333333333333, + "terminal_packet": 0.8018, + "velocity_flow": 0.8266666666666665, + "velocity_flow_t01": 0.7786, + "velocity_flow_t03": 0.7939333333333334, + "velocity_flow_t05": 0.7992666666666667, + "velocity_flow_t07": 0.8191333333333333, + "velocity_flow_t09": 0.8608666666666667, + "velocity_flow_t10": 0.8575333333333334, + "velocity_packet": 0.6748, + "velocity_packet_t01": 0.7051333333333334, + "velocity_packet_t03": 0.5978, + "velocity_packet_t05": 0.5592, + "velocity_packet_t07": 0.5687333333333333, + "velocity_packet_t09": 0.6921333333333333, + "velocity_packet_t10": 0.7470666666666667, + "velocity_total": 0.9065333333333333, + "velocity_total_t01": 0.814, + "velocity_total_t03": 0.8189333333333333, + "velocity_total_t05": 0.8286666666666667, + "velocity_total_t07": 0.8826666666666666, + "velocity_total_t09": 0.9275333333333334, + "velocity_total_t10": 0.9444 + }, + "vulnerabilityscan": { + "_n": 568.0, + "arc_length": 0.7798496478873239, + "causal_surprisal_flow": 0.37180686619718306, + "causal_surprisal_packet_max": 0.48348697183098593, + "causal_surprisal_packet_mean": 0.49124014084507045, + "causal_surprisal_packet_median": 0.4992806338028169, + "causal_surprisal_packet_trimmed10_mean": 0.4903235915492958, + "causal_surprisal_total": 0.42585492957746485, + "consistency_total": 0.7474461267605633, + "curvature_flow": 0.4400271126760563, + "curvature_packet": 0.6072265845070421, + "curvature_total": 0.5850471830985915, + "direction_drift_flow": 0.27132464788732397, + "direction_drift_packet_max": 0.3019776408450704, + "direction_drift_packet_mean": 0.2828850352112676, + "direction_drift_packet_median": 0.28400827464788736, + "direction_drift_packet_trimmed10_mean": 0.2829896126760563, + "direction_drift_total": 0.2576066901408451, + "flow_consistency": 0.7537580985915493, + "jacobian_flow": 0.4272781690140845, + "jacobian_packet": 0.6115984154929577, + "jacobian_total": 0.5776813380281689, + "kappa2_speed2norm_packet_mean": 0.4730984154929578, + "kappa2_speed2norm_packet_median": 0.47488204225352115, + "kappa2_speed2norm_packet_trimmed10_mean": 0.47654612676056335, + "kinetic_energy": 0.7801586267605634, + "kinetic_flow": 0.7193149647887325, + "kinetic_packet": 0.7594080985915493, + "packet_consistency": 0.6501926056338029, + "pna_flow": 0.2645640845070423, + "pna_packet_max": 0.4745288732394366, + "pna_packet_mean": 0.4730984154929578, + "pna_packet_median": 0.47488204225352115, + "pna_packet_trimmed10_mean": 0.47654612676056335, + "terminal_flow": 0.7899859154929578, + "terminal_norm": 0.8057661971830986, + "terminal_packet": 0.7887672535211268, + "velocity_flow": 0.6953327464788732, + "velocity_flow_t01": 0.5767257042253521, + "velocity_flow_t03": 0.6268996478873239, + "velocity_flow_t05": 0.6439492957746479, + "velocity_flow_t07": 0.6643158450704225, + "velocity_flow_t09": 0.7147656690140846, + "velocity_flow_t10": 0.7168091549295774, + "velocity_packet": 0.7178933098591549, + "velocity_packet_t01": 0.652725704225352, + "velocity_packet_t03": 0.6627721830985915, + "velocity_packet_t05": 0.6739683098591549, + "velocity_packet_t07": 0.6845563380281691, + "velocity_packet_t09": 0.6912762323943661, + "velocity_packet_t10": 0.6911010563380282, + "velocity_total": 0.736906514084507, + "velocity_total_t01": 0.6580422535211268, + "velocity_total_t03": 0.6560658450704224, + "velocity_total_t05": 0.6787457746478873, + "velocity_total_t07": 0.7129239436619719, + "velocity_total_t09": 0.7575982394366196, + "velocity_total_t10": 0.7547147887323944 + }, + "xss": { + "_n": 10.0, + "arc_length": 0.7815, + "causal_surprisal_flow": 0.6754800000000001, + "causal_surprisal_packet_max": 0.52926, + "causal_surprisal_packet_mean": 0.45706, + "causal_surprisal_packet_median": 0.4537, + "causal_surprisal_packet_trimmed10_mean": 0.45210000000000006, + "causal_surprisal_total": 0.6054200000000001, + "consistency_total": 0.86478, + "curvature_flow": 0.63066, + "curvature_packet": 0.724, + "curvature_total": 0.7323599999999999, + "direction_drift_flow": 0.22143999999999997, + "direction_drift_packet_max": 0.47751999999999994, + "direction_drift_packet_mean": 0.3741, + "direction_drift_packet_median": 0.34641999999999995, + "direction_drift_packet_trimmed10_mean": 0.3448, + "direction_drift_total": 0.33274000000000004, + "flow_consistency": 0.85592, + "jacobian_flow": 0.212, + "jacobian_packet": 0.57958, + "jacobian_total": 0.4455, + "kappa2_speed2norm_packet_mean": 0.56562, + "kappa2_speed2norm_packet_median": 0.58708, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5821000000000001, + "kinetic_energy": 0.78436, + "kinetic_flow": 0.75516, + "kinetic_packet": 0.72736, + "packet_consistency": 0.77124, + "pna_flow": 0.36535999999999996, + "pna_packet_max": 0.5317799999999999, + "pna_packet_mean": 0.56562, + "pna_packet_median": 0.58708, + "pna_packet_trimmed10_mean": 0.5821000000000001, + "terminal_flow": 0.8452199999999999, + "terminal_norm": 0.8264400000000001, + "terminal_packet": 0.77624, + "velocity_flow": 0.71766, + "velocity_flow_t01": 0.7513, + "velocity_flow_t03": 0.74494, + "velocity_flow_t05": 0.7338600000000001, + "velocity_flow_t07": 0.762, + "velocity_flow_t09": 0.7659400000000001, + "velocity_flow_t10": 0.68608, + "velocity_packet": 0.71446, + "velocity_packet_t01": 0.7376799999999999, + "velocity_packet_t03": 0.722, + "velocity_packet_t05": 0.69288, + "velocity_packet_t07": 0.68224, + "velocity_packet_t09": 0.7721800000000001, + "velocity_packet_t10": 0.7051799999999999, + "velocity_total": 0.7285600000000001, + "velocity_total_t01": 0.7656, + "velocity_total_t03": 0.75298, + "velocity_total_t05": 0.7393000000000001, + "velocity_total_t07": 0.75442, + "velocity_total_t09": 0.79846, + "velocity_total_t10": 0.6989399999999999 + } + }, + "classes": [ + "backdoor_malware", + "commandinjection", + "ddos-ack_fragmentation", + "ddos-http_flood", + "ddos-icmp_flood", + "ddos-icmp_fragmentation", + "ddos-pshack_flood", + "ddos-rstfinflood", + "ddos-slowloris", + "ddos-syn_flood", + "ddos-synonymousip_flood", + "ddos-tcp_flood", + "ddos-udp_flood", + "ddos-udp_fragmentation", + "dictionarybruteforce", + "dns_spoofing", + "dos-http_flood", + "dos-syn_flood", + "dos-tcp_flood", + "dos-udp_flood", + "mirai-greeth_flood", + "mirai-greip_flood", + "mirai-udpplain", + "mitm-arpspoofing", + "recon-hostdiscovery", + "recon-osscan", + "recon-pingsweep", + "recon-portscan", + "sqlinjection", + "uploading_attack", + "vulnerabilityscan", + "xss" + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/config.yaml b/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/config.yaml new file mode 100644 index 0000000..c509633 --- /dev/null +++ b/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/config.yaml @@ -0,0 +1,38 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 43 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_flow: 0.3 +lambda_packet: 0.3 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packet_mask_ratio: 0.5 +packet_preprocess: mixed_dequant +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed43 +seed: 43 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/history.json b/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/history.json new file mode 100644 index 0000000..3b81a1d --- /dev/null +++ b/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/history.json @@ -0,0 +1,243 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 2.295880232101832, + 1.8684886174324231, + 1.5978467464447021, + 1.4300957979300084, + 1.3075781846657777, + 1.2276439682031288, + 1.1702547394312346, + 1.1193513167210114, + 1.0876952623709655, + 1.063691577850244, + 1.0444015081112201, + 1.0404893526664147, + 1.0181697408358257, + 1.0271651362761474, + 1.0115293860435486, + 0.9933616748222938, + 0.9975837973447946, + 0.9984280039102603, + 0.9801298227065649, + 0.9614300345763181, + 0.9616735822115189, + 0.9594148703110523, + 0.9529028901687036, + 0.9418646708512918, + 0.9422893401903983, + 0.9366315603256226, + 0.9280572227942638, + 0.9283825097939907, + 0.9182835358839768, + 0.9140418752645835, + 0.9255502804731711, + 0.9190339079269996, + 0.9110679473632421, + 0.9223887186784011, + 0.9125799139340719, + 0.9046436502383306, + 0.9036675752737583, + 0.9030573383355752, + 0.9007368699098245, + 0.8960085312525431, + 0.8941583770972031, + 0.8919483545498971, + 0.8982304090108627, + 0.8849517366825006, + 0.8925961454709371, + 0.8908993235001197, + 0.8919377281115606, + 0.8867517495766665, + 0.8867396681736677, + 0.8877851244730827 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.7160411, + "auroc_curvature_flow": 0.09011186, + "auroc_curvature_packet": 0.127191385, + "auroc_curvature_total": 0.074348095, + "auroc_kappa2_speed2norm_packet_mean": 0.0859748475, + "auroc_kappa2_speed2norm_packet_median": 0.0875706125, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.0844788875, + "auroc_kinetic_energy": 0.68166931, + "auroc_kinetic_flow": 0.53329249, + "auroc_kinetic_packet": 0.8766312149999999, + "auroc_terminal_flow": 0.9280561725000002, + "auroc_terminal_norm": 0.9473163575, + "auroc_terminal_packet": 0.927704505, + "auroc_velocity_flow": 0.8011699325, + "auroc_velocity_packet": 0.9057326474999999, + "auroc_velocity_total": 0.912806985 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9235617, + "auroc_curvature_flow": 0.128709195, + "auroc_curvature_packet": 0.5519034225, + "auroc_curvature_total": 0.3195195, + "auroc_kappa2_speed2norm_packet_mean": 0.19213105, + "auroc_kappa2_speed2norm_packet_median": 0.1789340975, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.18174933, + "auroc_kinetic_energy": 0.9220352475, + "auroc_kinetic_flow": 0.8552761975, + "auroc_kinetic_packet": 0.9214437375, + "auroc_terminal_flow": 0.9265390550000001, + "auroc_terminal_norm": 0.9582051325000001, + "auroc_terminal_packet": 0.950127255, + "auroc_velocity_flow": 0.8578913675, + "auroc_velocity_packet": 0.891907205, + "auroc_velocity_total": 0.9141368500000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9390620600000001, + "auroc_curvature_flow": 0.27223155250000003, + "auroc_curvature_packet": 0.7314751975, + "auroc_curvature_total": 0.662044635, + "auroc_kappa2_speed2norm_packet_mean": 0.36059098999999994, + "auroc_kappa2_speed2norm_packet_median": 0.3505231125, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.34469324999999995, + "auroc_kinetic_energy": 0.9381241499999999, + "auroc_kinetic_flow": 0.8783319900000001, + "auroc_kinetic_packet": 0.915994365, + "auroc_terminal_flow": 0.9332579775, + "auroc_terminal_norm": 0.9491447225, + "auroc_terminal_packet": 0.931518935, + "auroc_velocity_flow": 0.85969543, + "auroc_velocity_packet": 0.9146603499999999, + "auroc_velocity_total": 0.9204479999999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.94569942, + "auroc_curvature_flow": 0.41047515749999997, + "auroc_curvature_packet": 0.817937595, + "auroc_curvature_total": 0.7759650025, + "auroc_kappa2_speed2norm_packet_mean": 0.3360694875, + "auroc_kappa2_speed2norm_packet_median": 0.3159760875, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.32262335999999997, + "auroc_kinetic_energy": 0.94554309, + "auroc_kinetic_flow": 0.8774956675000001, + "auroc_kinetic_packet": 0.9381295300000001, + "auroc_terminal_flow": 0.93725451, + "auroc_terminal_norm": 0.9627872025, + "auroc_terminal_packet": 0.9530150725, + "auroc_velocity_flow": 0.867424505, + "auroc_velocity_packet": 0.9224518349999999, + "auroc_velocity_total": 0.92370843 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9455949249999999, + "auroc_curvature_flow": 0.524496995, + "auroc_curvature_packet": 0.8366312625000001, + "auroc_curvature_total": 0.8059126200000001, + "auroc_kappa2_speed2norm_packet_mean": 0.455853085, + "auroc_kappa2_speed2norm_packet_median": 0.440969015, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.4467354075, + "auroc_kinetic_energy": 0.9455284425, + "auroc_kinetic_flow": 0.8836721675000001, + "auroc_kinetic_packet": 0.9356948149999998, + "auroc_terminal_flow": 0.9363421950000002, + "auroc_terminal_norm": 0.9627569549999999, + "auroc_terminal_packet": 0.952357455, + "auroc_velocity_flow": 0.8702017025, + "auroc_velocity_packet": 0.9236135700000001, + "auroc_velocity_total": 0.92393059 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/model.pt b/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/model.pt new file mode 100644 index 0000000..c800454 Binary files /dev/null and b/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/model.pt differ diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/phase1.log b/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/phase1.log new file mode 100644 index 0000000..8395f18 --- /dev/null +++ b/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/phase1.log @@ -0,0 +1,132 @@ +[config] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/config.yaml +[model] T=64 flow_dim=20 packet_dim=9 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets_source=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] using external flow features D=20 +[data] rows total=8,193,621 keep len>=2: 3,797,530 +[data] benign=97,045 attack=20,000 -> train=77,636 val=10,000 +[data] train=77,636 val=10,000 attack=20,000 +[eval] scoring val=5,000 and attack=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done in 11.8s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] attack done in 22.7s +[eval] score keys: 57 first 5: ['arc_length', 'causal_surprisal_flow', 'causal_surprisal_packet_max', 'causal_surprisal_packet_mean', 'causal_surprisal_packet_median'] +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/phase1_summary.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/phase1_scores.npz + +=== overall AUROC (sorted desc) === + terminal_norm AUROC=0.9628 AUPRC=0.9834 + terminal_packet AUROC=0.9517 AUPRC=0.9789 + arc_length AUROC=0.9501 AUPRC=0.9743 + kinetic_energy AUROC=0.9500 AUPRC=0.9744 + consistency_total AUROC=0.9423 AUPRC=0.9637 + kinetic_packet AUROC=0.9383 AUPRC=0.9737 + velocity_total_t09 AUROC=0.9367 AUPRC=0.9490 + terminal_flow AUROC=0.9359 AUPRC=0.9625 + velocity_total_t10 AUROC=0.9309 AUPRC=0.9427 + velocity_total AUROC=0.9283 AUPRC=0.9426 + velocity_packet_t09 AUROC=0.9270 AUPRC=0.9646 + flow_consistency AUROC=0.9264 AUPRC=0.9548 + velocity_packet AUROC=0.9257 AUPRC=0.9627 + velocity_total_t07 AUROC=0.9253 AUPRC=0.9446 + velocity_packet_t07 AUROC=0.9221 AUPRC=0.9626 + velocity_packet_t05 AUROC=0.9094 AUPRC=0.9525 + velocity_packet_t10 AUROC=0.9088 AUPRC=0.9544 + velocity_total_t05 AUROC=0.9076 AUPRC=0.9328 + velocity_total_t03 AUROC=0.8903 AUPRC=0.9206 + kinetic_flow AUROC=0.8885 AUPRC=0.8838 + velocity_packet_t03 AUROC=0.8863 AUPRC=0.9332 + velocity_flow_t09 AUROC=0.8853 AUPRC=0.8768 + velocity_flow_t10 AUROC=0.8835 AUPRC=0.8758 + velocity_flow AUROC=0.8754 AUPRC=0.8711 + velocity_flow_t07 AUROC=0.8735 AUPRC=0.8715 + velocity_total_t01 AUROC=0.8690 AUPRC=0.9060 + packet_consistency AUROC=0.8622 AUPRC=0.9356 + velocity_packet_t01 AUROC=0.8603 AUPRC=0.9060 + velocity_flow_t05 AUROC=0.8483 AUPRC=0.8582 + velocity_flow_t03 AUROC=0.8208 AUPRC=0.8444 + velocity_flow_t01 AUROC=0.8151 AUPRC=0.8420 + curvature_packet AUROC=0.7823 AUPRC=0.8649 + curvature_total AUROC=0.7281 AUPRC=0.8239 + causal_surprisal_packet_max AUROC=0.5809 AUPRC=0.6521 + causal_surprisal_packet_median AUROC=0.5777 AUPRC=0.6744 + causal_surprisal_packet_mean AUROC=0.5773 AUPRC=0.6586 + causal_surprisal_packet_trimmed10_mean AUROC=0.5740 AUPRC=0.6612 + jacobian_packet AUROC=0.5321 AUPRC=0.7323 + causal_surprisal_total AUROC=0.5262 AUPRC=0.6848 + causal_surprisal_flow AUROC=0.5213 AUPRC=0.6473 + pna_packet_max AUROC=0.3699 AUPRC=0.6075 + curvature_flow AUROC=0.3404 AUPRC=0.5788 + jacobian_total AUROC=0.2975 AUPRC=0.5693 + kappa2_speed2norm_packet_mean AUROC=0.2924 AUPRC=0.5569 + pna_packet_mean AUROC=0.2924 AUPRC=0.5569 + kappa2_speed2norm_packet_trimmed10_mean AUROC=0.2792 AUPRC=0.5514 + pna_packet_trimmed10_mean AUROC=0.2792 AUPRC=0.5514 + kappa2_speed2norm_packet_median AUROC=0.2720 AUPRC=0.5474 + pna_packet_median AUROC=0.2720 AUPRC=0.5474 + direction_drift_packet_max AUROC=0.1729 AUPRC=0.4987 + jacobian_flow AUROC=0.1509 AUPRC=0.4821 + direction_drift_flow AUROC=0.1133 AUPRC=0.4727 + direction_drift_packet_trimmed10_mean AUROC=0.1075 AUPRC=0.4721 + direction_drift_packet_median AUROC=0.1054 AUPRC=0.4716 + direction_drift_packet_mean AUROC=0.1021 AUPRC=0.4709 + pna_flow AUROC=0.0819 AUPRC=0.4649 + direction_drift_total AUROC=0.0786 AUPRC=0.4642 diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/phase1_scores.npz b/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/phase1_scores.npz new file mode 100644 index 0000000..d2fa829 Binary files /dev/null and b/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/phase1_summary.json b/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/phase1_summary.json new file mode 100644 index 0000000..a658754 --- /dev/null +++ b/artifacts/route_comparison/route_a_causal_ciciot2023_seed43/phase1_summary.json @@ -0,0 +1,2293 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed43", + "config": { + "T": 64, + "attack_cap": 20000, + "batch_size": 256, + "benign_label": "normal", + "d_model": 128, + "data_seed": 43, + "device": "auto", + "epochs": 50, + "eval_batch_size": 512, + "eval_every": 10, + "eval_n": 20000, + "eval_n_steps": 8, + "flow_features_align": "auto", + "flow_features_path": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet", + "flows_parquet": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet", + "grad_clip": 1.0, + "lambda_flow": 0.3, + "lambda_packet": 0.3, + "lr": 0.0003, + "min_len": 2, + "mlp_ratio": 4.0, + "n_heads": 4, + "n_layers": 4, + "n_train": 10000, + "num_workers": 0, + "packet_mask_ratio": 0.5, + "packet_preprocess": "mixed_dequant", + "reference_mode": "causal_packets", + "save_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed43", + "seed": 43, + "sigma": 0.1, + "source_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "time_dim": 64, + "token_dim": null, + "train_ratio": 0.8, + "use_ot": true, + "val_cap": 10000, + "weight_decay": 0.01 + }, + "n_val": 5000, + "n_atk": 10000, + "n_score_keys": 57, + "overall": { + "arc_length": { + "auroc": 0.9501263, + "auprc": 0.9742638278825755 + }, + "causal_surprisal_flow": { + "auroc": 0.52131696, + "auprc": 0.6472942282084528 + }, + "causal_surprisal_packet_max": { + "auroc": 0.5808856200000001, + "auprc": 0.6520654716866037 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.57734814, + "auprc": 0.6586048640760436 + }, + "causal_surprisal_packet_median": { + "auroc": 0.57770339, + "auprc": 0.6744376176898041 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.57401253, + "auprc": 0.6612172210338509 + }, + "causal_surprisal_total": { + "auroc": 0.52621054, + "auprc": 0.6848263212478207 + }, + "consistency_total": { + "auroc": 0.94229569, + "auprc": 0.9636839081733923 + }, + "curvature_flow": { + "auroc": 0.34037873, + "auprc": 0.5788312987412059 + }, + "curvature_packet": { + "auroc": 0.7822796699999999, + "auprc": 0.8649145761209924 + }, + "curvature_total": { + "auroc": 0.7281043600000001, + "auprc": 0.8238917444706713 + }, + "direction_drift_flow": { + "auroc": 0.11325679000000001, + "auprc": 0.4727020191816568 + }, + "direction_drift_packet_max": { + "auroc": 0.17294982, + "auprc": 0.4987229250702603 + }, + "direction_drift_packet_mean": { + "auroc": 0.10208586, + "auprc": 0.47093462233802297 + }, + "direction_drift_packet_median": { + "auroc": 0.10540125, + "auprc": 0.4716317092046137 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.10748471999999999, + "auprc": 0.4721264764004349 + }, + "direction_drift_total": { + "auroc": 0.0785814, + "auprc": 0.4641504647523549 + }, + "flow_consistency": { + "auroc": 0.92639274, + "auprc": 0.9548334884076529 + }, + "jacobian_flow": { + "auroc": 0.15092244, + "auprc": 0.4820941488091061 + }, + "jacobian_packet": { + "auroc": 0.5320780199999999, + "auprc": 0.7322905615589328 + }, + "jacobian_total": { + "auroc": 0.29749110999999995, + "auprc": 0.5693249683724366 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.29239559, + "auprc": 0.556871737001611 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.27203042, + "auprc": 0.5473610250881664 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.27920801, + "auprc": 0.5514471761728825 + }, + "kinetic_energy": { + "auroc": 0.95002264, + "auprc": 0.9743944308099081 + }, + "kinetic_flow": { + "auroc": 0.88845076, + "auprc": 0.8838271323140281 + }, + "kinetic_packet": { + "auroc": 0.93834103, + "auprc": 0.9737246078325256 + }, + "packet_consistency": { + "auroc": 0.86219512, + "auprc": 0.935602034588357 + }, + "pna_flow": { + "auroc": 0.08192476000000001, + "auprc": 0.4648924332790568 + }, + "pna_packet_max": { + "auroc": 0.36991358, + "auprc": 0.6074655614615061 + }, + "pna_packet_mean": { + "auroc": 0.29239559, + "auprc": 0.556871737001611 + }, + "pna_packet_median": { + "auroc": 0.27203042, + "auprc": 0.5473610250881664 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.27920801, + "auprc": 0.5514471761728825 + }, + "terminal_flow": { + "auroc": 0.93587644, + "auprc": 0.9625408612164544 + }, + "terminal_norm": { + "auroc": 0.96282823, + "auprc": 0.9833876751372082 + }, + "terminal_packet": { + "auroc": 0.95174208, + "auprc": 0.9788504312352111 + }, + "velocity_flow": { + "auroc": 0.87542161, + "auprc": 0.8711179960020345 + }, + "velocity_flow_t01": { + "auroc": 0.81507632, + "auprc": 0.8420292504760778 + }, + "velocity_flow_t03": { + "auroc": 0.8208200900000001, + "auprc": 0.8443551977904278 + }, + "velocity_flow_t05": { + "auroc": 0.84828997, + "auprc": 0.8582133885309114 + }, + "velocity_flow_t07": { + "auroc": 0.87345659, + "auprc": 0.8714834974614455 + }, + "velocity_flow_t09": { + "auroc": 0.8852907799999999, + "auprc": 0.8768101141942644 + }, + "velocity_flow_t10": { + "auroc": 0.8834782200000001, + "auprc": 0.8757570891986587 + }, + "velocity_packet": { + "auroc": 0.9256681800000001, + "auprc": 0.9626722930914111 + }, + "velocity_packet_t01": { + "auroc": 0.86032681, + "auprc": 0.9060380498511079 + }, + "velocity_packet_t03": { + "auroc": 0.88626972, + "auprc": 0.9332010111601389 + }, + "velocity_packet_t05": { + "auroc": 0.9093822300000001, + "auprc": 0.9524658156029742 + }, + "velocity_packet_t07": { + "auroc": 0.92207355, + "auprc": 0.9626002450300302 + }, + "velocity_packet_t09": { + "auroc": 0.92698802, + "auprc": 0.9646053624939976 + }, + "velocity_packet_t10": { + "auroc": 0.9087925699999999, + "auprc": 0.9544308188120098 + }, + "velocity_total": { + "auroc": 0.9283014999999999, + "auprc": 0.9425568273214695 + }, + "velocity_total_t01": { + "auroc": 0.8690447799999999, + "auprc": 0.9060080016781001 + }, + "velocity_total_t03": { + "auroc": 0.8902975299999999, + "auprc": 0.9205952768720114 + }, + "velocity_total_t05": { + "auroc": 0.9075936699999999, + "auprc": 0.9328272711208448 + }, + "velocity_total_t07": { + "auroc": 0.92530172, + "auprc": 0.9445536884269143 + }, + "velocity_total_t09": { + "auroc": 0.93665616, + "auprc": 0.9490010390650114 + }, + "velocity_total_t10": { + "auroc": 0.93089613, + "auprc": 0.9426512184835352 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 9.0, + "arc_length": 0.8778666666666667, + "causal_surprisal_flow": 0.5984666666666667, + "causal_surprisal_packet_max": 0.4463555555555555, + "causal_surprisal_packet_mean": 0.37886666666666663, + "causal_surprisal_packet_median": 0.3987111111111111, + "causal_surprisal_packet_trimmed10_mean": 0.38762222222222226, + "causal_surprisal_total": 0.5102444444444445, + "consistency_total": 0.7878666666666667, + "curvature_flow": 0.3657111111111111, + "curvature_packet": 0.5328222222222222, + "curvature_total": 0.4854666666666666, + "direction_drift_flow": 0.15597777777777777, + "direction_drift_packet_max": 0.3157333333333333, + "direction_drift_packet_mean": 0.28337777777777784, + "direction_drift_packet_median": 0.3060444444444444, + "direction_drift_packet_trimmed10_mean": 0.3010222222222222, + "direction_drift_total": 0.17757777777777778, + "flow_consistency": 0.7584666666666666, + "jacobian_flow": 0.24566666666666662, + "jacobian_packet": 0.34348888888888884, + "jacobian_total": 0.28844444444444445, + "kappa2_speed2norm_packet_mean": 0.28788888888888886, + "kappa2_speed2norm_packet_median": 0.286, + "kappa2_speed2norm_packet_trimmed10_mean": 0.30177777777777776, + "kinetic_energy": 0.8748222222222222, + "kinetic_flow": 0.8303111111111111, + "kinetic_packet": 0.7435777777777777, + "packet_consistency": 0.6950444444444445, + "pna_flow": 0.10017777777777778, + "pna_packet_max": 0.35408888888888884, + "pna_packet_mean": 0.28788888888888886, + "pna_packet_median": 0.286, + "pna_packet_trimmed10_mean": 0.30177777777777776, + "terminal_flow": 0.930711111111111, + "terminal_norm": 0.9318888888888888, + "terminal_packet": 0.8410888888888888, + "velocity_flow": 0.8171999999999999, + "velocity_flow_t01": 0.6857777777777778, + "velocity_flow_t03": 0.7277333333333333, + "velocity_flow_t05": 0.7644666666666666, + "velocity_flow_t07": 0.8063777777777777, + "velocity_flow_t09": 0.8553999999999999, + "velocity_flow_t10": 0.8459777777777777, + "velocity_packet": 0.7868, + "velocity_packet_t01": 0.6184888888888889, + "velocity_packet_t03": 0.6363777777777777, + "velocity_packet_t05": 0.6651777777777778, + "velocity_packet_t07": 0.7153111111111111, + "velocity_packet_t09": 0.8031777777777778, + "velocity_packet_t10": 0.8744222222222221, + "velocity_total": 0.8559555555555556, + "velocity_total_t01": 0.6718222222222222, + "velocity_total_t03": 0.7266, + "velocity_total_t05": 0.765311111111111, + "velocity_total_t07": 0.8198666666666665, + "velocity_total_t09": 0.9050222222222223, + "velocity_total_t10": 0.8943333333333333 + }, + "browserhijacking": { + "_n": 3.0, + "arc_length": 0.911, + "causal_surprisal_flow": 0.5293999999999999, + "causal_surprisal_packet_max": 0.2558666666666667, + "causal_surprisal_packet_mean": 0.21406666666666668, + "causal_surprisal_packet_median": 0.23486666666666667, + "causal_surprisal_packet_trimmed10_mean": 0.22986666666666666, + "causal_surprisal_total": 0.4097333333333333, + "consistency_total": 0.9434, + "curvature_flow": 0.6133333333333333, + "curvature_packet": 0.3804666666666666, + "curvature_total": 0.4927333333333333, + "direction_drift_flow": 0.2744, + "direction_drift_packet_max": 0.2687333333333333, + "direction_drift_packet_mean": 0.13986666666666664, + "direction_drift_packet_median": 0.18780000000000002, + "direction_drift_packet_trimmed10_mean": 0.1601333333333333, + "direction_drift_total": 0.14006666666666667, + "flow_consistency": 0.9338000000000001, + "jacobian_flow": 0.3414, + "jacobian_packet": 0.6297333333333333, + "jacobian_total": 0.5545333333333333, + "kappa2_speed2norm_packet_mean": 0.2553333333333333, + "kappa2_speed2norm_packet_median": 0.2690666666666667, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2542, + "kinetic_energy": 0.9116, + "kinetic_flow": 0.8165333333333333, + "kinetic_packet": 0.8262666666666667, + "packet_consistency": 0.8148, + "pna_flow": 0.34126666666666666, + "pna_packet_max": 0.35686666666666667, + "pna_packet_mean": 0.2553333333333333, + "pna_packet_median": 0.2690666666666667, + "pna_packet_trimmed10_mean": 0.2542, + "terminal_flow": 0.7770666666666667, + "terminal_norm": 0.8068666666666666, + "terminal_packet": 0.8378, + "velocity_flow": 0.7409333333333333, + "velocity_flow_t01": 0.6578666666666666, + "velocity_flow_t03": 0.6951333333333333, + "velocity_flow_t05": 0.7282, + "velocity_flow_t07": 0.7242666666666666, + "velocity_flow_t09": 0.7932666666666667, + "velocity_flow_t10": 0.7854, + "velocity_packet": 0.6957333333333332, + "velocity_packet_t01": 0.5617333333333333, + "velocity_packet_t03": 0.5588, + "velocity_packet_t05": 0.5743999999999999, + "velocity_packet_t07": 0.6752, + "velocity_packet_t09": 0.7295999999999999, + "velocity_packet_t10": 0.7153999999999999, + "velocity_total": 0.7582, + "velocity_total_t01": 0.6522666666666667, + "velocity_total_t03": 0.6924666666666666, + "velocity_total_t05": 0.7193333333333333, + "velocity_total_t07": 0.7378666666666666, + "velocity_total_t09": 0.7864666666666666, + "velocity_total_t10": 0.7672666666666667 + }, + "commandinjection": { + "_n": 13.0, + "arc_length": 0.8676153846153846, + "causal_surprisal_flow": 0.624123076923077, + "causal_surprisal_packet_max": 0.41692307692307695, + "causal_surprisal_packet_mean": 0.35393846153846154, + "causal_surprisal_packet_median": 0.32572307692307695, + "causal_surprisal_packet_trimmed10_mean": 0.33080000000000004, + "causal_surprisal_total": 0.530723076923077, + "consistency_total": 0.7606923076923078, + "curvature_flow": 0.6504153846153846, + "curvature_packet": 0.7629384615384616, + "curvature_total": 0.7759846153846154, + "direction_drift_flow": 0.12084615384615385, + "direction_drift_packet_max": 0.4902615384615384, + "direction_drift_packet_mean": 0.3353538461538461, + "direction_drift_packet_median": 0.3226769230769231, + "direction_drift_packet_trimmed10_mean": 0.3048461538461538, + "direction_drift_total": 0.28310769230769234, + "flow_consistency": 0.7684769230769232, + "jacobian_flow": 0.16215384615384618, + "jacobian_packet": 0.3608923076923077, + "jacobian_total": 0.21073846153846154, + "kappa2_speed2norm_packet_mean": 0.6121692307692308, + "kappa2_speed2norm_packet_median": 0.6042153846153846, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5939076923076922, + "kinetic_energy": 0.8641384615384615, + "kinetic_flow": 0.860123076923077, + "kinetic_packet": 0.6653230769230769, + "packet_consistency": 0.5869692307692308, + "pna_flow": 0.19027692307692307, + "pna_packet_max": 0.6707076923076923, + "pna_packet_mean": 0.6121692307692308, + "pna_packet_median": 0.6042153846153846, + "pna_packet_trimmed10_mean": 0.5939076923076922, + "terminal_flow": 0.8857384615384615, + "terminal_norm": 0.8221846153846154, + "terminal_packet": 0.687123076923077, + "velocity_flow": 0.859276923076923, + "velocity_flow_t01": 0.8464153846153846, + "velocity_flow_t03": 0.8467846153846154, + "velocity_flow_t05": 0.8460000000000001, + "velocity_flow_t07": 0.853323076923077, + "velocity_flow_t09": 0.8818, + "velocity_flow_t10": 0.8748461538461538, + "velocity_packet": 0.7298769230769231, + "velocity_packet_t01": 0.7732307692307692, + "velocity_packet_t03": 0.7413846153846154, + "velocity_packet_t05": 0.7255692307692307, + "velocity_packet_t07": 0.7036923076923077, + "velocity_packet_t09": 0.7643692307692308, + "velocity_packet_t10": 0.7151076923076923, + "velocity_total": 0.8495538461538461, + "velocity_total_t01": 0.8372307692307693, + "velocity_total_t03": 0.8358461538461539, + "velocity_total_t05": 0.8393692307692308, + "velocity_total_t07": 0.8444923076923077, + "velocity_total_t09": 0.8826923076923077, + "velocity_total_t10": 0.8602307692307692 + }, + "ddos-ack_fragmentation": { + "_n": 316.0, + "arc_length": 0.9865569620253165, + "causal_surprisal_flow": 0.14261518987341773, + "causal_surprisal_packet_max": 0.03557278481012659, + "causal_surprisal_packet_mean": 0.03586708860759493, + "causal_surprisal_packet_median": 0.034555696202531655, + "causal_surprisal_packet_trimmed10_mean": 0.03388734177215191, + "causal_surprisal_total": 0.10815, + "consistency_total": 0.9677025316455696, + "curvature_flow": 0.10743354430379748, + "curvature_packet": 0.9754253164556963, + "curvature_total": 0.8983348101265822, + "direction_drift_flow": 0.11348006329113924, + "direction_drift_packet_max": 0.052731012658227855, + "direction_drift_packet_mean": 0.049394303797468356, + "direction_drift_packet_median": 0.05769620253164557, + "direction_drift_packet_trimmed10_mean": 0.056038607594936694, + "direction_drift_total": 0.03250063291139241, + "flow_consistency": 0.9523101265822785, + "jacobian_flow": 0.03393227848101266, + "jacobian_packet": 0.9015930379746836, + "jacobian_total": 0.38765316455696197, + "kappa2_speed2norm_packet_mean": 0.3530721518987342, + "kappa2_speed2norm_packet_median": 0.36414556962025313, + "kappa2_speed2norm_packet_trimmed10_mean": 0.37863037974683544, + "kinetic_energy": 0.9864525316455697, + "kinetic_flow": 0.9244999999999999, + "kinetic_packet": 0.976493670886076, + "packet_consistency": 0.9613531645569621, + "pna_flow": 0.025870569620253164, + "pna_packet_max": 0.27845632911392404, + "pna_packet_mean": 0.3530721518987342, + "pna_packet_median": 0.36414556962025313, + "pna_packet_trimmed10_mean": 0.37863037974683544, + "terminal_flow": 0.9909582278481013, + "terminal_norm": 0.9927702531645569, + "terminal_packet": 0.9837221518987341, + "velocity_flow": 0.9054221518987341, + "velocity_flow_t01": 0.9255291139240507, + "velocity_flow_t03": 0.9229930379746836, + "velocity_flow_t05": 0.9193575949367089, + "velocity_flow_t07": 0.9082335443037974, + "velocity_flow_t09": 0.8981208860759493, + "velocity_flow_t10": 0.8909120253164557, + "velocity_packet": 0.9812974683544304, + "velocity_packet_t01": 0.9703056962025316, + "velocity_packet_t03": 0.9745240506329115, + "velocity_packet_t05": 0.9809544303797467, + "velocity_packet_t07": 0.9833803797468355, + "velocity_packet_t09": 0.9812455696202533, + "velocity_packet_t10": 0.9660620253164557, + "velocity_total": 0.9815462025316455, + "velocity_total_t01": 0.9841955696202531, + "velocity_total_t03": 0.9837784810126583, + "velocity_total_t05": 0.9831151898734176, + "velocity_total_t07": 0.9834012658227849, + "velocity_total_t09": 0.9818405063291138, + "velocity_total_t10": 0.9760316455696203 + }, + "ddos-http_flood": { + "_n": 915.0, + "arc_length": 0.9685508196721311, + "causal_surprisal_flow": 0.5545606557377049, + "causal_surprisal_packet_max": 0.6689468852459016, + "causal_surprisal_packet_mean": 0.6580762841530055, + "causal_surprisal_packet_median": 0.6531567213114755, + "causal_surprisal_packet_trimmed10_mean": 0.6516778142076504, + "causal_surprisal_total": 0.5639213114754098, + "consistency_total": 0.9646538797814208, + "curvature_flow": 0.46194448087431694, + "curvature_packet": 0.8805661202185793, + "curvature_total": 0.8302731147540983, + "direction_drift_flow": 0.1377824043715847, + "direction_drift_packet_max": 0.1626216393442623, + "direction_drift_packet_mean": 0.09271628415300547, + "direction_drift_packet_median": 0.09469180327868852, + "direction_drift_packet_trimmed10_mean": 0.09752306010928961, + "direction_drift_total": 0.06692830601092896, + "flow_consistency": 0.9551497267759562, + "jacobian_flow": 0.19731213114754098, + "jacobian_packet": 0.52322, + "jacobian_total": 0.3830968306010929, + "kappa2_speed2norm_packet_mean": 0.4576974863387978, + "kappa2_speed2norm_packet_median": 0.4529943169398907, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4647097267759563, + "kinetic_energy": 0.9682837158469945, + "kinetic_flow": 0.8818485245901639, + "kinetic_packet": 0.9676790163934426, + "packet_consistency": 0.7988542076502732, + "pna_flow": 0.10189836065573771, + "pna_packet_max": 0.43754273224043716, + "pna_packet_mean": 0.4576974863387978, + "pna_packet_median": 0.4529943169398907, + "pna_packet_trimmed10_mean": 0.4647097267759563, + "terminal_flow": 0.9706212021857925, + "terminal_norm": 0.9891943169398906, + "terminal_packet": 0.9750252459016394, + "velocity_flow": 0.8705862295081968, + "velocity_flow_t01": 0.7364706010928962, + "velocity_flow_t03": 0.7418524590163934, + "velocity_flow_t05": 0.8173248087431694, + "velocity_flow_t07": 0.8666607650273224, + "velocity_flow_t09": 0.8835495081967214, + "velocity_flow_t10": 0.8906063387978143, + "velocity_packet": 0.9384977049180327, + "velocity_packet_t01": 0.8493108196721311, + "velocity_packet_t03": 0.8896054644808743, + "velocity_packet_t05": 0.9247663387978142, + "velocity_packet_t07": 0.9385444808743169, + "velocity_packet_t09": 0.9518535519125684, + "velocity_packet_t10": 0.8918245901639343, + "velocity_total": 0.9351610928961747, + "velocity_total_t01": 0.8348804371584699, + "velocity_total_t03": 0.8719169398907105, + "velocity_total_t05": 0.9048679781420764, + "velocity_total_t07": 0.9329790163934426, + "velocity_total_t09": 0.9521420765027322, + "velocity_total_t10": 0.9481842622950819 + }, + "ddos-icmp_flood": { + "_n": 20.0, + "arc_length": 0.64589, + "causal_surprisal_flow": 0.38756, + "causal_surprisal_packet_max": 0.43796999999999997, + "causal_surprisal_packet_mean": 0.43435999999999997, + "causal_surprisal_packet_median": 0.42172000000000004, + "causal_surprisal_packet_trimmed10_mean": 0.4296399999999999, + "causal_surprisal_total": 0.40132, + "consistency_total": 0.7599899999999999, + "curvature_flow": 0.3308, + "curvature_packet": 0.58967, + "curvature_total": 0.56199, + "direction_drift_flow": 0.27199, + "direction_drift_packet_max": 0.44114, + "direction_drift_packet_mean": 0.51793, + "direction_drift_packet_median": 0.52397, + "direction_drift_packet_trimmed10_mean": 0.5322000000000001, + "direction_drift_total": 0.38126, + "flow_consistency": 0.7552599999999999, + "jacobian_flow": 0.37197, + "jacobian_packet": 0.46694, + "jacobian_total": 0.46526, + "kappa2_speed2norm_packet_mean": 0.46960999999999997, + "kappa2_speed2norm_packet_median": 0.46481, + "kappa2_speed2norm_packet_trimmed10_mean": 0.47616, + "kinetic_energy": 0.64663, + "kinetic_flow": 0.59782, + "kinetic_packet": 0.61148, + "packet_consistency": 0.58981, + "pna_flow": 0.3849900000000001, + "pna_packet_max": 0.50753, + "pna_packet_mean": 0.46960999999999997, + "pna_packet_median": 0.46481, + "pna_packet_trimmed10_mean": 0.47616, + "terminal_flow": 0.68947, + "terminal_norm": 0.7308199999999999, + "terminal_packet": 0.69713, + "velocity_flow": 0.5830899999999999, + "velocity_flow_t01": 0.5301, + "velocity_flow_t03": 0.53768, + "velocity_flow_t05": 0.5584600000000001, + "velocity_flow_t07": 0.60278, + "velocity_flow_t09": 0.64401, + "velocity_flow_t10": 0.5635600000000001, + "velocity_packet": 0.59171, + "velocity_packet_t01": 0.57642, + "velocity_packet_t03": 0.5783699999999999, + "velocity_packet_t05": 0.58151, + "velocity_packet_t07": 0.5845, + "velocity_packet_t09": 0.56174, + "velocity_packet_t10": 0.60466, + "velocity_total": 0.60925, + "velocity_total_t01": 0.5800299999999999, + "velocity_total_t03": 0.59062, + "velocity_total_t05": 0.5958800000000001, + "velocity_total_t07": 0.60793, + "velocity_total_t09": 0.63822, + "velocity_total_t10": 0.61966 + }, + "ddos-icmp_fragmentation": { + "_n": 38.0, + "arc_length": 0.8158868421052632, + "causal_surprisal_flow": 0.49334210526315786, + "causal_surprisal_packet_max": 0.30215263157894734, + "causal_surprisal_packet_mean": 0.2692052631578947, + "causal_surprisal_packet_median": 0.2696421052631579, + "causal_surprisal_packet_trimmed10_mean": 0.26523684210526316, + "causal_surprisal_total": 0.4729315789473684, + "consistency_total": 0.840657894736842, + "curvature_flow": 0.40452631578947373, + "curvature_packet": 0.5834157894736842, + "curvature_total": 0.5747684210526315, + "direction_drift_flow": 0.21400526315789475, + "direction_drift_packet_max": 0.4275736842105263, + "direction_drift_packet_mean": 0.5207315789473683, + "direction_drift_packet_median": 0.5164842105263158, + "direction_drift_packet_trimmed10_mean": 0.5297210526315789, + "direction_drift_total": 0.38574210526315794, + "flow_consistency": 0.8475684210526315, + "jacobian_flow": 0.33908684210526313, + "jacobian_packet": 0.5429052631578948, + "jacobian_total": 0.4695631578947368, + "kappa2_speed2norm_packet_mean": 0.5609105263157895, + "kappa2_speed2norm_packet_median": 0.5729052631578947, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5725736842105263, + "kinetic_energy": 0.815778947368421, + "kinetic_flow": 0.7277578947368422, + "kinetic_packet": 0.6560315789473685, + "packet_consistency": 0.44522631578947364, + "pna_flow": 0.2021684210526316, + "pna_packet_max": 0.5088052631578948, + "pna_packet_mean": 0.5609105263157895, + "pna_packet_median": 0.5729052631578947, + "pna_packet_trimmed10_mean": 0.5725736842105263, + "terminal_flow": 0.8372894736842106, + "terminal_norm": 0.8665157894736842, + "terminal_packet": 0.7321684210526316, + "velocity_flow": 0.7329526315789475, + "velocity_flow_t01": 0.6181894736842105, + "velocity_flow_t03": 0.6523105263157895, + "velocity_flow_t05": 0.6863157894736843, + "velocity_flow_t07": 0.7162263157894736, + "velocity_flow_t09": 0.7593052631578947, + "velocity_flow_t10": 0.7474315789473683, + "velocity_packet": 0.5514157894736842, + "velocity_packet_t01": 0.5502368421052631, + "velocity_packet_t03": 0.5443842105263158, + "velocity_packet_t05": 0.5434842105263158, + "velocity_packet_t07": 0.5292368421052631, + "velocity_packet_t09": 0.5115210526315788, + "velocity_packet_t10": 0.5574947368421053, + "velocity_total": 0.7543, + "velocity_total_t01": 0.6480736842105262, + "velocity_total_t03": 0.6737026315789474, + "velocity_total_t05": 0.7013736842105263, + "velocity_total_t07": 0.7299736842105263, + "velocity_total_t09": 0.7671736842105263, + "velocity_total_t10": 0.7382947368421052 + }, + "ddos-pshack_flood": { + "_n": 1046.0, + "arc_length": 0.9922179732313575, + "causal_surprisal_flow": 0.5771558317399618, + "causal_surprisal_packet_max": 0.649916156787763, + "causal_surprisal_packet_mean": 0.6676399617590822, + "causal_surprisal_packet_median": 0.666148948374761, + "causal_surprisal_packet_trimmed10_mean": 0.6624925430210326, + "causal_surprisal_total": 0.5750288718929254, + "consistency_total": 0.9767810707456979, + "curvature_flow": 0.347740535372849, + "curvature_packet": 0.9350179732313576, + "curvature_total": 0.889640535372849, + "direction_drift_flow": 0.0325821223709369, + "direction_drift_packet_max": 0.16317629063097516, + "direction_drift_packet_mean": 0.024486042065009567, + "direction_drift_packet_median": 0.024612237093690252, + "direction_drift_packet_trimmed10_mean": 0.027225239005736136, + "direction_drift_total": 0.0146414913957935, + "flow_consistency": 0.9224707456978968, + "jacobian_flow": 0.046886806883365204, + "jacobian_packet": 0.31329120458891013, + "jacobian_total": 0.0890614722753346, + "kappa2_speed2norm_packet_mean": 0.26046175908221797, + "kappa2_speed2norm_packet_median": 0.20341988527724664, + "kappa2_speed2norm_packet_trimmed10_mean": 0.21982370936902487, + "kinetic_energy": 0.9922334608030593, + "kinetic_flow": 0.9491137667304015, + "kinetic_packet": 0.9957657743785852, + "packet_consistency": 0.9916076481835564, + "pna_flow": 0.03153738049713193, + "pna_packet_max": 0.4271481835564054, + "pna_packet_mean": 0.26046175908221797, + "pna_packet_median": 0.20341988527724664, + "pna_packet_trimmed10_mean": 0.21982370936902487, + "terminal_flow": 0.9082548757170172, + "terminal_norm": 0.992963862332696, + "terminal_packet": 0.9956560229445507, + "velocity_flow": 0.9366141491395794, + "velocity_flow_t01": 0.9293845124282983, + "velocity_flow_t03": 0.9322240917782026, + "velocity_flow_t05": 0.9390294455066922, + "velocity_flow_t07": 0.94084034416826, + "velocity_flow_t09": 0.9358200764818355, + "velocity_flow_t10": 0.9322632887189294, + "velocity_packet": 0.991476673040153, + "velocity_packet_t01": 0.9744048757170172, + "velocity_packet_t03": 0.9855179732313576, + "velocity_packet_t05": 0.9906705544933079, + "velocity_packet_t07": 0.992327533460803, + "velocity_packet_t09": 0.9909650095602295, + "velocity_packet_t10": 0.9893535372848947, + "velocity_total": 0.9830254302103251, + "velocity_total_t01": 0.9725520076481836, + "velocity_total_t03": 0.9789474187380497, + "velocity_total_t05": 0.9819975143403441, + "velocity_total_t07": 0.9827173996175907, + "velocity_total_t09": 0.9826231357552582, + "velocity_total_t10": 0.9835512428298279 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "arc_length": 0.2152, + "causal_surprisal_flow": 0.4146, + "causal_surprisal_packet_max": 0.11509999999999998, + "causal_surprisal_packet_mean": 0.14340000000000003, + "causal_surprisal_packet_median": 0.16599999999999998, + "causal_surprisal_packet_trimmed10_mean": 0.15969999999999995, + "causal_surprisal_total": 0.4379, + "consistency_total": 0.8129, + "curvature_flow": 0.19080000000000003, + "curvature_packet": 0.03749999999999998, + "curvature_total": 0.03689999999999999, + "direction_drift_flow": 0.5244, + "direction_drift_packet_max": 0.3304, + "direction_drift_packet_mean": 0.6556, + "direction_drift_packet_median": 0.6526000000000001, + "direction_drift_packet_trimmed10_mean": 0.6642, + "direction_drift_total": 0.5343, + "flow_consistency": 0.7376, + "jacobian_flow": 0.5642, + "jacobian_packet": 0.7289, + "jacobian_total": 0.7938000000000001, + "kappa2_speed2norm_packet_mean": 0.1281, + "kappa2_speed2norm_packet_median": 0.1306, + "kappa2_speed2norm_packet_trimmed10_mean": 0.1306, + "kinetic_energy": 0.21489999999999998, + "kinetic_flow": 0.30469999999999997, + "kinetic_packet": 0.20140000000000002, + "packet_consistency": 0.8858, + "pna_flow": 0.2998, + "pna_packet_max": 0.29769999999999996, + "pna_packet_mean": 0.1281, + "pna_packet_median": 0.1306, + "pna_packet_trimmed10_mean": 0.1306, + "terminal_flow": 0.4649, + "terminal_norm": 0.5673, + "terminal_packet": 0.5951, + "velocity_flow": 0.4667, + "velocity_flow_t01": 0.4307, + "velocity_flow_t03": 0.4199, + "velocity_flow_t05": 0.42689999999999995, + "velocity_flow_t07": 0.4306, + "velocity_flow_t09": 0.5035000000000001, + "velocity_flow_t10": 0.5444, + "velocity_packet": 0.17209999999999998, + "velocity_packet_t01": 0.25329999999999997, + "velocity_packet_t03": 0.238, + "velocity_packet_t05": 0.20879999999999999, + "velocity_packet_t07": 0.1992, + "velocity_packet_t09": 0.2027, + "velocity_packet_t10": 0.2042, + "velocity_total": 0.3845, + "velocity_total_t01": 0.36979999999999996, + "velocity_total_t03": 0.3625, + "velocity_total_t05": 0.3497, + "velocity_total_t07": 0.352, + "velocity_total_t09": 0.39849999999999997, + "velocity_total_t10": 0.384 + }, + "ddos-slowloris": { + "_n": 314.0, + "arc_length": 0.8331184713375797, + "causal_surprisal_flow": 0.7551210191082802, + "causal_surprisal_packet_max": 0.6596267515923566, + "causal_surprisal_packet_mean": 0.6227420382165606, + "causal_surprisal_packet_median": 0.6002630573248409, + "causal_surprisal_packet_trimmed10_mean": 0.5989910828025478, + "causal_surprisal_total": 0.6518382165605097, + "consistency_total": 0.914484076433121, + "curvature_flow": 0.2948751592356688, + "curvature_packet": 0.8408878980891719, + "curvature_total": 0.8080592356687899, + "direction_drift_flow": 0.1711611464968153, + "direction_drift_packet_max": 0.5768726114649682, + "direction_drift_packet_mean": 0.3691866242038217, + "direction_drift_packet_median": 0.35462866242038216, + "direction_drift_packet_trimmed10_mean": 0.34682866242038213, + "direction_drift_total": 0.3625191082802548, + "flow_consistency": 0.9229687898089173, + "jacobian_flow": 0.21763694267515923, + "jacobian_packet": 0.1968076433121019, + "jacobian_total": 0.17712292993630574, + "kappa2_speed2norm_packet_mean": 0.7656468152866243, + "kappa2_speed2norm_packet_median": 0.7130318471337579, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7369891719745223, + "kinetic_energy": 0.8291343949044586, + "kinetic_flow": 0.8693031847133759, + "kinetic_packet": 0.7410464968152866, + "packet_consistency": 0.6216649681528662, + "pna_flow": 0.08438535031847136, + "pna_packet_max": 0.8083585987261147, + "pna_packet_mean": 0.7656468152866243, + "pna_packet_median": 0.7130318471337579, + "pna_packet_trimmed10_mean": 0.7369891719745223, + "terminal_flow": 0.9285515923566879, + "terminal_norm": 0.9387222929936306, + "terminal_packet": 0.9147821656050955, + "velocity_flow": 0.8542834394904459, + "velocity_flow_t01": 0.8046509554140128, + "velocity_flow_t03": 0.8165101910828025, + "velocity_flow_t05": 0.8277165605095542, + "velocity_flow_t07": 0.8476063694267516, + "velocity_flow_t09": 0.8729229299363057, + "velocity_flow_t10": 0.8740700636942675, + "velocity_packet": 0.8133133757961784, + "velocity_packet_t01": 0.8107745222929936, + "velocity_packet_t03": 0.8186394904458599, + "velocity_packet_t05": 0.8204108280254777, + "velocity_packet_t07": 0.8088821656050955, + "velocity_packet_t09": 0.8152815286624204, + "velocity_packet_t10": 0.7871490445859872, + "velocity_total": 0.8592783439490447, + "velocity_total_t01": 0.8063547770700639, + "velocity_total_t03": 0.8156675159235669, + "velocity_total_t05": 0.8325515923566879, + "velocity_total_t07": 0.8563006369426751, + "velocity_total_t09": 0.8696216560509554, + "velocity_total_t10": 0.8695894904458598 + }, + "ddos-syn_flood": { + "_n": 1141.0, + "arc_length": 0.9917510955302367, + "causal_surprisal_flow": 0.5825896581945661, + "causal_surprisal_packet_max": 0.674607712532866, + "causal_surprisal_packet_mean": 0.6993107800175284, + "causal_surprisal_packet_median": 0.703268361086766, + "causal_surprisal_packet_trimmed10_mean": 0.7002310254163014, + "causal_surprisal_total": 0.5973961437335671, + "consistency_total": 0.9878075372480282, + "curvature_flow": 0.22078694127957932, + "curvature_packet": 0.7579021910604734, + "curvature_total": 0.6793879929886066, + "direction_drift_flow": 0.07136021034180542, + "direction_drift_packet_max": 0.021003856266432953, + "direction_drift_packet_mean": 0.00950061349693251, + "direction_drift_packet_median": 0.011729886064855394, + "direction_drift_packet_trimmed10_mean": 0.011572480280455733, + "direction_drift_total": 0.0044050832602979765, + "flow_consistency": 0.9806466257668711, + "jacobian_flow": 0.04716879929886064, + "jacobian_packet": 0.605579666958808, + "jacobian_total": 0.1731826468010517, + "kappa2_speed2norm_packet_mean": 0.09450385626643296, + "kappa2_speed2norm_packet_median": 0.09075337423312883, + "kappa2_speed2norm_packet_trimmed10_mean": 0.07265731814198072, + "kinetic_energy": 0.9918196319018406, + "kinetic_flow": 0.9380399649430324, + "kinetic_packet": 0.9961539000876423, + "packet_consistency": 0.996325503943909, + "pna_flow": 0.028630324276950052, + "pna_packet_max": 0.21104031551270813, + "pna_packet_mean": 0.09450385626643296, + "pna_packet_median": 0.09075337423312883, + "pna_packet_trimmed10_mean": 0.07265731814198072, + "terminal_flow": 0.9888732690622262, + "terminal_norm": 0.9971256792287467, + "terminal_packet": 0.9950285714285714, + "velocity_flow": 0.9320340052585452, + "velocity_flow_t01": 0.923701314636284, + "velocity_flow_t03": 0.9257498685363716, + "velocity_flow_t05": 0.9308505696757231, + "velocity_flow_t07": 0.933550744960561, + "velocity_flow_t09": 0.9329062226117442, + "velocity_flow_t10": 0.9309074496056091, + "velocity_packet": 0.9945095530236635, + "velocity_packet_t01": 0.9542420683610867, + "velocity_packet_t03": 0.9802760736196319, + "velocity_packet_t05": 0.9918718667835231, + "velocity_packet_t07": 0.9953991235758107, + "velocity_packet_t09": 0.9945288343558282, + "velocity_packet_t10": 0.9773761612620508, + "velocity_total": 0.9839353198948291, + "velocity_total_t01": 0.9612760736196317, + "velocity_total_t03": 0.9743812445223489, + "velocity_total_t05": 0.9824385626643295, + "velocity_total_t07": 0.9867561787905346, + "velocity_total_t09": 0.9844976336546888, + "velocity_total_t10": 0.974672217353199 + }, + "ddos-synonymousip_flood": { + "_n": 182.0, + "arc_length": 0.9782549450549451, + "causal_surprisal_flow": 0.3260439560439561, + "causal_surprisal_packet_max": 0.03494065934065933, + "causal_surprisal_packet_mean": 0.011337362637362625, + "causal_surprisal_packet_median": 0.010123076923076945, + "causal_surprisal_packet_trimmed10_mean": 0.010664835164835178, + "causal_surprisal_total": 0.011130769230769279, + "consistency_total": 0.9947945054945055, + "curvature_flow": 0.00014835164835164848, + "curvature_packet": 0.9569802197802199, + "curvature_total": 0.943242857142857, + "direction_drift_flow": 0.014508241758241752, + "direction_drift_packet_max": 0.25322527472527473, + "direction_drift_packet_mean": 0.006259340659340663, + "direction_drift_packet_median": 0.00847142857142858, + "direction_drift_packet_trimmed10_mean": 0.0058780219780219765, + "direction_drift_total": 0.008693406593406587, + "flow_consistency": 0.9947846153846154, + "jacobian_flow": 0.003997802197802201, + "jacobian_packet": 0.1799879120879121, + "jacobian_total": 0.08792857142857144, + "kappa2_speed2norm_packet_mean": 0.5843807692307692, + "kappa2_speed2norm_packet_median": 0.4601945054945054, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5188428571428572, + "kinetic_energy": 0.9790703296703297, + "kinetic_flow": 0.8831934065934066, + "kinetic_packet": 0.9974890109890111, + "packet_consistency": 0.9203472527472527, + "pna_flow": 0.0010109890109890106, + "pna_packet_max": 0.9647186813186814, + "pna_packet_mean": 0.5843807692307692, + "pna_packet_median": 0.4601945054945054, + "pna_packet_trimmed10_mean": 0.5188428571428572, + "terminal_flow": 0.9981978021978022, + "terminal_norm": 0.9994560439560438, + "terminal_packet": 0.9976923076923077, + "velocity_flow": 0.8814758241758243, + "velocity_flow_t01": 0.8578725274725275, + "velocity_flow_t03": 0.8571494505494506, + "velocity_flow_t05": 0.8772219780219781, + "velocity_flow_t07": 0.8809802197802198, + "velocity_flow_t09": 0.8854747252747253, + "velocity_flow_t10": 0.895301098901099, + "velocity_packet": 0.9898736263736263, + "velocity_packet_t01": 0.976356043956044, + "velocity_packet_t03": 0.9808043956043956, + "velocity_packet_t05": 0.9906285714285714, + "velocity_packet_t07": 0.9945164835164835, + "velocity_packet_t09": 0.9880538461538463, + "velocity_packet_t10": 0.9148615384615386, + "velocity_total": 0.9344934065934066, + "velocity_total_t01": 0.9101505494505494, + "velocity_total_t03": 0.9247153846153846, + "velocity_total_t05": 0.9375516483516484, + "velocity_total_t07": 0.9409582417582418, + "velocity_total_t09": 0.9322307692307693, + "velocity_total_t10": 0.8390978021978023 + }, + "ddos-tcp_flood": { + "_n": 1224.0, + "arc_length": 0.9969944444444444, + "causal_surprisal_flow": 0.5681179738562092, + "causal_surprisal_packet_max": 0.666771568627451, + "causal_surprisal_packet_mean": 0.69586977124183, + "causal_surprisal_packet_median": 0.6974333333333332, + "causal_surprisal_packet_trimmed10_mean": 0.6967955882352941, + "causal_surprisal_total": 0.5715746732026143, + "consistency_total": 0.9711905228758171, + "curvature_flow": 0.3457520424836601, + "curvature_packet": 0.8918739379084967, + "curvature_total": 0.8563675653594772, + "direction_drift_flow": 0.033330473856209145, + "direction_drift_packet_max": 0.10284673202614379, + "direction_drift_packet_mean": 0.05506486928104576, + "direction_drift_packet_median": 0.05990490196078432, + "direction_drift_packet_trimmed10_mean": 0.07222679738562092, + "direction_drift_total": 0.02976045751633987, + "flow_consistency": 0.9333039215686274, + "jacobian_flow": 0.054014215686274514, + "jacobian_packet": 0.7138039215686275, + "jacobian_total": 0.266568954248366, + "kappa2_speed2norm_packet_mean": 0.21985433006535948, + "kappa2_speed2norm_packet_median": 0.20772116013071895, + "kappa2_speed2norm_packet_trimmed10_mean": 0.22139305555555558, + "kinetic_energy": 0.9971106209150327, + "kinetic_flow": 0.9453387254901962, + "kinetic_packet": 0.997796568627451, + "packet_consistency": 0.943020588235294, + "pna_flow": 0.03450964052287581, + "pna_packet_max": 0.2497264705882353, + "pna_packet_mean": 0.21985433006535948, + "pna_packet_median": 0.20772116013071895, + "pna_packet_trimmed10_mean": 0.22139305555555558, + "terminal_flow": 0.922650980392157, + "terminal_norm": 0.9918908496732025, + "terminal_packet": 0.9935501633986928, + "velocity_flow": 0.9308787581699346, + "velocity_flow_t01": 0.9242566993464053, + "velocity_flow_t03": 0.9288331699346406, + "velocity_flow_t05": 0.9333936274509804, + "velocity_flow_t07": 0.936048202614379, + "velocity_flow_t09": 0.9305011437908497, + "velocity_flow_t10": 0.9246785947712418, + "velocity_packet": 0.9929410130718954, + "velocity_packet_t01": 0.927292156862745, + "velocity_packet_t03": 0.9697352941176471, + "velocity_packet_t05": 0.9888882352941176, + "velocity_packet_t07": 0.9946071895424836, + "velocity_packet_t09": 0.9921269607843137, + "velocity_packet_t10": 0.9796034313725491, + "velocity_total": 0.9831066993464053, + "velocity_total_t01": 0.9621339869281047, + "velocity_total_t03": 0.9741403594771242, + "velocity_total_t05": 0.9819071895424838, + "velocity_total_t07": 0.98579477124183, + "velocity_total_t09": 0.9829024509803922, + "velocity_total_t10": 0.9781539215686275 + }, + "ddos-udp_flood": { + "_n": 10.0, + "arc_length": 0.9503, + "causal_surprisal_flow": 0.7590600000000001, + "causal_surprisal_packet_max": 0.31986, + "causal_surprisal_packet_mean": 0.27724000000000004, + "causal_surprisal_packet_median": 0.29335999999999995, + "causal_surprisal_packet_trimmed10_mean": 0.28432, + "causal_surprisal_total": 0.33378, + "consistency_total": 0.9848, + "curvature_flow": 0.1447, + "curvature_packet": 0.92298, + "curvature_total": 0.90302, + "direction_drift_flow": 0.07382000000000004, + "direction_drift_packet_max": 0.72878, + "direction_drift_packet_mean": 0.6203000000000001, + "direction_drift_packet_median": 0.63336, + "direction_drift_packet_trimmed10_mean": 0.6187799999999999, + "direction_drift_total": 0.6834600000000001, + "flow_consistency": 0.9841599999999999, + "jacobian_flow": 0.23522, + "jacobian_packet": 0.6093, + "jacobian_total": 0.35774, + "kappa2_speed2norm_packet_mean": 0.8417600000000001, + "kappa2_speed2norm_packet_median": 0.8144, + "kappa2_speed2norm_packet_trimmed10_mean": 0.83918, + "kinetic_energy": 0.95712, + "kinetic_flow": 0.9515600000000001, + "kinetic_packet": 0.9876800000000001, + "packet_consistency": 0.66942, + "pna_flow": 0.03191999999999998, + "pna_packet_max": 0.9015, + "pna_packet_mean": 0.8417600000000001, + "pna_packet_median": 0.8144, + "pna_packet_trimmed10_mean": 0.83918, + "terminal_flow": 0.9908399999999999, + "terminal_norm": 0.9959199999999999, + "terminal_packet": 0.99446, + "velocity_flow": 0.9389200000000001, + "velocity_flow_t01": 0.92996, + "velocity_flow_t03": 0.9304600000000001, + "velocity_flow_t05": 0.9329000000000001, + "velocity_flow_t07": 0.93696, + "velocity_flow_t09": 0.94322, + "velocity_flow_t10": 0.9440999999999999, + "velocity_packet": 0.70186, + "velocity_packet_t01": 0.94472, + "velocity_packet_t03": 0.94452, + "velocity_packet_t05": 0.89246, + "velocity_packet_t07": 0.7117600000000001, + "velocity_packet_t09": 0.66768, + "velocity_packet_t10": 0.40806000000000003, + "velocity_total": 0.77424, + "velocity_total_t01": 0.90124, + "velocity_total_t03": 0.8945199999999999, + "velocity_total_t05": 0.8610399999999999, + "velocity_total_t07": 0.79012, + "velocity_total_t09": 0.74836, + "velocity_total_t10": 0.58212 + }, + "ddos-udp_fragmentation": { + "_n": 26.0, + "arc_length": 0.7998230769230769, + "causal_surprisal_flow": 0.6337769230769231, + "causal_surprisal_packet_max": 0.3294615384615384, + "causal_surprisal_packet_mean": 0.2645769230769231, + "causal_surprisal_packet_median": 0.26700769230769233, + "causal_surprisal_packet_trimmed10_mean": 0.26195384615384615, + "causal_surprisal_total": 0.4443615384615385, + "consistency_total": 0.8213230769230769, + "curvature_flow": 0.28415384615384615, + "curvature_packet": 0.7234846153846154, + "curvature_total": 0.6886461538461538, + "direction_drift_flow": 0.2657769230769231, + "direction_drift_packet_max": 0.5511230769230769, + "direction_drift_packet_mean": 0.43693846153846155, + "direction_drift_packet_median": 0.42719999999999997, + "direction_drift_packet_trimmed10_mean": 0.4449769230769231, + "direction_drift_total": 0.42728461538461543, + "flow_consistency": 0.7698769230769231, + "jacobian_flow": 0.21276153846153847, + "jacobian_packet": 0.6013615384615384, + "jacobian_total": 0.46189230769230766, + "kappa2_speed2norm_packet_mean": 0.6434307692307691, + "kappa2_speed2norm_packet_median": 0.6268153846153847, + "kappa2_speed2norm_packet_trimmed10_mean": 0.656653846153846, + "kinetic_energy": 0.8001461538461538, + "kinetic_flow": 0.7510076923076924, + "kinetic_packet": 0.7455076923076923, + "packet_consistency": 0.6675538461538462, + "pna_flow": 0.18416923076923075, + "pna_packet_max": 0.6499230769230769, + "pna_packet_mean": 0.6434307692307691, + "pna_packet_median": 0.6268153846153847, + "pna_packet_trimmed10_mean": 0.656653846153846, + "terminal_flow": 0.8233692307692307, + "terminal_norm": 0.8389, + "terminal_packet": 0.7511653846153845, + "velocity_flow": 0.7535846153846153, + "velocity_flow_t01": 0.7789615384615385, + "velocity_flow_t03": 0.7715692307692308, + "velocity_flow_t05": 0.7640384615384616, + "velocity_flow_t07": 0.758576923076923, + "velocity_flow_t09": 0.7470384615384615, + "velocity_flow_t10": 0.7367461538461537, + "velocity_packet": 0.7146923076923077, + "velocity_packet_t01": 0.7292, + "velocity_packet_t03": 0.7120923076923078, + "velocity_packet_t05": 0.7023461538461537, + "velocity_packet_t07": 0.6905307692307693, + "velocity_packet_t09": 0.6923, + "velocity_packet_t10": 0.6011461538461538, + "velocity_total": 0.7435692307692308, + "velocity_total_t01": 0.7525384615384615, + "velocity_total_t03": 0.7472, + "velocity_total_t05": 0.7414307692307692, + "velocity_total_t07": 0.737123076923077, + "velocity_total_t09": 0.7243461538461538, + "velocity_total_t10": 0.665676923076923 + }, + "dictionarybruteforce": { + "_n": 19.0, + "arc_length": 0.8219157894736843, + "causal_surprisal_flow": 0.5684210526315789, + "causal_surprisal_packet_max": 0.3634421052631579, + "causal_surprisal_packet_mean": 0.2974421052631579, + "causal_surprisal_packet_median": 0.2835368421052632, + "causal_surprisal_packet_trimmed10_mean": 0.2758, + "causal_surprisal_total": 0.4906631578947368, + "consistency_total": 0.7170736842105264, + "curvature_flow": 0.5252842105263158, + "curvature_packet": 0.655157894736842, + "curvature_total": 0.6479157894736842, + "direction_drift_flow": 0.19924210526315791, + "direction_drift_packet_max": 0.33536842105263154, + "direction_drift_packet_mean": 0.35084210526315784, + "direction_drift_packet_median": 0.37829473684210524, + "direction_drift_packet_trimmed10_mean": 0.3748842105263158, + "direction_drift_total": 0.25354736842105263, + "flow_consistency": 0.7204526315789473, + "jacobian_flow": 0.2434, + "jacobian_packet": 0.4435052631578947, + "jacobian_total": 0.3548210526315789, + "kappa2_speed2norm_packet_mean": 0.5772315789473684, + "kappa2_speed2norm_packet_median": 0.5871999999999999, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5966210526315789, + "kinetic_energy": 0.8202842105263157, + "kinetic_flow": 0.7789578947368421, + "kinetic_packet": 0.5724631578947368, + "packet_consistency": 0.4667368421052631, + "pna_flow": 0.2323157894736842, + "pna_packet_max": 0.5502947368421053, + "pna_packet_mean": 0.5772315789473684, + "pna_packet_median": 0.5871999999999999, + "pna_packet_trimmed10_mean": 0.5966210526315789, + "terminal_flow": 0.8281368421052632, + "terminal_norm": 0.8089578947368421, + "terminal_packet": 0.6198210526315788, + "velocity_flow": 0.7727368421052632, + "velocity_flow_t01": 0.7220842105263158, + "velocity_flow_t03": 0.7373473684210526, + "velocity_flow_t05": 0.7483684210526316, + "velocity_flow_t07": 0.767157894736842, + "velocity_flow_t09": 0.8044421052631578, + "velocity_flow_t10": 0.7791052631578947, + "velocity_packet": 0.6283052631578947, + "velocity_packet_t01": 0.6110210526315789, + "velocity_packet_t03": 0.601178947368421, + "velocity_packet_t05": 0.5961157894736842, + "velocity_packet_t07": 0.5751052631578947, + "velocity_packet_t09": 0.6446947368421052, + "velocity_packet_t10": 0.7100842105263158, + "velocity_total": 0.7699789473684211, + "velocity_total_t01": 0.6905157894736842, + "velocity_total_t03": 0.7031368421052631, + "velocity_total_t05": 0.7216210526315788, + "velocity_total_t07": 0.7459157894736842, + "velocity_total_t09": 0.7994736842105263, + "velocity_total_t10": 0.7729157894736842 + }, + "dns_spoofing": { + "_n": 185.0, + "arc_length": 0.7583913513513514, + "causal_surprisal_flow": 0.5523448648648649, + "causal_surprisal_packet_max": 0.38646594594594597, + "causal_surprisal_packet_mean": 0.33501297297297294, + "causal_surprisal_packet_median": 0.3256616216216216, + "causal_surprisal_packet_trimmed10_mean": 0.32560540540540545, + "causal_surprisal_total": 0.4872994594594595, + "consistency_total": 0.7816756756756755, + "curvature_flow": 0.5477675675675676, + "curvature_packet": 0.6265967567567567, + "curvature_total": 0.6309362162162162, + "direction_drift_flow": 0.2677751351351352, + "direction_drift_packet_max": 0.48367459459459455, + "direction_drift_packet_mean": 0.3536086486486487, + "direction_drift_packet_median": 0.3567264864864865, + "direction_drift_packet_trimmed10_mean": 0.3610254054054054, + "direction_drift_total": 0.3044237837837838, + "flow_consistency": 0.745348108108108, + "jacobian_flow": 0.2588162162162162, + "jacobian_packet": 0.4942054054054054, + "jacobian_total": 0.40130918918918923, + "kappa2_speed2norm_packet_mean": 0.502992972972973, + "kappa2_speed2norm_packet_median": 0.4943367567567568, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5074610810810811, + "kinetic_energy": 0.758041081081081, + "kinetic_flow": 0.7276832432432433, + "kinetic_packet": 0.6852832432432434, + "packet_consistency": 0.690762162162162, + "pna_flow": 0.2835243243243243, + "pna_packet_max": 0.514987027027027, + "pna_packet_mean": 0.502992972972973, + "pna_packet_median": 0.4943367567567568, + "pna_packet_trimmed10_mean": 0.5074610810810811, + "terminal_flow": 0.7487178378378377, + "terminal_norm": 0.7604086486486487, + "terminal_packet": 0.7065621621621622, + "velocity_flow": 0.7269232432432432, + "velocity_flow_t01": 0.6863416216216217, + "velocity_flow_t03": 0.6974702702702703, + "velocity_flow_t05": 0.7110324324324325, + "velocity_flow_t07": 0.7251486486486487, + "velocity_flow_t09": 0.7512097297297298, + "velocity_flow_t10": 0.7303448648648649, + "velocity_packet": 0.6699372972972972, + "velocity_packet_t01": 0.6427632432432432, + "velocity_packet_t03": 0.6414032432432433, + "velocity_packet_t05": 0.6474832432432431, + "velocity_packet_t07": 0.6591135135135135, + "velocity_packet_t09": 0.7007967567567567, + "velocity_packet_t10": 0.6475891891891892, + "velocity_total": 0.7273621621621621, + "velocity_total_t01": 0.6912994594594595, + "velocity_total_t03": 0.7028681081081081, + "velocity_total_t05": 0.7148324324324324, + "velocity_total_t07": 0.7282410810810811, + "velocity_total_t09": 0.7489124324324324, + "velocity_total_t10": 0.721307027027027 + }, + "dos-http_flood": { + "_n": 704.0, + "arc_length": 0.9782076704545455, + "causal_surprisal_flow": 0.23871818181818177, + "causal_surprisal_packet_max": 0.6113727272727272, + "causal_surprisal_packet_mean": 0.5575133522727274, + "causal_surprisal_packet_median": 0.5480031249999999, + "causal_surprisal_packet_trimmed10_mean": 0.5494150568181818, + "causal_surprisal_total": 0.29253948863636364, + "consistency_total": 0.9484988636363636, + "curvature_flow": 0.45470113636363646, + "curvature_packet": 0.8710602272727272, + "curvature_total": 0.8206971590909091, + "direction_drift_flow": 0.13740284090909088, + "direction_drift_packet_max": 0.18488892045454544, + "direction_drift_packet_mean": 0.0901815340909091, + "direction_drift_packet_median": 0.09102244318181818, + "direction_drift_packet_trimmed10_mean": 0.09673352272727273, + "direction_drift_total": 0.05837386363636363, + "flow_consistency": 0.9258943181818181, + "jacobian_flow": 0.22938522727272728, + "jacobian_packet": 0.5885832386363636, + "jacobian_total": 0.4525845170454545, + "kappa2_speed2norm_packet_mean": 0.3669146306818182, + "kappa2_speed2norm_packet_median": 0.35300071022727275, + "kappa2_speed2norm_packet_trimmed10_mean": 0.37164616477272727, + "kinetic_energy": 0.9780997159090911, + "kinetic_flow": 0.8879963068181819, + "kinetic_packet": 0.9698039772727272, + "packet_consistency": 0.9137420454545455, + "pna_flow": 0.08786818181818182, + "pna_packet_max": 0.37721235795454544, + "pna_packet_mean": 0.3669146306818182, + "pna_packet_median": 0.35300071022727275, + "pna_packet_trimmed10_mean": 0.37164616477272727, + "terminal_flow": 0.9779539772727273, + "terminal_norm": 0.9910454545454545, + "terminal_packet": 0.9818136363636363, + "velocity_flow": 0.8596897727272728, + "velocity_flow_t01": 0.6689193181818182, + "velocity_flow_t03": 0.6739927556818182, + "velocity_flow_t05": 0.7492718749999999, + "velocity_flow_t07": 0.8497443181818183, + "velocity_flow_t09": 0.886277840909091, + "velocity_flow_t10": 0.8947525568181819, + "velocity_packet": 0.9447786931818182, + "velocity_packet_t01": 0.8716116477272728, + "velocity_packet_t03": 0.9080715909090907, + "velocity_packet_t05": 0.9346857954545453, + "velocity_packet_t07": 0.9469842329545455, + "velocity_packet_t09": 0.951838068181818, + "velocity_packet_t10": 0.9144196022727273, + "velocity_total": 0.9376366477272727, + "velocity_total_t01": 0.7732602272727271, + "velocity_total_t03": 0.8368619318181818, + "velocity_total_t05": 0.8798426136363636, + "velocity_total_t07": 0.9313360795454546, + "velocity_total_t09": 0.9631542613636364, + "velocity_total_t10": 0.9625840909090909 + }, + "dos-syn_flood": { + "_n": 874.0, + "arc_length": 0.9844914187643019, + "causal_surprisal_flow": 0.6943702517162472, + "causal_surprisal_packet_max": 0.682708924485126, + "causal_surprisal_packet_mean": 0.6920130434782608, + "causal_surprisal_packet_median": 0.7158805491990848, + "causal_surprisal_packet_trimmed10_mean": 0.6988439359267735, + "causal_surprisal_total": 0.7600578947368422, + "consistency_total": 0.9849938215102974, + "curvature_flow": 0.21459427917620139, + "curvature_packet": 0.598970938215103, + "curvature_total": 0.5285620137299771, + "direction_drift_flow": 0.10365915331807782, + "direction_drift_packet_max": 0.08291395881006866, + "direction_drift_packet_mean": 0.009782151029748287, + "direction_drift_packet_median": 0.016737528604118996, + "direction_drift_packet_trimmed10_mean": 0.010834096109839812, + "direction_drift_total": 0.006287643020594962, + "flow_consistency": 0.9823016018306636, + "jacobian_flow": 0.13411578947368422, + "jacobian_packet": 0.35572425629290616, + "jacobian_total": 0.1819883295194508, + "kappa2_speed2norm_packet_mean": 0.14791830663615563, + "kappa2_speed2norm_packet_median": 0.09724771167048056, + "kappa2_speed2norm_packet_trimmed10_mean": 0.09485606407322655, + "kinetic_energy": 0.9846359267734555, + "kinetic_flow": 0.914250114416476, + "kinetic_packet": 0.9949649885583522, + "packet_consistency": 0.9805029748283755, + "pna_flow": 0.043918306636155605, + "pna_packet_max": 0.3509924485125858, + "pna_packet_mean": 0.14791830663615563, + "pna_packet_median": 0.09724771167048056, + "pna_packet_trimmed10_mean": 0.09485606407322655, + "terminal_flow": 0.9905924485125859, + "terminal_norm": 0.9982652173913042, + "terminal_packet": 0.9971565217391305, + "velocity_flow": 0.9055462242562928, + "velocity_flow_t01": 0.894296338672769, + "velocity_flow_t03": 0.8935826086956521, + "velocity_flow_t05": 0.8954361556064073, + "velocity_flow_t07": 0.903937528604119, + "velocity_flow_t09": 0.9079814645308925, + "velocity_flow_t10": 0.9106574370709382, + "velocity_packet": 0.9804725400457666, + "velocity_packet_t01": 0.8967096109839816, + "velocity_packet_t03": 0.9266597254004576, + "velocity_packet_t05": 0.9620993135011442, + "velocity_packet_t07": 0.9840782608695653, + "velocity_packet_t09": 0.9835356979405034, + "velocity_packet_t10": 0.9619608695652174, + "velocity_total": 0.9599549199084669, + "velocity_total_t01": 0.9236826086956522, + "velocity_total_t03": 0.940362700228833, + "velocity_total_t05": 0.9504574370709383, + "velocity_total_t07": 0.962266819221968, + "velocity_total_t09": 0.9654558352402747, + "velocity_total_t10": 0.9609679633867275 + }, + "dos-tcp_flood": { + "_n": 1076.0, + "arc_length": 0.9906100371747212, + "causal_surprisal_flow": 0.6539866171003719, + "causal_surprisal_packet_max": 0.5761371747211895, + "causal_surprisal_packet_mean": 0.5492195167286246, + "causal_surprisal_packet_median": 0.5420044609665428, + "causal_surprisal_packet_trimmed10_mean": 0.5388004646840149, + "causal_surprisal_total": 0.7443477695167287, + "consistency_total": 0.9651416356877324, + "curvature_flow": 0.5096900557620818, + "curvature_packet": 0.7603539033457251, + "curvature_total": 0.7301065055762082, + "direction_drift_flow": 0.08831793680297398, + "direction_drift_packet_max": 0.07902118959107807, + "direction_drift_packet_mean": 0.06747472118959108, + "direction_drift_packet_median": 0.07660148698884758, + "direction_drift_packet_trimmed10_mean": 0.07705185873605949, + "direction_drift_total": 0.03281133828996282, + "flow_consistency": 0.9510695167286246, + "jacobian_flow": 0.11024832713754647, + "jacobian_packet": 0.5783193308550185, + "jacobian_total": 0.2880949814126394, + "kappa2_speed2norm_packet_mean": 0.1953313197026022, + "kappa2_speed2norm_packet_median": 0.180278531598513, + "kappa2_speed2norm_packet_trimmed10_mean": 0.17618475836431224, + "kinetic_energy": 0.990932713754647, + "kinetic_flow": 0.9123754646840149, + "kinetic_packet": 0.988642750929368, + "packet_consistency": 0.7561578996282527, + "pna_flow": 0.07820669144981413, + "pna_packet_max": 0.2911746282527881, + "pna_packet_mean": 0.1953313197026022, + "pna_packet_median": 0.180278531598513, + "pna_packet_trimmed10_mean": 0.17618475836431224, + "terminal_flow": 0.9729832713754647, + "terminal_norm": 0.9968302973977695, + "terminal_packet": 0.997210594795539, + "velocity_flow": 0.9032551115241636, + "velocity_flow_t01": 0.8910009293680297, + "velocity_flow_t03": 0.8940150557620817, + "velocity_flow_t05": 0.9001721189591078, + "velocity_flow_t07": 0.9045336431226767, + "velocity_flow_t09": 0.9055065985130113, + "velocity_flow_t10": 0.9015563197026022, + "velocity_packet": 0.9570384758364312, + "velocity_packet_t01": 0.8132111524163569, + "velocity_packet_t03": 0.85254312267658, + "velocity_packet_t05": 0.9086172862453532, + "velocity_packet_t07": 0.9511310408921934, + "velocity_packet_t09": 0.9608689591078067, + "velocity_packet_t10": 0.9678046468401488, + "velocity_total": 0.9632999999999999, + "velocity_total_t01": 0.9378962825278812, + "velocity_total_t03": 0.9463920074349443, + "velocity_total_t05": 0.9520420074349443, + "velocity_total_t07": 0.9594988847583644, + "velocity_total_t09": 0.9649048327137547, + "velocity_total_t10": 0.9692979553903347 + }, + "dos-udp_flood": { + "_n": 201.0, + "arc_length": 0.9884666666666666, + "causal_surprisal_flow": 0.6474248756218905, + "causal_surprisal_packet_max": 0.14234228855721393, + "causal_surprisal_packet_mean": 0.055396019900497515, + "causal_surprisal_packet_median": 0.04974129353233829, + "causal_surprisal_packet_trimmed10_mean": 0.05270149253731343, + "causal_surprisal_total": 0.13493034825870648, + "consistency_total": 0.9924388059701492, + "curvature_flow": 0.31973084577114425, + "curvature_packet": 0.8632398009950248, + "curvature_total": 0.8520905472636816, + "direction_drift_flow": 0.06664676616915421, + "direction_drift_packet_max": 0.6604278606965175, + "direction_drift_packet_mean": 0.004584079601990059, + "direction_drift_packet_median": 0.005157213930348269, + "direction_drift_packet_trimmed10_mean": 0.0038646766169154138, + "direction_drift_total": 0.005599004975124366, + "flow_consistency": 0.9930417910447761, + "jacobian_flow": 0.04805074626865671, + "jacobian_packet": 0.2706641791044776, + "jacobian_total": 0.12024179104477613, + "kappa2_speed2norm_packet_mean": 0.11627562189054728, + "kappa2_speed2norm_packet_median": 0.06812935323383083, + "kappa2_speed2norm_packet_trimmed10_mean": 0.0849492537313433, + "kinetic_energy": 0.9888179104477612, + "kinetic_flow": 0.9699054726368159, + "kinetic_packet": 0.996710447761194, + "packet_consistency": 0.7677194029850747, + "pna_flow": 0.01831343283582089, + "pna_packet_max": 0.5913144278606965, + "pna_packet_mean": 0.11627562189054728, + "pna_packet_median": 0.06812935323383083, + "pna_packet_trimmed10_mean": 0.0849492537313433, + "terminal_flow": 0.9906696517412935, + "terminal_norm": 0.9648507462686566, + "terminal_packet": 0.9584746268656718, + "velocity_flow": 0.963934328358209, + "velocity_flow_t01": 0.9487472636815921, + "velocity_flow_t03": 0.9488218905472636, + "velocity_flow_t05": 0.952068656716418, + "velocity_flow_t07": 0.9629024875621891, + "velocity_flow_t09": 0.9701203980099503, + "velocity_flow_t10": 0.9723522388059702, + "velocity_packet": 0.9981751243781094, + "velocity_packet_t01": 0.995123383084577, + "velocity_packet_t03": 0.9954716417910447, + "velocity_packet_t05": 0.9960268656716418, + "velocity_packet_t07": 0.9966616915422886, + "velocity_packet_t09": 0.9974736318407961, + "velocity_packet_t10": 0.9912875621890548, + "velocity_total": 0.9696686567164179, + "velocity_total_t01": 0.96403184079602, + "velocity_total_t03": 0.9676606965174128, + "velocity_total_t05": 0.9713402985074628, + "velocity_total_t07": 0.9784467661691542, + "velocity_total_t09": 0.9714417910447761, + "velocity_total_t10": 0.9461741293532339 + }, + "mirai-greeth_flood": { + "_n": 16.0, + "arc_length": 0.6009875, + "causal_surprisal_flow": 0.53415, + "causal_surprisal_packet_max": 0.4801625, + "causal_surprisal_packet_mean": 0.48096249999999996, + "causal_surprisal_packet_median": 0.48466250000000005, + "causal_surprisal_packet_trimmed10_mean": 0.48673750000000005, + "causal_surprisal_total": 0.5350499999999999, + "consistency_total": 0.6857375, + "curvature_flow": 0.43079999999999996, + "curvature_packet": 0.5536875, + "curvature_total": 0.5364875, + "direction_drift_flow": 0.44555, + "direction_drift_packet_max": 0.4766, + "direction_drift_packet_mean": 0.521925, + "direction_drift_packet_median": 0.5363749999999999, + "direction_drift_packet_trimmed10_mean": 0.5314875000000001, + "direction_drift_total": 0.502725, + "flow_consistency": 0.6280125, + "jacobian_flow": 0.318625, + "jacobian_packet": 0.47608750000000005, + "jacobian_total": 0.4702125, + "kappa2_speed2norm_packet_mean": 0.4721625, + "kappa2_speed2norm_packet_median": 0.48783750000000003, + "kappa2_speed2norm_packet_trimmed10_mean": 0.49196249999999997, + "kinetic_energy": 0.6017125000000001, + "kinetic_flow": 0.5709625, + "kinetic_packet": 0.5614874999999999, + "packet_consistency": 0.5560750000000001, + "pna_flow": 0.36719999999999997, + "pna_packet_max": 0.44373749999999995, + "pna_packet_mean": 0.4721625, + "pna_packet_median": 0.48783750000000003, + "pna_packet_trimmed10_mean": 0.49196249999999997, + "terminal_flow": 0.6061624999999999, + "terminal_norm": 0.62805, + "terminal_packet": 0.587675, + "velocity_flow": 0.5590875000000001, + "velocity_flow_t01": 0.5774874999999999, + "velocity_flow_t03": 0.5655249999999999, + "velocity_flow_t05": 0.5676, + "velocity_flow_t07": 0.5696125000000001, + "velocity_flow_t09": 0.575575, + "velocity_flow_t10": 0.5756, + "velocity_packet": 0.5193375, + "velocity_packet_t01": 0.5430875000000001, + "velocity_packet_t03": 0.5374, + "velocity_packet_t05": 0.5250250000000001, + "velocity_packet_t07": 0.522425, + "velocity_packet_t09": 0.5642375, + "velocity_packet_t10": 0.5451, + "velocity_total": 0.56145, + "velocity_total_t01": 0.56335, + "velocity_total_t03": 0.5700625, + "velocity_total_t05": 0.572225, + "velocity_total_t07": 0.5776125, + "velocity_total_t09": 0.586725, + "velocity_total_t10": 0.5549125 + }, + "mirai-greip_flood": { + "_n": 25.0, + "arc_length": 0.893992, + "causal_surprisal_flow": 0.574488, + "causal_surprisal_packet_max": 0.41097600000000006, + "causal_surprisal_packet_mean": 0.35912800000000006, + "causal_surprisal_packet_median": 0.3294, + "causal_surprisal_packet_trimmed10_mean": 0.35886399999999996, + "causal_surprisal_total": 0.507648, + "consistency_total": 0.9175679999999999, + "curvature_flow": 0.424336, + "curvature_packet": 0.716344, + "curvature_total": 0.6863120000000001, + "direction_drift_flow": 0.13532000000000002, + "direction_drift_packet_max": 0.36195200000000005, + "direction_drift_packet_mean": 0.26888, + "direction_drift_packet_median": 0.25617599999999996, + "direction_drift_packet_trimmed10_mean": 0.286424, + "direction_drift_total": 0.15624, + "flow_consistency": 0.8889279999999999, + "jacobian_flow": 0.190688, + "jacobian_packet": 0.4536239999999999, + "jacobian_total": 0.29604, + "kappa2_speed2norm_packet_mean": 0.5087360000000001, + "kappa2_speed2norm_packet_median": 0.503656, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5216240000000001, + "kinetic_energy": 0.892872, + "kinetic_flow": 0.8162240000000001, + "kinetic_packet": 0.81552, + "packet_consistency": 0.57172, + "pna_flow": 0.12856800000000002, + "pna_packet_max": 0.540904, + "pna_packet_mean": 0.5087360000000001, + "pna_packet_median": 0.503656, + "pna_packet_trimmed10_mean": 0.5216240000000001, + "terminal_flow": 0.9121759999999999, + "terminal_norm": 0.9512959999999999, + "terminal_packet": 0.860672, + "velocity_flow": 0.83672, + "velocity_flow_t01": 0.758744, + "velocity_flow_t03": 0.780592, + "velocity_flow_t05": 0.802624, + "velocity_flow_t07": 0.826368, + "velocity_flow_t09": 0.84532, + "velocity_flow_t10": 0.8457760000000001, + "velocity_packet": 0.7918080000000001, + "velocity_packet_t01": 0.713688, + "velocity_packet_t03": 0.722976, + "velocity_packet_t05": 0.738152, + "velocity_packet_t07": 0.75216, + "velocity_packet_t09": 0.7844639999999999, + "velocity_packet_t10": 0.791008, + "velocity_total": 0.8668, + "velocity_total_t01": 0.776824, + "velocity_total_t03": 0.801288, + "velocity_total_t05": 0.8241839999999999, + "velocity_total_t07": 0.857256, + "velocity_total_t09": 0.878112, + "velocity_total_t10": 0.8739840000000001 + }, + "mirai-udpplain": { + "_n": 8.0, + "arc_length": 0.8875500000000001, + "causal_surprisal_flow": 0.582825, + "causal_surprisal_packet_max": 0.5057500000000001, + "causal_surprisal_packet_mean": 0.44725, + "causal_surprisal_packet_median": 0.451975, + "causal_surprisal_packet_trimmed10_mean": 0.44675, + "causal_surprisal_total": 0.5549999999999999, + "consistency_total": 0.679975, + "curvature_flow": 0.433725, + "curvature_packet": 0.7192999999999999, + "curvature_total": 0.7246000000000001, + "direction_drift_flow": 0.21045, + "direction_drift_packet_max": 0.63285, + "direction_drift_packet_mean": 0.537675, + "direction_drift_packet_median": 0.556125, + "direction_drift_packet_trimmed10_mean": 0.539125, + "direction_drift_total": 0.433875, + "flow_consistency": 0.701525, + "jacobian_flow": 0.22924999999999998, + "jacobian_packet": 0.5247375, + "jacobian_total": 0.34262499999999996, + "kappa2_speed2norm_packet_mean": 0.660225, + "kappa2_speed2norm_packet_median": 0.62115, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6492, + "kinetic_energy": 0.8874, + "kinetic_flow": 0.865625, + "kinetic_packet": 0.659225, + "packet_consistency": 0.589, + "pna_flow": 0.19335000000000002, + "pna_packet_max": 0.637775, + "pna_packet_mean": 0.660225, + "pna_packet_median": 0.62115, + "pna_packet_trimmed10_mean": 0.6492, + "terminal_flow": 0.90205, + "terminal_norm": 0.896425, + "terminal_packet": 0.7086749999999999, + "velocity_flow": 0.795625, + "velocity_flow_t01": 0.71365, + "velocity_flow_t03": 0.72455, + "velocity_flow_t05": 0.75235, + "velocity_flow_t07": 0.79295, + "velocity_flow_t09": 0.81915, + "velocity_flow_t10": 0.8001, + "velocity_packet": 0.706875, + "velocity_packet_t01": 0.747675, + "velocity_packet_t03": 0.7314499999999999, + "velocity_packet_t05": 0.703025, + "velocity_packet_t07": 0.682275, + "velocity_packet_t09": 0.700325, + "velocity_packet_t10": 0.749775, + "velocity_total": 0.809975, + "velocity_total_t01": 0.7522500000000001, + "velocity_total_t03": 0.7642249999999999, + "velocity_total_t05": 0.7733749999999999, + "velocity_total_t07": 0.7884250000000002, + "velocity_total_t09": 0.822425, + "velocity_total_t10": 0.839875 + }, + "mitm-arpspoofing": { + "_n": 137.0, + "arc_length": 0.795456204379562, + "causal_surprisal_flow": 0.47503211678832113, + "causal_surprisal_packet_max": 0.3131007299270073, + "causal_surprisal_packet_mean": 0.26928905109489054, + "causal_surprisal_packet_median": 0.25012846715328463, + "causal_surprisal_packet_trimmed10_mean": 0.2498934306569343, + "causal_surprisal_total": 0.4065474452554745, + "consistency_total": 0.7976598540145986, + "curvature_flow": 0.5029036496350365, + "curvature_packet": 0.5871284671532846, + "curvature_total": 0.5825335766423357, + "direction_drift_flow": 0.18013284671532848, + "direction_drift_packet_max": 0.3683299270072993, + "direction_drift_packet_mean": 0.35069197080291975, + "direction_drift_packet_median": 0.3609846715328467, + "direction_drift_packet_trimmed10_mean": 0.37234379562043796, + "direction_drift_total": 0.22079854014598543, + "flow_consistency": 0.8107124087591241, + "jacobian_flow": 0.2994715328467153, + "jacobian_packet": 0.4805985401459854, + "jacobian_total": 0.429741605839416, + "kappa2_speed2norm_packet_mean": 0.47052992700729923, + "kappa2_speed2norm_packet_median": 0.4739124087591241, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4812189781021898, + "kinetic_energy": 0.7938569343065695, + "kinetic_flow": 0.7517182481751825, + "kinetic_packet": 0.6653503649635036, + "packet_consistency": 0.5279299270072992, + "pna_flow": 0.23155182481751824, + "pna_packet_max": 0.4585562043795621, + "pna_packet_mean": 0.47052992700729923, + "pna_packet_median": 0.4739124087591241, + "pna_packet_trimmed10_mean": 0.4812189781021898, + "terminal_flow": 0.8308846715328467, + "terminal_norm": 0.8257737226277371, + "terminal_packet": 0.6816109489051095, + "velocity_flow": 0.766163503649635, + "velocity_flow_t01": 0.665443795620438, + "velocity_flow_t03": 0.6861854014598541, + "velocity_flow_t05": 0.7148467153284671, + "velocity_flow_t07": 0.7577226277372263, + "velocity_flow_t09": 0.8116204379562043, + "velocity_flow_t10": 0.787043795620438, + "velocity_packet": 0.6298598540145985, + "velocity_packet_t01": 0.5741430656934307, + "velocity_packet_t03": 0.5834540145985401, + "velocity_packet_t05": 0.5932131386861313, + "velocity_packet_t07": 0.5983897810218979, + "velocity_packet_t09": 0.6230335766423357, + "velocity_packet_t10": 0.6493416058394161, + "velocity_total": 0.7794686131386861, + "velocity_total_t01": 0.6652890510948906, + "velocity_total_t03": 0.6826408759124087, + "velocity_total_t05": 0.7125430656934306, + "velocity_total_t07": 0.765348905109489, + "velocity_total_t09": 0.8205693430656934, + "velocity_total_t10": 0.7931664233576642 + }, + "recon-hostdiscovery": { + "_n": 163.0, + "arc_length": 0.7935858895705521, + "causal_surprisal_flow": 0.35941349693251534, + "causal_surprisal_packet_max": 0.53640245398773, + "causal_surprisal_packet_mean": 0.5495852760736195, + "causal_surprisal_packet_median": 0.5615558282208589, + "causal_surprisal_packet_trimmed10_mean": 0.5559889570552147, + "causal_surprisal_total": 0.43610674846625763, + "consistency_total": 0.792841717791411, + "curvature_flow": 0.32633865030674847, + "curvature_packet": 0.5593067484662577, + "curvature_total": 0.4790085889570552, + "direction_drift_flow": 0.2910134969325153, + "direction_drift_packet_max": 0.262421472392638, + "direction_drift_packet_mean": 0.2814552147239263, + "direction_drift_packet_median": 0.2873067484662577, + "direction_drift_packet_trimmed10_mean": 0.2935018404907975, + "direction_drift_total": 0.23875460122699388, + "flow_consistency": 0.7838159509202454, + "jacobian_flow": 0.32443619631901843, + "jacobian_packet": 0.6770411042944785, + "jacobian_total": 0.5792196319018406, + "kappa2_speed2norm_packet_mean": 0.33560245398773003, + "kappa2_speed2norm_packet_median": 0.3424760736196319, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3508834355828221, + "kinetic_energy": 0.7937840490797545, + "kinetic_flow": 0.6861079754601227, + "kinetic_packet": 0.7852601226993865, + "packet_consistency": 0.730778527607362, + "pna_flow": 0.24079141104294477, + "pna_packet_max": 0.3106957055214724, + "pna_packet_mean": 0.33560245398773003, + "pna_packet_median": 0.3424760736196319, + "pna_packet_trimmed10_mean": 0.3508834355828221, + "terminal_flow": 0.7756159509202454, + "terminal_norm": 0.8098490797546014, + "terminal_packet": 0.7946049079754602, + "velocity_flow": 0.6921619631901842, + "velocity_flow_t01": 0.5430527607361962, + "velocity_flow_t03": 0.5651546012269939, + "velocity_flow_t05": 0.6347325153374233, + "velocity_flow_t07": 0.6901914110429448, + "velocity_flow_t09": 0.7232674846625767, + "velocity_flow_t10": 0.7033398773006134, + "velocity_packet": 0.7337509202453988, + "velocity_packet_t01": 0.6625386503067484, + "velocity_packet_t03": 0.6799472392638037, + "velocity_packet_t05": 0.7026576687116564, + "velocity_packet_t07": 0.7230993865030675, + "velocity_packet_t09": 0.7413386503067485, + "velocity_packet_t10": 0.6870944785276073, + "velocity_total": 0.7510036809815951, + "velocity_total_t01": 0.6337423312883435, + "velocity_total_t03": 0.6673509202453987, + "velocity_total_t05": 0.7039668711656442, + "velocity_total_t07": 0.7414184049079755, + "velocity_total_t09": 0.7757288343558282, + "velocity_total_t10": 0.7600552147239266 + }, + "recon-osscan": { + "_n": 352.0, + "arc_length": 0.9096284090909091, + "causal_surprisal_flow": 0.34918977272727275, + "causal_surprisal_packet_max": 0.5786306818181819, + "causal_surprisal_packet_mean": 0.589890909090909, + "causal_surprisal_packet_median": 0.5969755681818182, + "causal_surprisal_packet_trimmed10_mean": 0.5914380681818181, + "causal_surprisal_total": 0.3984261363636364, + "consistency_total": 0.9055124999999998, + "curvature_flow": 0.2593943181818182, + "curvature_packet": 0.5941732954545454, + "curvature_total": 0.4810732954545455, + "direction_drift_flow": 0.19207897727272727, + "direction_drift_packet_max": 0.1826943181818182, + "direction_drift_packet_mean": 0.1683653409090909, + "direction_drift_packet_median": 0.17677329545454545, + "direction_drift_packet_trimmed10_mean": 0.1743806818181818, + "direction_drift_total": 0.13379204545454548, + "flow_consistency": 0.9108005681818183, + "jacobian_flow": 0.3451539772727273, + "jacobian_packet": 0.6667829545454546, + "jacobian_total": 0.5653448863636363, + "kappa2_speed2norm_packet_mean": 0.28322329545454544, + "kappa2_speed2norm_packet_median": 0.27815681818181814, + "kappa2_speed2norm_packet_trimmed10_mean": 0.28695340909090916, + "kinetic_energy": 0.9096034090909091, + "kinetic_flow": 0.8273636363636364, + "kinetic_packet": 0.8757221590909092, + "packet_consistency": 0.8240857954545454, + "pna_flow": 0.12268295454545455, + "pna_packet_max": 0.30062897727272725, + "pna_packet_mean": 0.28322329545454544, + "pna_packet_median": 0.27815681818181814, + "pna_packet_trimmed10_mean": 0.28695340909090916, + "terminal_flow": 0.9201409090909092, + "terminal_norm": 0.9295940340909091, + "terminal_packet": 0.9084423295454546, + "velocity_flow": 0.7926892045454548, + "velocity_flow_t01": 0.5913176136363637, + "velocity_flow_t03": 0.6137448863636363, + "velocity_flow_t05": 0.7099431818181817, + "velocity_flow_t07": 0.781453409090909, + "velocity_flow_t09": 0.82625625, + "velocity_flow_t10": 0.8237392045454545, + "velocity_packet": 0.8583829545454545, + "velocity_packet_t01": 0.7577068181818182, + "velocity_packet_t03": 0.7823068181818182, + "velocity_packet_t05": 0.8132903409090909, + "velocity_packet_t07": 0.8367301136363636, + "velocity_packet_t09": 0.8526221590909091, + "velocity_packet_t10": 0.8388772727272729, + "velocity_total": 0.8709568181818181, + "velocity_total_t01": 0.7101426136363636, + "velocity_total_t03": 0.7549750000000001, + "velocity_total_t05": 0.8018994318181818, + "velocity_total_t07": 0.8544409090909091, + "velocity_total_t09": 0.8951414772727273, + "velocity_total_t10": 0.89609375 + }, + "recon-pingsweep": { + "_n": 4.0, + "arc_length": 0.9522499999999999, + "causal_surprisal_flow": 0.54655, + "causal_surprisal_packet_max": 0.62925, + "causal_surprisal_packet_mean": 0.6504, + "causal_surprisal_packet_median": 0.68315, + "causal_surprisal_packet_trimmed10_mean": 0.65315, + "causal_surprisal_total": 0.5185, + "consistency_total": 0.8872, + "curvature_flow": 0.27140000000000003, + "curvature_packet": 0.58025, + "curvature_total": 0.5046499999999999, + "direction_drift_flow": 0.15914999999999999, + "direction_drift_packet_max": 0.43374999999999997, + "direction_drift_packet_mean": 0.34809999999999997, + "direction_drift_packet_median": 0.3444, + "direction_drift_packet_trimmed10_mean": 0.3111, + "direction_drift_total": 0.36605, + "flow_consistency": 0.8724000000000001, + "jacobian_flow": 0.43500000000000005, + "jacobian_packet": 0.311, + "jacobian_total": 0.39575, + "kappa2_speed2norm_packet_mean": 0.46854999999999997, + "kappa2_speed2norm_packet_median": 0.4937, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4527, + "kinetic_energy": 0.9522999999999999, + "kinetic_flow": 0.86345, + "kinetic_packet": 0.9642000000000001, + "packet_consistency": 0.7043, + "pna_flow": 0.06740000000000002, + "pna_packet_max": 0.47375, + "pna_packet_mean": 0.46854999999999997, + "pna_packet_median": 0.4937, + "pna_packet_trimmed10_mean": 0.4527, + "terminal_flow": 0.9312, + "terminal_norm": 0.9864499999999999, + "terminal_packet": 0.98285, + "velocity_flow": 0.8276, + "velocity_flow_t01": 0.66515, + "velocity_flow_t03": 0.6829, + "velocity_flow_t05": 0.6896000000000001, + "velocity_flow_t07": 0.7466999999999999, + "velocity_flow_t09": 0.8442, + "velocity_flow_t10": 0.87, + "velocity_packet": 0.84115, + "velocity_packet_t01": 0.60275, + "velocity_packet_t03": 0.62965, + "velocity_packet_t05": 0.6459, + "velocity_packet_t07": 0.6599499999999999, + "velocity_packet_t09": 0.86745, + "velocity_packet_t10": 0.919, + "velocity_total": 0.86795, + "velocity_total_t01": 0.65005, + "velocity_total_t03": 0.67265, + "velocity_total_t05": 0.6841, + "velocity_total_t07": 0.7597499999999999, + "velocity_total_t09": 0.89715, + "velocity_total_t10": 0.9255500000000001 + }, + "recon-portscan": { + "_n": 385.0, + "arc_length": 0.9233542857142856, + "causal_surprisal_flow": 0.26589194805194805, + "causal_surprisal_packet_max": 0.6067015584415585, + "causal_surprisal_packet_mean": 0.6223662337662337, + "causal_surprisal_packet_median": 0.6267475324675325, + "causal_surprisal_packet_trimmed10_mean": 0.623867012987013, + "causal_surprisal_total": 0.32650649350649347, + "consistency_total": 0.9159314285714285, + "curvature_flow": 0.23262987012987013, + "curvature_packet": 0.6284285714285714, + "curvature_total": 0.4924685714285715, + "direction_drift_flow": 0.17920571428571427, + "direction_drift_packet_max": 0.135347012987013, + "direction_drift_packet_mean": 0.12966077922077923, + "direction_drift_packet_median": 0.13528103896103896, + "direction_drift_packet_trimmed10_mean": 0.1377496103896104, + "direction_drift_total": 0.09501714285714286, + "flow_consistency": 0.918531948051948, + "jacobian_flow": 0.31235792207792207, + "jacobian_packet": 0.6729766233766235, + "jacobian_total": 0.5682090909090909, + "kappa2_speed2norm_packet_mean": 0.26136, + "kappa2_speed2norm_packet_median": 0.2655218181818182, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2682322077922078, + "kinetic_energy": 0.9231272727272728, + "kinetic_flow": 0.8370244155844156, + "kinetic_packet": 0.8965537662337663, + "packet_consistency": 0.8327085714285715, + "pna_flow": 0.09888259740259739, + "pna_packet_max": 0.2764285714285714, + "pna_packet_mean": 0.26136, + "pna_packet_median": 0.2655218181818182, + "pna_packet_trimmed10_mean": 0.2682322077922078, + "terminal_flow": 0.9318888311688311, + "terminal_norm": 0.938775064935065, + "terminal_packet": 0.9210503896103895, + "velocity_flow": 0.8078633766233766, + "velocity_flow_t01": 0.5945038961038961, + "velocity_flow_t03": 0.6121693506493505, + "velocity_flow_t05": 0.7156098701298702, + "velocity_flow_t07": 0.7962670129870131, + "velocity_flow_t09": 0.8343054545454546, + "velocity_flow_t10": 0.8373355844155844, + "velocity_packet": 0.8791153246753246, + "velocity_packet_t01": 0.7783329870129869, + "velocity_packet_t03": 0.8043298701298701, + "velocity_packet_t05": 0.8413901298701298, + "velocity_packet_t07": 0.8715101298701298, + "velocity_packet_t09": 0.874508051948052, + "velocity_packet_t10": 0.8623023376623377, + "velocity_total": 0.8931376623376623, + "velocity_total_t01": 0.7208212987012985, + "velocity_total_t03": 0.7758976623376623, + "velocity_total_t05": 0.8275522077922078, + "velocity_total_t07": 0.8788675324675324, + "velocity_total_t09": 0.9111823376623376, + "velocity_total_t10": 0.9192275324675323 + }, + "sqlinjection": { + "_n": 11.0, + "arc_length": 0.7281454545454547, + "causal_surprisal_flow": 0.6932909090909091, + "causal_surprisal_packet_max": 0.6083272727272727, + "causal_surprisal_packet_mean": 0.4806181818181818, + "causal_surprisal_packet_median": 0.5078181818181818, + "causal_surprisal_packet_trimmed10_mean": 0.4776909090909091, + "causal_surprisal_total": 0.5802, + "consistency_total": 0.7244727272727273, + "curvature_flow": 0.5305454545454545, + "curvature_packet": 0.6911818181818182, + "curvature_total": 0.6696363636363636, + "direction_drift_flow": 0.23034545454545455, + "direction_drift_packet_max": 0.627890909090909, + "direction_drift_packet_mean": 0.4346727272727273, + "direction_drift_packet_median": 0.4002909090909091, + "direction_drift_packet_trimmed10_mean": 0.40596363636363636, + "direction_drift_total": 0.4576363636363636, + "flow_consistency": 0.6984, + "jacobian_flow": 0.3801818181818182, + "jacobian_packet": 0.2585818181818182, + "jacobian_total": 0.2636545454545455, + "kappa2_speed2norm_packet_mean": 0.6332727272727273, + "kappa2_speed2norm_packet_median": 0.6039454545454546, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6280727272727272, + "kinetic_energy": 0.7294181818181817, + "kinetic_flow": 0.7275090909090909, + "kinetic_packet": 0.740909090909091, + "packet_consistency": 0.6308727272727273, + "pna_flow": 0.26892727272727274, + "pna_packet_max": 0.6636545454545455, + "pna_packet_mean": 0.6332727272727273, + "pna_packet_median": 0.6039454545454546, + "pna_packet_trimmed10_mean": 0.6280727272727272, + "terminal_flow": 0.7702909090909091, + "terminal_norm": 0.8238727272727273, + "terminal_packet": 0.8167272727272726, + "velocity_flow": 0.7265454545454545, + "velocity_flow_t01": 0.7057454545454546, + "velocity_flow_t03": 0.7074545454545454, + "velocity_flow_t05": 0.710709090909091, + "velocity_flow_t07": 0.7225090909090909, + "velocity_flow_t09": 0.7332181818181818, + "velocity_flow_t10": 0.6823272727272728, + "velocity_packet": 0.7343454545454545, + "velocity_packet_t01": 0.7080545454545455, + "velocity_packet_t03": 0.7166545454545455, + "velocity_packet_t05": 0.7135545454545454, + "velocity_packet_t07": 0.6824363636363636, + "velocity_packet_t09": 0.6667818181818181, + "velocity_packet_t10": 0.7042727272727273, + "velocity_total": 0.733418181818182, + "velocity_total_t01": 0.7079454545454545, + "velocity_total_t03": 0.7121999999999999, + "velocity_total_t05": 0.7093272727272727, + "velocity_total_t07": 0.7124, + "velocity_total_t09": 0.7055454545454546, + "velocity_total_t10": 0.695090909090909 + }, + "uploading_attack": { + "_n": 2.0, + "arc_length": 0.8434, + "causal_surprisal_flow": 0.7282, + "causal_surprisal_packet_max": 0.359, + "causal_surprisal_packet_mean": 0.3345, + "causal_surprisal_packet_median": 0.09960000000000002, + "causal_surprisal_packet_trimmed10_mean": 0.126, + "causal_surprisal_total": 0.42410000000000003, + "consistency_total": 0.40359999999999996, + "curvature_flow": 0.2585, + "curvature_packet": 0.9045, + "curvature_total": 0.8407, + "direction_drift_flow": 0.04239999999999999, + "direction_drift_packet_max": 0.38180000000000003, + "direction_drift_packet_mean": 0.19370000000000004, + "direction_drift_packet_median": 0.1951, + "direction_drift_packet_trimmed10_mean": 0.24129999999999996, + "direction_drift_total": 0.1744, + "flow_consistency": 0.31679999999999997, + "jacobian_flow": 0.05449999999999999, + "jacobian_packet": 0.4282, + "jacobian_total": 0.12619999999999998, + "kappa2_speed2norm_packet_mean": 0.7246, + "kappa2_speed2norm_packet_median": 0.698, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7718999999999999, + "kinetic_energy": 0.8334999999999999, + "kinetic_flow": 0.9429000000000001, + "kinetic_packet": 0.7595000000000001, + "packet_consistency": 0.6587, + "pna_flow": 0.028100000000000014, + "pna_packet_max": 0.78, + "pna_packet_mean": 0.7246, + "pna_packet_median": 0.698, + "pna_packet_trimmed10_mean": 0.7718999999999999, + "terminal_flow": 0.7714, + "terminal_norm": 0.7294999999999999, + "terminal_packet": 0.6396, + "velocity_flow": 0.9422999999999999, + "velocity_flow_t01": 0.9466, + "velocity_flow_t03": 0.9473, + "velocity_flow_t05": 0.9449000000000001, + "velocity_flow_t07": 0.9423999999999999, + "velocity_flow_t09": 0.9416000000000001, + "velocity_flow_t10": 0.9400000000000001, + "velocity_packet": 0.9173, + "velocity_packet_t01": 0.9198000000000001, + "velocity_packet_t03": 0.9273, + "velocity_packet_t05": 0.9174, + "velocity_packet_t07": 0.8609, + "velocity_packet_t09": 0.9446, + "velocity_packet_t10": 0.8802000000000001, + "velocity_total": 0.9287, + "velocity_total_t01": 0.9094, + "velocity_total_t03": 0.9075, + "velocity_total_t05": 0.9206, + "velocity_total_t07": 0.9197000000000001, + "velocity_total_t09": 0.9335, + "velocity_total_t10": 0.9412 + }, + "vulnerabilityscan": { + "_n": 567.0, + "arc_length": 0.7611086419753086, + "causal_surprisal_flow": 0.38527619047619044, + "causal_surprisal_packet_max": 0.5412797178130512, + "causal_surprisal_packet_mean": 0.5370761904761905, + "causal_surprisal_packet_median": 0.5458865961199294, + "causal_surprisal_packet_trimmed10_mean": 0.5355329805996474, + "causal_surprisal_total": 0.4197333333333333, + "consistency_total": 0.7639393298059964, + "curvature_flow": 0.35760811287477956, + "curvature_packet": 0.5762906525573193, + "curvature_total": 0.5100451499118165, + "direction_drift_flow": 0.27625097001763665, + "direction_drift_packet_max": 0.34598465608465606, + "direction_drift_packet_mean": 0.3378409171075838, + "direction_drift_packet_median": 0.33668077601410934, + "direction_drift_packet_trimmed10_mean": 0.3375142857142857, + "direction_drift_total": 0.30356225749559085, + "flow_consistency": 0.7699051146384479, + "jacobian_flow": 0.40381410934744266, + "jacobian_packet": 0.5318243386243386, + "jacobian_total": 0.4784162257495591, + "kappa2_speed2norm_packet_mean": 0.4302380952380952, + "kappa2_speed2norm_packet_median": 0.4235089947089947, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4294557319223985, + "kinetic_energy": 0.7612014109347442, + "kinetic_flow": 0.7118747795414462, + "kinetic_packet": 0.7195047619047619, + "packet_consistency": 0.657021164021164, + "pna_flow": 0.25391851851851854, + "pna_packet_max": 0.4238063492063492, + "pna_packet_mean": 0.4302380952380952, + "pna_packet_median": 0.4235089947089947, + "pna_packet_trimmed10_mean": 0.4294557319223985, + "terminal_flow": 0.7689502645502646, + "terminal_norm": 0.7914578483245149, + "terminal_packet": 0.76585291005291, + "velocity_flow": 0.6915199294532627, + "velocity_flow_t01": 0.5649414462081128, + "velocity_flow_t03": 0.5770306878306878, + "velocity_flow_t05": 0.6204758377425044, + "velocity_flow_t07": 0.676183774250441, + "velocity_flow_t09": 0.719163139329806, + "velocity_flow_t10": 0.7157961199294531, + "velocity_packet": 0.7010416225749558, + "velocity_packet_t01": 0.6293022927689595, + "velocity_packet_t03": 0.6451291005291006, + "velocity_packet_t05": 0.6665227513227513, + "velocity_packet_t07": 0.6788130511463845, + "velocity_packet_t09": 0.6844984126984126, + "velocity_packet_t10": 0.6841128747795415, + "velocity_total": 0.7304638447971781, + "velocity_total_t01": 0.6131728395061729, + "velocity_total_t03": 0.6448924162257496, + "velocity_total_t05": 0.6743419753086421, + "velocity_total_t07": 0.7083372134038802, + "velocity_total_t09": 0.7448931216931217, + "velocity_total_t10": 0.7442680776014109 + }, + "xss": { + "_n": 12.0, + "arc_length": 0.7983166666666666, + "causal_surprisal_flow": 0.49585, + "causal_surprisal_packet_max": 0.2905166666666667, + "causal_surprisal_packet_mean": 0.23283333333333334, + "causal_surprisal_packet_median": 0.22308333333333336, + "causal_surprisal_packet_trimmed10_mean": 0.20344999999999996, + "causal_surprisal_total": 0.38063333333333327, + "consistency_total": 0.7859499999999999, + "curvature_flow": 0.4238666666666666, + "curvature_packet": 0.6496500000000001, + "curvature_total": 0.6540333333333334, + "direction_drift_flow": 0.16679166666666667, + "direction_drift_packet_max": 0.47396666666666665, + "direction_drift_packet_mean": 0.40881666666666666, + "direction_drift_packet_median": 0.41485000000000005, + "direction_drift_packet_trimmed10_mean": 0.4048166666666667, + "direction_drift_total": 0.31178333333333336, + "flow_consistency": 0.7949166666666667, + "jacobian_flow": 0.28231666666666666, + "jacobian_packet": 0.4949, + "jacobian_total": 0.3637666666666667, + "kappa2_speed2norm_packet_mean": 0.46601666666666663, + "kappa2_speed2norm_packet_median": 0.44401666666666667, + "kappa2_speed2norm_packet_trimmed10_mean": 0.47276666666666667, + "kinetic_energy": 0.796, + "kinetic_flow": 0.7660833333333333, + "kinetic_packet": 0.6858833333333334, + "packet_consistency": 0.5750166666666667, + "pna_flow": 0.22599999999999998, + "pna_packet_max": 0.5381666666666667, + "pna_packet_mean": 0.46601666666666663, + "pna_packet_median": 0.44401666666666667, + "pna_packet_trimmed10_mean": 0.47276666666666667, + "terminal_flow": 0.7991666666666666, + "terminal_norm": 0.8046333333333333, + "terminal_packet": 0.6755, + "velocity_flow": 0.7739, + "velocity_flow_t01": 0.7247166666666667, + "velocity_flow_t03": 0.7244833333333334, + "velocity_flow_t05": 0.7298, + "velocity_flow_t07": 0.7685666666666667, + "velocity_flow_t09": 0.8167500000000001, + "velocity_flow_t10": 0.7995, + "velocity_packet": 0.6991666666666667, + "velocity_packet_t01": 0.69095, + "velocity_packet_t03": 0.6751166666666666, + "velocity_packet_t05": 0.6519, + "velocity_packet_t07": 0.6308333333333334, + "velocity_packet_t09": 0.6850666666666667, + "velocity_packet_t10": 0.7468333333333333, + "velocity_total": 0.7741166666666667, + "velocity_total_t01": 0.7170166666666667, + "velocity_total_t03": 0.7101833333333334, + "velocity_total_t05": 0.71175, + "velocity_total_t07": 0.7474833333333333, + "velocity_total_t09": 0.8159666666666666, + "velocity_total_t10": 0.8140499999999999 + } + }, + "classes": [ + "backdoor_malware", + "browserhijacking", + "commandinjection", + "ddos-ack_fragmentation", + "ddos-http_flood", + "ddos-icmp_flood", + "ddos-icmp_fragmentation", + "ddos-pshack_flood", + "ddos-rstfinflood", + "ddos-slowloris", + "ddos-syn_flood", + "ddos-synonymousip_flood", + "ddos-tcp_flood", + "ddos-udp_flood", + "ddos-udp_fragmentation", + "dictionarybruteforce", + "dns_spoofing", + "dos-http_flood", + "dos-syn_flood", + "dos-tcp_flood", + "dos-udp_flood", + "mirai-greeth_flood", + "mirai-greip_flood", + "mirai-udpplain", + "mitm-arpspoofing", + "recon-hostdiscovery", + "recon-osscan", + "recon-pingsweep", + "recon-portscan", + "sqlinjection", + "uploading_attack", + "vulnerabilityscan", + "xss" + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/config.yaml b/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/config.yaml new file mode 100644 index 0000000..802a583 --- /dev/null +++ b/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/config.yaml @@ -0,0 +1,38 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 44 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_flow: 0.3 +lambda_packet: 0.3 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packet_mask_ratio: 0.5 +packet_preprocess: mixed_dequant +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed44 +seed: 44 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/history.json b/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/history.json new file mode 100644 index 0000000..0e3207e --- /dev/null +++ b/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/history.json @@ -0,0 +1,243 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 2.375049291512905, + 1.9489314189324012, + 1.6760596923339062, + 1.504449541752155, + 1.3761945871206431, + 1.2736949553856483, + 1.2215654177543445, + 1.1492674763386066, + 1.1219276159237592, + 1.0878859101197658, + 1.0889926843154125, + 1.0707854246481872, + 1.034467611557398, + 1.0338049240601368, + 1.0246107807526221, + 1.0058713815151117, + 1.0185796511478913, + 0.9841543940397409, + 0.9716082077759963, + 0.9683993168366261, + 0.9673636800203568, + 0.9619743365507859, + 0.9594233754353646, + 0.9625819218464386, + 0.9356345809423007, + 0.9334020064427302, + 0.9384908966529064, + 0.9380930402340033, + 0.9328552790177174, + 0.9210913807917864, + 0.9249321803068503, + 0.9135568692133977, + 0.9095215934973496, + 0.9062970754427787, + 0.9017524566405859, + 0.9110065148426936, + 0.9032528048906571, + 0.9050933657548367, + 0.9041350300495441, + 0.8996510826624357, + 0.8968601394922305, + 0.8950647360239273, + 0.8981135670955365, + 0.8957514319664392, + 0.9015492644065466, + 0.9002510844132839, + 0.8902667623299819, + 0.8877373184913244, + 0.892833873247489, + 0.8973987026092334 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9194169575, + "auroc_curvature_flow": 0.166416695, + "auroc_curvature_packet": 0.36164496749999997, + "auroc_curvature_total": 0.268135765, + "auroc_kappa2_speed2norm_packet_mean": 0.1492408, + "auroc_kappa2_speed2norm_packet_median": 0.15209779750000002, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.14248039499999998, + "auroc_kinetic_energy": 0.9168255725000001, + "auroc_kinetic_flow": 0.812661755, + "auroc_kinetic_packet": 0.8453452600000002, + "auroc_terminal_flow": 0.9251651025000001, + "auroc_terminal_norm": 0.947440695, + "auroc_terminal_packet": 0.9415417650000001, + "auroc_velocity_flow": 0.8429024875000001, + "auroc_velocity_packet": 0.8941211549999999, + "auroc_velocity_total": 0.9134732600000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9246398124999999, + "auroc_curvature_flow": 0.22171449499999996, + "auroc_curvature_packet": 0.649676975, + "auroc_curvature_total": 0.5197889925000001, + "auroc_kappa2_speed2norm_packet_mean": 0.344650185, + "auroc_kappa2_speed2norm_packet_median": 0.3375882025, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.3363174025, + "auroc_kinetic_energy": 0.9229483049999999, + "auroc_kinetic_flow": 0.86706961, + "auroc_kinetic_packet": 0.8944427599999999, + "auroc_terminal_flow": 0.9300443325000001, + "auroc_terminal_norm": 0.9543728800000001, + "auroc_terminal_packet": 0.9380904925, + "auroc_velocity_flow": 0.8605055700000002, + "auroc_velocity_packet": 0.8992951425, + "auroc_velocity_total": 0.9133841025 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9304722925000002, + "auroc_curvature_flow": 0.32105131249999996, + "auroc_curvature_packet": 0.8673615100000001, + "auroc_curvature_total": 0.8070453124999999, + "auroc_kappa2_speed2norm_packet_mean": 0.5948310299999999, + "auroc_kappa2_speed2norm_packet_median": 0.579870725, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.58692911, + "auroc_kinetic_energy": 0.93039026, + "auroc_kinetic_flow": 0.8694094425, + "auroc_kinetic_packet": 0.9111260274999999, + "auroc_terminal_flow": 0.936989525, + "auroc_terminal_norm": 0.9601692999999999, + "auroc_terminal_packet": 0.95159365, + "auroc_velocity_flow": 0.8660867025, + "auroc_velocity_packet": 0.9171313025000001, + "auroc_velocity_total": 0.9196071775000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9380573325000001, + "auroc_curvature_flow": 0.47755249499999997, + "auroc_curvature_packet": 0.8786714375, + "auroc_curvature_total": 0.8329957825000001, + "auroc_kappa2_speed2norm_packet_mean": 0.484593885, + "auroc_kappa2_speed2norm_packet_median": 0.4603784675, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.46956351500000004, + "auroc_kinetic_energy": 0.93788139, + "auroc_kinetic_flow": 0.8771772950000001, + "auroc_kinetic_packet": 0.9283155425, + "auroc_terminal_flow": 0.9332928575000001, + "auroc_terminal_norm": 0.96137366, + "auroc_terminal_packet": 0.9536772475, + "auroc_velocity_flow": 0.873581445, + "auroc_velocity_packet": 0.92144, + "auroc_velocity_total": 0.92278831 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9412332050000001, + "auroc_curvature_flow": 0.5689601975, + "auroc_curvature_packet": 0.9025206525, + "auroc_curvature_total": 0.87587233, + "auroc_kappa2_speed2norm_packet_mean": 0.5605753925, + "auroc_kappa2_speed2norm_packet_median": 0.54022797, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.5470836425, + "auroc_kinetic_energy": 0.9412793675, + "auroc_kinetic_flow": 0.8804320525, + "auroc_kinetic_packet": 0.9340590900000001, + "auroc_terminal_flow": 0.9397983675, + "auroc_terminal_norm": 0.9636626874999998, + "auroc_terminal_packet": 0.955491715, + "auroc_velocity_flow": 0.8717023724999999, + "auroc_velocity_packet": 0.9242410725, + "auroc_velocity_total": 0.9218633075000001 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/model.pt b/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/model.pt new file mode 100644 index 0000000..94c65ad Binary files /dev/null and b/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/model.pt differ diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/phase1.log b/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/phase1.log new file mode 100644 index 0000000..1438944 --- /dev/null +++ b/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/phase1.log @@ -0,0 +1,132 @@ +[config] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/config.yaml +[model] T=64 flow_dim=20 packet_dim=9 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets_source=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] using external flow features D=20 +[data] rows total=8,193,621 keep len>=2: 3,797,530 +[data] benign=97,045 attack=20,000 -> train=77,636 val=10,000 +[data] train=77,636 val=10,000 attack=20,000 +[eval] scoring val=5,000 and attack=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done in 12.2s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] attack done in 23.3s +[eval] score keys: 57 first 5: ['arc_length', 'causal_surprisal_flow', 'causal_surprisal_packet_max', 'causal_surprisal_packet_mean', 'causal_surprisal_packet_median'] +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/phase1_summary.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/phase1_scores.npz + +=== overall AUROC (sorted desc) === + terminal_norm AUROC=0.9635 AUPRC=0.9838 + terminal_packet AUROC=0.9565 AUPRC=0.9807 + kinetic_energy AUROC=0.9429 AUPRC=0.9667 + arc_length AUROC=0.9428 AUPRC=0.9665 + terminal_flow AUROC=0.9399 AUPRC=0.9658 + kinetic_packet AUROC=0.9373 AUPRC=0.9733 + velocity_total_t09 AUROC=0.9317 AUPRC=0.9461 + velocity_packet_t09 AUROC=0.9262 AUPRC=0.9647 + velocity_total_t10 AUROC=0.9247 AUPRC=0.9377 + velocity_packet AUROC=0.9232 AUPRC=0.9571 + velocity_total AUROC=0.9208 AUPRC=0.9358 + consistency_total AUROC=0.9206 AUPRC=0.9533 + velocity_packet_t07 AUROC=0.9201 AUPRC=0.9594 + velocity_total_t07 AUROC=0.9181 AUPRC=0.9380 + velocity_packet_t10 AUROC=0.9093 AUPRC=0.9563 + flow_consistency AUROC=0.9052 AUPRC=0.9440 + velocity_packet_t05 AUROC=0.9044 AUPRC=0.9380 + velocity_total_t05 AUROC=0.9019 AUPRC=0.9234 + velocity_total_t03 AUROC=0.8883 AUPRC=0.9123 + curvature_packet AUROC=0.8871 AUPRC=0.9400 + velocity_packet_t03 AUROC=0.8828 AUPRC=0.9137 + velocity_total_t01 AUROC=0.8800 AUPRC=0.9055 + kinetic_flow AUROC=0.8786 AUPRC=0.8838 + velocity_flow_t09 AUROC=0.8741 AUPRC=0.8751 + velocity_flow_t10 AUROC=0.8708 AUPRC=0.8713 + velocity_flow AUROC=0.8707 AUPRC=0.8751 + velocity_flow_t07 AUROC=0.8689 AUPRC=0.8766 + velocity_flow_t05 AUROC=0.8605 AUPRC=0.8735 + velocity_packet_t01 AUROC=0.8574 AUPRC=0.8919 + curvature_total AUROC=0.8358 AUPRC=0.8914 + velocity_flow_t03 AUROC=0.8348 AUPRC=0.8614 + packet_consistency AUROC=0.8346 AUPRC=0.9222 + velocity_flow_t01 AUROC=0.8174 AUPRC=0.8522 + causal_surprisal_packet_median AUROC=0.6147 AUPRC=0.6963 + jacobian_packet AUROC=0.6141 AUPRC=0.7942 + causal_surprisal_packet_trimmed10_mean AUROC=0.6094 AUPRC=0.6895 + causal_surprisal_packet_mean AUROC=0.6083 AUPRC=0.6823 + causal_surprisal_total AUROC=0.5982 AUPRC=0.7322 + causal_surprisal_packet_max AUROC=0.5929 AUPRC=0.6571 + causal_surprisal_flow AUROC=0.5793 AUPRC=0.6851 + pna_packet_max AUROC=0.5436 AUPRC=0.7423 + kappa2_speed2norm_packet_mean AUROC=0.4341 AUPRC=0.6833 + pna_packet_mean AUROC=0.4341 AUPRC=0.6833 + kappa2_speed2norm_packet_trimmed10_mean AUROC=0.4197 AUPRC=0.6807 + pna_packet_trimmed10_mean AUROC=0.4197 AUPRC=0.6807 + kappa2_speed2norm_packet_median AUROC=0.4149 AUPRC=0.6772 + pna_packet_median AUROC=0.4149 AUPRC=0.6772 + curvature_flow AUROC=0.3914 AUPRC=0.5908 + jacobian_total AUROC=0.3280 AUPRC=0.6093 + direction_drift_packet_max AUROC=0.2477 AUPRC=0.5405 + jacobian_flow AUROC=0.1674 AUPRC=0.4878 + direction_drift_flow AUROC=0.1357 AUPRC=0.4781 + direction_drift_packet_median AUROC=0.1309 AUPRC=0.4859 + direction_drift_packet_trimmed10_mean AUROC=0.1308 AUPRC=0.4861 + direction_drift_packet_mean AUROC=0.1260 AUPRC=0.4842 + direction_drift_total AUROC=0.0967 AUPRC=0.4686 + pna_flow AUROC=0.0869 AUPRC=0.4676 diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/phase1_scores.npz b/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/phase1_scores.npz new file mode 100644 index 0000000..3b09da0 Binary files /dev/null and b/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/phase1_summary.json b/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/phase1_summary.json new file mode 100644 index 0000000..ca04bca --- /dev/null +++ b/artifacts/route_comparison/route_a_causal_ciciot2023_seed44/phase1_summary.json @@ -0,0 +1,2293 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed44", + "config": { + "T": 64, + "attack_cap": 20000, + "batch_size": 256, + "benign_label": "normal", + "d_model": 128, + "data_seed": 44, + "device": "auto", + "epochs": 50, + "eval_batch_size": 512, + "eval_every": 10, + "eval_n": 20000, + "eval_n_steps": 8, + "flow_features_align": "auto", + "flow_features_path": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet", + "flows_parquet": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet", + "grad_clip": 1.0, + "lambda_flow": 0.3, + "lambda_packet": 0.3, + "lr": 0.0003, + "min_len": 2, + "mlp_ratio": 4.0, + "n_heads": 4, + "n_layers": 4, + "n_train": 10000, + "num_workers": 0, + "packet_mask_ratio": 0.5, + "packet_preprocess": "mixed_dequant", + "reference_mode": "causal_packets", + "save_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_a_causal_ciciot2023_seed44", + "seed": 44, + "sigma": 0.1, + "source_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "time_dim": 64, + "token_dim": null, + "train_ratio": 0.8, + "use_ot": true, + "val_cap": 10000, + "weight_decay": 0.01 + }, + "n_val": 5000, + "n_atk": 10000, + "n_score_keys": 57, + "overall": { + "arc_length": { + "auroc": 0.9428350799999999, + "auprc": 0.9665077445424068 + }, + "causal_surprisal_flow": { + "auroc": 0.5793067900000001, + "auprc": 0.6850603801580577 + }, + "causal_surprisal_packet_max": { + "auroc": 0.59291248, + "auprc": 0.6570940999285364 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.60832536, + "auprc": 0.6822716848486308 + }, + "causal_surprisal_packet_median": { + "auroc": 0.6146865800000001, + "auprc": 0.696340914574201 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.60937076, + "auprc": 0.689544239310977 + }, + "causal_surprisal_total": { + "auroc": 0.59816098, + "auprc": 0.7321990898485508 + }, + "consistency_total": { + "auroc": 0.92060828, + "auprc": 0.9532611276160439 + }, + "curvature_flow": { + "auroc": 0.39143529, + "auprc": 0.5908360563112701 + }, + "curvature_packet": { + "auroc": 0.8871439400000001, + "auprc": 0.93995990792895 + }, + "curvature_total": { + "auroc": 0.8357525100000001, + "auprc": 0.8913768296444906 + }, + "direction_drift_flow": { + "auroc": 0.13572156000000002, + "auprc": 0.478050725925092 + }, + "direction_drift_packet_max": { + "auroc": 0.24769434, + "auprc": 0.540458044540163 + }, + "direction_drift_packet_mean": { + "auroc": 0.12599586000000002, + "auprc": 0.4841845085363828 + }, + "direction_drift_packet_median": { + "auroc": 0.13088748, + "auprc": 0.4858931439098879 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.1308055, + "auprc": 0.486085888656429 + }, + "direction_drift_total": { + "auroc": 0.09668170000000001, + "auprc": 0.46862020553314976 + }, + "flow_consistency": { + "auroc": 0.90517053, + "auprc": 0.9440074682109504 + }, + "jacobian_flow": { + "auroc": 0.16740475999999999, + "auprc": 0.4877587969547703 + }, + "jacobian_packet": { + "auroc": 0.61407621, + "auprc": 0.7942490965957978 + }, + "jacobian_total": { + "auroc": 0.32804090999999996, + "auprc": 0.6093455902193656 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.43409809, + "auprc": 0.6833332813733113 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.4149231299999999, + "auprc": 0.6771719958737599 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.41968985, + "auprc": 0.6806873613168378 + }, + "kinetic_energy": { + "auroc": 0.94287668, + "auprc": 0.9666925183711246 + }, + "kinetic_flow": { + "auroc": 0.87858886, + "auprc": 0.883784996366558 + }, + "kinetic_packet": { + "auroc": 0.9373457199999999, + "auprc": 0.9732609975832849 + }, + "packet_consistency": { + "auroc": 0.8345634500000001, + "auprc": 0.92217633914647 + }, + "pna_flow": { + "auroc": 0.08691219, + "auprc": 0.46760568010536085 + }, + "pna_packet_max": { + "auroc": 0.54359025, + "auprc": 0.7423334455051696 + }, + "pna_packet_mean": { + "auroc": 0.43409809, + "auprc": 0.6833332813733113 + }, + "pna_packet_median": { + "auroc": 0.4149231299999999, + "auprc": 0.6771719958737599 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.41968985, + "auprc": 0.6806873613168378 + }, + "terminal_flow": { + "auroc": 0.93988762, + "auprc": 0.9657736154104686 + }, + "terminal_norm": { + "auroc": 0.9634961, + "auprc": 0.9837647238179839 + }, + "terminal_packet": { + "auroc": 0.95647782, + "auprc": 0.9807068412514096 + }, + "velocity_flow": { + "auroc": 0.87073781, + "auprc": 0.875126030315333 + }, + "velocity_flow_t01": { + "auroc": 0.81736304, + "auprc": 0.8522219316550577 + }, + "velocity_flow_t03": { + "auroc": 0.83482583, + "auprc": 0.8613741250008162 + }, + "velocity_flow_t05": { + "auroc": 0.8604900800000002, + "auprc": 0.8734978995558254 + }, + "velocity_flow_t07": { + "auroc": 0.86890404, + "auprc": 0.8766275103610062 + }, + "velocity_flow_t09": { + "auroc": 0.87408602, + "auprc": 0.8751391633113811 + }, + "velocity_flow_t10": { + "auroc": 0.87080583, + "auprc": 0.8713046391439407 + }, + "velocity_packet": { + "auroc": 0.92316332, + "auprc": 0.957141816762805 + }, + "velocity_packet_t01": { + "auroc": 0.85740466, + "auprc": 0.8918711895368313 + }, + "velocity_packet_t03": { + "auroc": 0.88279218, + "auprc": 0.9137041563104218 + }, + "velocity_packet_t05": { + "auroc": 0.90440358, + "auprc": 0.9380191698181599 + }, + "velocity_packet_t07": { + "auroc": 0.9201011299999999, + "auprc": 0.9594295289676362 + }, + "velocity_packet_t09": { + "auroc": 0.9262457500000001, + "auprc": 0.9647485789736565 + }, + "velocity_packet_t10": { + "auroc": 0.9092716599999999, + "auprc": 0.9563328880457502 + }, + "velocity_total": { + "auroc": 0.9208302799999998, + "auprc": 0.9358090467277522 + }, + "velocity_total_t01": { + "auroc": 0.88001522, + "auprc": 0.9054727206760456 + }, + "velocity_total_t03": { + "auroc": 0.88829952, + "auprc": 0.9123444978482707 + }, + "velocity_total_t05": { + "auroc": 0.9018892099999999, + "auprc": 0.9233571820912926 + }, + "velocity_total_t07": { + "auroc": 0.91813073, + "auprc": 0.9380201351744246 + }, + "velocity_total_t09": { + "auroc": 0.93169754, + "auprc": 0.946077027019677 + }, + "velocity_total_t10": { + "auroc": 0.9246999099999998, + "auprc": 0.9377095073176414 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 7.0, + "arc_length": 0.9027428571428571, + "causal_surprisal_flow": 0.5614, + "causal_surprisal_packet_max": 0.36588571428571426, + "causal_surprisal_packet_mean": 0.4230285714285715, + "causal_surprisal_packet_median": 0.44079999999999997, + "causal_surprisal_packet_trimmed10_mean": 0.4295428571428571, + "causal_surprisal_total": 0.5879428571428571, + "consistency_total": 0.8981142857142858, + "curvature_flow": 0.4089142857142857, + "curvature_packet": 0.49648571428571425, + "curvature_total": 0.49651428571428574, + "direction_drift_flow": 0.25739999999999996, + "direction_drift_packet_max": 0.22645714285714286, + "direction_drift_packet_mean": 0.15625714285714284, + "direction_drift_packet_median": 0.13622857142857142, + "direction_drift_packet_trimmed10_mean": 0.14091428571428571, + "direction_drift_total": 0.14359999999999998, + "flow_consistency": 0.8723714285714285, + "jacobian_flow": 0.30137142857142857, + "jacobian_packet": 0.4706, + "jacobian_total": 0.42551428571428573, + "kappa2_speed2norm_packet_mean": 0.23494285714285715, + "kappa2_speed2norm_packet_median": 0.26159999999999994, + "kappa2_speed2norm_packet_trimmed10_mean": 0.20651428571428568, + "kinetic_energy": 0.9021428571428572, + "kinetic_flow": 0.7927428571428572, + "kinetic_packet": 0.8936, + "packet_consistency": 0.8360857142857143, + "pna_flow": 0.15362857142857145, + "pna_packet_max": 0.2601428571428571, + "pna_packet_mean": 0.23494285714285715, + "pna_packet_median": 0.26159999999999994, + "pna_packet_trimmed10_mean": 0.20651428571428568, + "terminal_flow": 0.9063999999999999, + "terminal_norm": 0.9333142857142857, + "terminal_packet": 0.9197428571428571, + "velocity_flow": 0.7803714285714285, + "velocity_flow_t01": 0.6302857142857142, + "velocity_flow_t03": 0.6673142857142856, + "velocity_flow_t05": 0.7259428571428571, + "velocity_flow_t07": 0.7516, + "velocity_flow_t09": 0.8144, + "velocity_flow_t10": 0.8107142857142857, + "velocity_packet": 0.7331142857142857, + "velocity_packet_t01": 0.5143428571428571, + "velocity_packet_t03": 0.5414571428571429, + "velocity_packet_t05": 0.5791142857142857, + "velocity_packet_t07": 0.6806857142857143, + "velocity_packet_t09": 0.7707714285714284, + "velocity_packet_t10": 0.8338, + "velocity_total": 0.8345142857142858, + "velocity_total_t01": 0.6363428571428571, + "velocity_total_t03": 0.6994571428571428, + "velocity_total_t05": 0.7438857142857143, + "velocity_total_t07": 0.7958, + "velocity_total_t09": 0.8691142857142857, + "velocity_total_t10": 0.8732857142857142 + }, + "browserhijacking": { + "_n": 9.0, + "arc_length": 0.693288888888889, + "causal_surprisal_flow": 0.7488000000000001, + "causal_surprisal_packet_max": 0.5111111111111111, + "causal_surprisal_packet_mean": 0.4796666666666667, + "causal_surprisal_packet_median": 0.4368222222222222, + "causal_surprisal_packet_trimmed10_mean": 0.4425111111111111, + "causal_surprisal_total": 0.6292, + "consistency_total": 0.6152888888888888, + "curvature_flow": 0.5457333333333333, + "curvature_packet": 0.7084666666666667, + "curvature_total": 0.6769555555555555, + "direction_drift_flow": 0.19184444444444448, + "direction_drift_packet_max": 0.5702444444444444, + "direction_drift_packet_mean": 0.30091111111111113, + "direction_drift_packet_median": 0.2865111111111111, + "direction_drift_packet_trimmed10_mean": 0.3138222222222222, + "direction_drift_total": 0.2026444444444444, + "flow_consistency": 0.5834444444444444, + "jacobian_flow": 0.16384444444444443, + "jacobian_packet": 0.3351777777777778, + "jacobian_total": 0.22713333333333335, + "kappa2_speed2norm_packet_mean": 0.6741111111111111, + "kappa2_speed2norm_packet_median": 0.6701777777777778, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6905555555555556, + "kinetic_energy": 0.6904, + "kinetic_flow": 0.7289111111111111, + "kinetic_packet": 0.6617111111111111, + "packet_consistency": 0.6184888888888889, + "pna_flow": 0.237, + "pna_packet_max": 0.6502222222222223, + "pna_packet_mean": 0.6741111111111111, + "pna_packet_median": 0.6701777777777778, + "pna_packet_trimmed10_mean": 0.6905555555555556, + "terminal_flow": 0.7035555555555555, + "terminal_norm": 0.7249111111111111, + "terminal_packet": 0.7536666666666666, + "velocity_flow": 0.7542, + "velocity_flow_t01": 0.7145333333333332, + "velocity_flow_t03": 0.7270222222222222, + "velocity_flow_t05": 0.7432, + "velocity_flow_t07": 0.7368444444444444, + "velocity_flow_t09": 0.7640666666666667, + "velocity_flow_t10": 0.7889333333333333, + "velocity_packet": 0.6461333333333334, + "velocity_packet_t01": 0.6636, + "velocity_packet_t03": 0.661511111111111, + "velocity_packet_t05": 0.6606444444444445, + "velocity_packet_t07": 0.6625555555555556, + "velocity_packet_t09": 0.6783111111111111, + "velocity_packet_t10": 0.5866444444444444, + "velocity_total": 0.6973999999999999, + "velocity_total_t01": 0.6816444444444445, + "velocity_total_t03": 0.693311111111111, + "velocity_total_t05": 0.6914888888888889, + "velocity_total_t07": 0.6897333333333334, + "velocity_total_t09": 0.738311111111111, + "velocity_total_t10": 0.7179777777777778 + }, + "commandinjection": { + "_n": 11.0, + "arc_length": 0.8707454545454545, + "causal_surprisal_flow": 0.648, + "causal_surprisal_packet_max": 0.4046363636363636, + "causal_surprisal_packet_mean": 0.3737818181818182, + "causal_surprisal_packet_median": 0.28576363636363633, + "causal_surprisal_packet_trimmed10_mean": 0.2885090909090909, + "causal_surprisal_total": 0.5706363636363636, + "consistency_total": 0.6624545454545454, + "curvature_flow": 0.5954363636363637, + "curvature_packet": 0.7769272727272727, + "curvature_total": 0.8112909090909091, + "direction_drift_flow": 0.14843636363636362, + "direction_drift_packet_max": 0.3835454545454546, + "direction_drift_packet_mean": 0.3036, + "direction_drift_packet_median": 0.29910909090909094, + "direction_drift_packet_trimmed10_mean": 0.31298181818181814, + "direction_drift_total": 0.2946363636363637, + "flow_consistency": 0.6616363636363637, + "jacobian_flow": 0.14983636363636363, + "jacobian_packet": 0.30567272727272726, + "jacobian_total": 0.1517090909090909, + "kappa2_speed2norm_packet_mean": 0.6453818181818182, + "kappa2_speed2norm_packet_median": 0.6535272727272727, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6525636363636363, + "kinetic_energy": 0.870090909090909, + "kinetic_flow": 0.8438727272727272, + "kinetic_packet": 0.761490909090909, + "packet_consistency": 0.6111636363636364, + "pna_flow": 0.17596363636363638, + "pna_packet_max": 0.6079636363636364, + "pna_packet_mean": 0.6453818181818182, + "pna_packet_median": 0.6535272727272727, + "pna_packet_trimmed10_mean": 0.6525636363636363, + "terminal_flow": 0.9075454545454547, + "terminal_norm": 0.9460181818181819, + "terminal_packet": 0.9284181818181818, + "velocity_flow": 0.8414909090909091, + "velocity_flow_t01": 0.7819090909090909, + "velocity_flow_t03": 0.7994181818181818, + "velocity_flow_t05": 0.8121636363636364, + "velocity_flow_t07": 0.8345090909090909, + "velocity_flow_t09": 0.8554181818181817, + "velocity_flow_t10": 0.8323636363636364, + "velocity_packet": 0.7591454545454546, + "velocity_packet_t01": 0.7166545454545454, + "velocity_packet_t03": 0.7278181818181817, + "velocity_packet_t05": 0.7406363636363636, + "velocity_packet_t07": 0.7521454545454546, + "velocity_packet_t09": 0.7871090909090909, + "velocity_packet_t10": 0.7373636363636364, + "velocity_total": 0.8424909090909091, + "velocity_total_t01": 0.7744363636363636, + "velocity_total_t03": 0.7812727272727273, + "velocity_total_t05": 0.8015454545454546, + "velocity_total_t07": 0.8384363636363636, + "velocity_total_t09": 0.8622181818181818, + "velocity_total_t10": 0.8287636363636363 + }, + "ddos-ack_fragmentation": { + "_n": 340.0, + "arc_length": 0.9794335294117648, + "causal_surprisal_flow": 0.5055152941176471, + "causal_surprisal_packet_max": 0.039186470588235295, + "causal_surprisal_packet_mean": 0.04551705882352941, + "causal_surprisal_packet_median": 0.04962823529411764, + "causal_surprisal_packet_trimmed10_mean": 0.04835705882352941, + "causal_surprisal_total": 0.5117029411764706, + "consistency_total": 0.9611541176470588, + "curvature_flow": 0.15079441176470587, + "curvature_packet": 0.9447217647058825, + "curvature_total": 0.8481664705882352, + "direction_drift_flow": 0.11282, + "direction_drift_packet_max": 0.11139176470588236, + "direction_drift_packet_mean": 0.04989294117647059, + "direction_drift_packet_median": 0.05708235294117647, + "direction_drift_packet_trimmed10_mean": 0.0576864705882353, + "direction_drift_total": 0.026811176470588248, + "flow_consistency": 0.9527911764705883, + "jacobian_flow": 0.03663411764705882, + "jacobian_packet": 0.9433629411764707, + "jacobian_total": 0.42107647058823533, + "kappa2_speed2norm_packet_mean": 0.3092905882352941, + "kappa2_speed2norm_packet_median": 0.32472999999999996, + "kappa2_speed2norm_packet_trimmed10_mean": 0.33192441176470583, + "kinetic_energy": 0.9793847058823529, + "kinetic_flow": 0.9287488235294116, + "kinetic_packet": 0.9755005882352941, + "packet_consistency": 0.9722911764705883, + "pna_flow": 0.027352941176470583, + "pna_packet_max": 0.23487470588235293, + "pna_packet_mean": 0.3092905882352941, + "pna_packet_median": 0.32472999999999996, + "pna_packet_trimmed10_mean": 0.33192441176470583, + "terminal_flow": 0.9804252941176471, + "terminal_norm": 0.9834735294117647, + "terminal_packet": 0.9826205882352942, + "velocity_flow": 0.9276129411764705, + "velocity_flow_t01": 0.9386194117647059, + "velocity_flow_t03": 0.9392858823529413, + "velocity_flow_t05": 0.9372367647058825, + "velocity_flow_t07": 0.9303764705882352, + "velocity_flow_t09": 0.9176035294117645, + "velocity_flow_t10": 0.91107, + "velocity_packet": 0.976815294117647, + "velocity_packet_t01": 0.9716017647058823, + "velocity_packet_t03": 0.9725494117647059, + "velocity_packet_t05": 0.9752805882352942, + "velocity_packet_t07": 0.9774894117647059, + "velocity_packet_t09": 0.9773576470588234, + "velocity_packet_t10": 0.9697158823529413, + "velocity_total": 0.976075294117647, + "velocity_total_t01": 0.9763635294117647, + "velocity_total_t03": 0.9767023529411764, + "velocity_total_t05": 0.9771682352941177, + "velocity_total_t07": 0.976920588235294, + "velocity_total_t09": 0.9772829411764707, + "velocity_total_t10": 0.9744458823529412 + }, + "ddos-http_flood": { + "_n": 893.0, + "arc_length": 0.9334259798432251, + "causal_surprisal_flow": 0.6273661814109742, + "causal_surprisal_packet_max": 0.6597581187010079, + "causal_surprisal_packet_mean": 0.6739334826427772, + "causal_surprisal_packet_median": 0.6705522956326989, + "causal_surprisal_packet_trimmed10_mean": 0.6696232922732362, + "causal_surprisal_total": 0.6416304591265398, + "consistency_total": 0.9271807390817468, + "curvature_flow": 0.43153796192609184, + "curvature_packet": 0.9589892497200446, + "curvature_total": 0.9384851063829787, + "direction_drift_flow": 0.19026517357222844, + "direction_drift_packet_max": 0.4643390817469205, + "direction_drift_packet_mean": 0.2191511758118701, + "direction_drift_packet_median": 0.23456248600223967, + "direction_drift_packet_trimmed10_mean": 0.2302326987681971, + "direction_drift_total": 0.1710417693169093, + "flow_consistency": 0.8151388577827549, + "jacobian_flow": 0.24120134378499442, + "jacobian_packet": 0.6423161254199328, + "jacobian_total": 0.4641459126539754, + "kappa2_speed2norm_packet_mean": 0.8208994400895855, + "kappa2_speed2norm_packet_median": 0.8146955207166854, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8236210526315789, + "kinetic_energy": 0.9334709966405376, + "kinetic_flow": 0.8468692049272115, + "kinetic_packet": 0.9229350503919371, + "packet_consistency": 0.8544097424412094, + "pna_flow": 0.09267569988801792, + "pna_packet_max": 0.8053012318029116, + "pna_packet_mean": 0.8208994400895855, + "pna_packet_median": 0.8146955207166854, + "pna_packet_trimmed10_mean": 0.8236210526315789, + "terminal_flow": 0.954288241881299, + "terminal_norm": 0.9886255319148936, + "terminal_packet": 0.9828197088465845, + "velocity_flow": 0.8553213885778276, + "velocity_flow_t01": 0.7570183650615901, + "velocity_flow_t03": 0.8294080627099665, + "velocity_flow_t05": 0.8515894736842106, + "velocity_flow_t07": 0.8565397536394178, + "velocity_flow_t09": 0.8517556550951848, + "velocity_flow_t10": 0.8500711086226203, + "velocity_packet": 0.9294810750279956, + "velocity_packet_t01": 0.9176107502799552, + "velocity_packet_t03": 0.9308217245240762, + "velocity_packet_t05": 0.9366673012318029, + "velocity_packet_t07": 0.9318053751399775, + "velocity_packet_t09": 0.9390768197088466, + "velocity_packet_t10": 0.8635921612541992, + "velocity_total": 0.9149181410974244, + "velocity_total_t01": 0.8672898096304591, + "velocity_total_t03": 0.8824020156774917, + "velocity_total_t05": 0.905684882418813, + "velocity_total_t07": 0.9191393057110863, + "velocity_total_t09": 0.9262752519596865, + "velocity_total_t10": 0.9052161254199328 + }, + "ddos-icmp_flood": { + "_n": 20.0, + "arc_length": 0.6616299999999999, + "causal_surprisal_flow": 0.5722700000000001, + "causal_surprisal_packet_max": 0.49799000000000004, + "causal_surprisal_packet_mean": 0.49602999999999997, + "causal_surprisal_packet_median": 0.49237999999999993, + "causal_surprisal_packet_trimmed10_mean": 0.48762, + "causal_surprisal_total": 0.52473, + "consistency_total": 0.6796000000000001, + "curvature_flow": 0.48840000000000006, + "curvature_packet": 0.58836, + "curvature_total": 0.6094900000000001, + "direction_drift_flow": 0.33977, + "direction_drift_packet_max": 0.5598200000000001, + "direction_drift_packet_mean": 0.50192, + "direction_drift_packet_median": 0.44015000000000004, + "direction_drift_packet_trimmed10_mean": 0.49263999999999997, + "direction_drift_total": 0.43916999999999995, + "flow_consistency": 0.6613100000000001, + "jacobian_flow": 0.39255000000000007, + "jacobian_packet": 0.44708, + "jacobian_total": 0.43033999999999994, + "kappa2_speed2norm_packet_mean": 0.6217199999999999, + "kappa2_speed2norm_packet_median": 0.5939, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6109399999999999, + "kinetic_energy": 0.66164, + "kinetic_flow": 0.63319, + "kinetic_packet": 0.60556, + "packet_consistency": 0.57295, + "pna_flow": 0.36594000000000004, + "pna_packet_max": 0.64744, + "pna_packet_mean": 0.6217199999999999, + "pna_packet_median": 0.5939, + "pna_packet_trimmed10_mean": 0.6109399999999999, + "terminal_flow": 0.7246999999999999, + "terminal_norm": 0.7186899999999999, + "terminal_packet": 0.67713, + "velocity_flow": 0.64491, + "velocity_flow_t01": 0.6186499999999999, + "velocity_flow_t03": 0.62029, + "velocity_flow_t05": 0.6404, + "velocity_flow_t07": 0.63894, + "velocity_flow_t09": 0.66286, + "velocity_flow_t10": 0.63318, + "velocity_packet": 0.5874499999999999, + "velocity_packet_t01": 0.58078, + "velocity_packet_t03": 0.57558, + "velocity_packet_t05": 0.57765, + "velocity_packet_t07": 0.58011, + "velocity_packet_t09": 0.5656800000000001, + "velocity_packet_t10": 0.60445, + "velocity_total": 0.63282, + "velocity_total_t01": 0.6064499999999999, + "velocity_total_t03": 0.60363, + "velocity_total_t05": 0.60892, + "velocity_total_t07": 0.61585, + "velocity_total_t09": 0.65141, + "velocity_total_t10": 0.6451300000000001 + }, + "ddos-icmp_fragmentation": { + "_n": 35.0, + "arc_length": 0.8552628571428571, + "causal_surprisal_flow": 0.5497885714285714, + "causal_surprisal_packet_max": 0.3839542857142857, + "causal_surprisal_packet_mean": 0.3776742857142857, + "causal_surprisal_packet_median": 0.39745142857142857, + "causal_surprisal_packet_trimmed10_mean": 0.3858, + "causal_surprisal_total": 0.5437828571428571, + "consistency_total": 0.6634857142857142, + "curvature_flow": 0.4124857142857143, + "curvature_packet": 0.66392, + "curvature_total": 0.6664457142857143, + "direction_drift_flow": 0.2091142857142857, + "direction_drift_packet_max": 0.38108, + "direction_drift_packet_mean": 0.38586857142857145, + "direction_drift_packet_median": 0.36924571428571423, + "direction_drift_packet_trimmed10_mean": 0.39743999999999996, + "direction_drift_total": 0.2903142857142857, + "flow_consistency": 0.7069085714285714, + "jacobian_flow": 0.34205142857142856, + "jacobian_packet": 0.3920571428571428, + "jacobian_total": 0.38140571428571435, + "kappa2_speed2norm_packet_mean": 0.5773028571428571, + "kappa2_speed2norm_packet_median": 0.5707028571428572, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5934457142857142, + "kinetic_energy": 0.8553085714285715, + "kinetic_flow": 0.7786685714285714, + "kinetic_packet": 0.7510685714285715, + "packet_consistency": 0.44006285714285714, + "pna_flow": 0.19498285714285715, + "pna_packet_max": 0.5563828571428573, + "pna_packet_mean": 0.5773028571428571, + "pna_packet_median": 0.5707028571428572, + "pna_packet_trimmed10_mean": 0.5934457142857142, + "terminal_flow": 0.9164457142857142, + "terminal_norm": 0.9438857142857142, + "terminal_packet": 0.8694742857142858, + "velocity_flow": 0.7683314285714286, + "velocity_flow_t01": 0.67092, + "velocity_flow_t03": 0.6870400000000001, + "velocity_flow_t05": 0.7003771428571428, + "velocity_flow_t07": 0.7352171428571428, + "velocity_flow_t09": 0.7906514285714286, + "velocity_flow_t10": 0.7978571428571429, + "velocity_packet": 0.6289257142857143, + "velocity_packet_t01": 0.5965714285714285, + "velocity_packet_t03": 0.5962685714285714, + "velocity_packet_t05": 0.5913885714285714, + "velocity_packet_t07": 0.5953885714285714, + "velocity_packet_t09": 0.6330457142857142, + "velocity_packet_t10": 0.6605257142857143, + "velocity_total": 0.7680457142857142, + "velocity_total_t01": 0.6774857142857144, + "velocity_total_t03": 0.6775371428571428, + "velocity_total_t05": 0.6865942857142857, + "velocity_total_t07": 0.7325771428571428, + "velocity_total_t09": 0.7944171428571428, + "velocity_total_t10": 0.79124 + }, + "ddos-pshack_flood": { + "_n": 1065.0, + "arc_length": 0.9864593427230046, + "causal_surprisal_flow": 0.5734169014084507, + "causal_surprisal_packet_max": 0.6588475117370892, + "causal_surprisal_packet_mean": 0.6863669483568076, + "causal_surprisal_packet_median": 0.6872584037558684, + "causal_surprisal_packet_trimmed10_mean": 0.6862146478873239, + "causal_surprisal_total": 0.6001430985915492, + "consistency_total": 0.975453145539906, + "curvature_flow": 0.54833558685446, + "curvature_packet": 0.9733658215962441, + "curvature_total": 0.9378384976525821, + "direction_drift_flow": 0.04154159624413146, + "direction_drift_packet_max": 0.08323906103286385, + "direction_drift_packet_mean": 0.0247586854460094, + "direction_drift_packet_median": 0.025989295774647887, + "direction_drift_packet_trimmed10_mean": 0.024986291079812213, + "direction_drift_total": 0.019059342723004698, + "flow_consistency": 0.9667139906103287, + "jacobian_flow": 0.05260826291079812, + "jacobian_packet": 0.3492953990610329, + "jacobian_total": 0.07361953051643193, + "kappa2_speed2norm_packet_mean": 0.34997145539906105, + "kappa2_speed2norm_packet_median": 0.4167779342723005, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3394644131455399, + "kinetic_energy": 0.9864589671361501, + "kinetic_flow": 0.9449784037558686, + "kinetic_packet": 0.9939357746478872, + "packet_consistency": 0.9848469483568074, + "pna_flow": 0.04969333333333333, + "pna_packet_max": 0.3493597183098591, + "pna_packet_mean": 0.34997145539906105, + "pna_packet_median": 0.4167779342723005, + "pna_packet_trimmed10_mean": 0.3394644131455399, + "terminal_flow": 0.9453344600938968, + "terminal_norm": 0.9945252582159624, + "terminal_packet": 0.996477558685446, + "velocity_flow": 0.9348961502347417, + "velocity_flow_t01": 0.9300430046948356, + "velocity_flow_t03": 0.9320276056338027, + "velocity_flow_t05": 0.9376777464788733, + "velocity_flow_t07": 0.9391976525821596, + "velocity_flow_t09": 0.9327059154929577, + "velocity_flow_t10": 0.9270315492957746, + "velocity_packet": 0.9902997183098591, + "velocity_packet_t01": 0.9548450704225352, + "velocity_packet_t03": 0.9739113615023475, + "velocity_packet_t05": 0.9869391549295775, + "velocity_packet_t07": 0.9945378403755868, + "velocity_packet_t09": 0.9897186854460095, + "velocity_packet_t10": 0.9812791549295774, + "velocity_total": 0.9799379342723006, + "velocity_total_t01": 0.9619492957746479, + "velocity_total_t03": 0.9707376525821597, + "velocity_total_t05": 0.977485821596244, + "velocity_total_t07": 0.9837598122065728, + "velocity_total_t09": 0.9800022535211268, + "velocity_total_t10": 0.9746172769953051 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "arc_length": 0.7382, + "causal_surprisal_flow": 0.44689999999999996, + "causal_surprisal_packet_max": 0.5978000000000001, + "causal_surprisal_packet_mean": 0.6193, + "causal_surprisal_packet_median": 0.6278, + "causal_surprisal_packet_trimmed10_mean": 0.6261, + "causal_surprisal_total": 0.4657, + "consistency_total": 0.8802, + "curvature_flow": 0.2338, + "curvature_packet": 0.7514, + "curvature_total": 0.5534, + "direction_drift_flow": 0.6161, + "direction_drift_packet_max": 0.3012, + "direction_drift_packet_mean": 0.4528, + "direction_drift_packet_median": 0.4482, + "direction_drift_packet_trimmed10_mean": 0.4585, + "direction_drift_total": 0.4874, + "flow_consistency": 0.8094000000000001, + "jacobian_flow": 0.325, + "jacobian_packet": 0.9053, + "jacobian_total": 0.755, + "kappa2_speed2norm_packet_mean": 0.5379, + "kappa2_speed2norm_packet_median": 0.4861, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5392999999999999, + "kinetic_energy": 0.7456999999999999, + "kinetic_flow": 0.4495, + "kinetic_packet": 0.9611999999999999, + "packet_consistency": 0.5439, + "pna_flow": 0.4893, + "pna_packet_max": 0.5483, + "pna_packet_mean": 0.5379, + "pna_packet_median": 0.4861, + "pna_packet_trimmed10_mean": 0.5392999999999999, + "terminal_flow": 0.6321000000000001, + "terminal_norm": 0.9119, + "terminal_packet": 0.9740000000000001, + "velocity_flow": 0.4388, + "velocity_flow_t01": 0.5127, + "velocity_flow_t03": 0.5517000000000001, + "velocity_flow_t05": 0.5528, + "velocity_flow_t07": 0.5308, + "velocity_flow_t09": 0.4984, + "velocity_flow_t10": 0.4177, + "velocity_packet": 0.6792, + "velocity_packet_t01": 0.7155, + "velocity_packet_t03": 0.7174, + "velocity_packet_t05": 0.7088, + "velocity_packet_t07": 0.698, + "velocity_packet_t09": 0.6832, + "velocity_packet_t10": 0.5376000000000001, + "velocity_total": 0.5821000000000001, + "velocity_total_t01": 0.6349, + "velocity_total_t03": 0.6613, + "velocity_total_t05": 0.653, + "velocity_total_t07": 0.6239, + "velocity_total_t09": 0.6027, + "velocity_total_t10": 0.4898 + }, + "ddos-slowloris": { + "_n": 336.0, + "arc_length": 0.8977053571428573, + "causal_surprisal_flow": 0.7477761904761906, + "causal_surprisal_packet_max": 0.7055499999999999, + "causal_surprisal_packet_mean": 0.7151488095238095, + "causal_surprisal_packet_median": 0.7272595238095239, + "causal_surprisal_packet_trimmed10_mean": 0.7105851190476191, + "causal_surprisal_total": 0.7401791666666666, + "consistency_total": 0.869057142857143, + "curvature_flow": 0.4789690476190476, + "curvature_packet": 0.897939880952381, + "curvature_total": 0.8635833333333333, + "direction_drift_flow": 0.20170892857142855, + "direction_drift_packet_max": 0.6203446428571429, + "direction_drift_packet_mean": 0.29492857142857143, + "direction_drift_packet_median": 0.27864940476190475, + "direction_drift_packet_trimmed10_mean": 0.2633875, + "direction_drift_total": 0.3297589285714286, + "flow_consistency": 0.8822369047619049, + "jacobian_flow": 0.22255238095238095, + "jacobian_packet": 0.30146279761904765, + "jacobian_total": 0.1935410714285714, + "kappa2_speed2norm_packet_mean": 0.7141279761904762, + "kappa2_speed2norm_packet_median": 0.654952380952381, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6615827380952382, + "kinetic_energy": 0.8969107142857143, + "kinetic_flow": 0.8688029761904763, + "kinetic_packet": 0.8754446428571429, + "packet_consistency": 0.6434848214285713, + "pna_flow": 0.12313869047619048, + "pna_packet_max": 0.8033208333333333, + "pna_packet_mean": 0.7141279761904762, + "pna_packet_median": 0.654952380952381, + "pna_packet_trimmed10_mean": 0.6615827380952382, + "terminal_flow": 0.9452333333333333, + "terminal_norm": 0.9520404761904763, + "terminal_packet": 0.9386553571428572, + "velocity_flow": 0.8581666666666667, + "velocity_flow_t01": 0.802025, + "velocity_flow_t03": 0.8209589285714285, + "velocity_flow_t05": 0.8368505952380954, + "velocity_flow_t07": 0.8522666666666667, + "velocity_flow_t09": 0.8695095238095238, + "velocity_flow_t10": 0.8721410714285714, + "velocity_packet": 0.8839434523809523, + "velocity_packet_t01": 0.8797422619047619, + "velocity_packet_t03": 0.8842696428571428, + "velocity_packet_t05": 0.8868940476190476, + "velocity_packet_t07": 0.8733970238095237, + "velocity_packet_t09": 0.8734940476190477, + "velocity_packet_t10": 0.8506238095238097, + "velocity_total": 0.8772035714285714, + "velocity_total_t01": 0.8236482142857146, + "velocity_total_t03": 0.8481940476190476, + "velocity_total_t05": 0.863114880952381, + "velocity_total_t07": 0.8728357142857143, + "velocity_total_t09": 0.8799559523809524, + "velocity_total_t10": 0.8786166666666667 + }, + "ddos-syn_flood": { + "_n": 1089.0, + "arc_length": 0.9853805325987144, + "causal_surprisal_flow": 0.5861342516069789, + "causal_surprisal_packet_max": 0.6704242424242425, + "causal_surprisal_packet_mean": 0.6962012855831037, + "causal_surprisal_packet_median": 0.7022971533516987, + "causal_surprisal_packet_trimmed10_mean": 0.6979529843893482, + "causal_surprisal_total": 0.6230541781450871, + "consistency_total": 0.9810387511478421, + "curvature_flow": 0.24590183654729109, + "curvature_packet": 0.9352088154269972, + "curvature_total": 0.8582273645546373, + "direction_drift_flow": 0.10278512396694214, + "direction_drift_packet_max": 0.054835261707989, + "direction_drift_packet_mean": 0.021305050505050507, + "direction_drift_packet_median": 0.023458769513314964, + "direction_drift_packet_trimmed10_mean": 0.022913682277318645, + "direction_drift_total": 0.013460422405876957, + "flow_consistency": 0.9745415977961431, + "jacobian_flow": 0.04383507805325987, + "jacobian_packet": 0.7170093663911846, + "jacobian_total": 0.17623122130394858, + "kappa2_speed2norm_packet_mean": 0.19681689623507803, + "kappa2_speed2norm_packet_median": 0.12725656565656565, + "kappa2_speed2norm_packet_trimmed10_mean": 0.15244885215794307, + "kinetic_energy": 0.9853684113865933, + "kinetic_flow": 0.9375597796143251, + "kinetic_packet": 0.9940328741965105, + "packet_consistency": 0.9886275482093664, + "pna_flow": 0.02368576675849403, + "pna_packet_max": 0.43926207529843897, + "pna_packet_mean": 0.19681689623507803, + "pna_packet_median": 0.12725656565656565, + "pna_packet_trimmed10_mean": 0.15244885215794307, + "terminal_flow": 0.9898470156106519, + "terminal_norm": 0.9968442607897154, + "terminal_packet": 0.9951900826446282, + "velocity_flow": 0.9178192837465565, + "velocity_flow_t01": 0.9273127640036731, + "velocity_flow_t03": 0.9255989898989899, + "velocity_flow_t05": 0.9219257116620754, + "velocity_flow_t07": 0.9181673094582186, + "velocity_flow_t09": 0.9144727272727274, + "velocity_flow_t10": 0.90847419651056, + "velocity_packet": 0.9873432506887053, + "velocity_packet_t01": 0.8663335169880624, + "velocity_packet_t03": 0.9074692378328743, + "velocity_packet_t05": 0.9502325068870524, + "velocity_packet_t07": 0.9847557392102847, + "velocity_packet_t09": 0.9942145087235995, + "velocity_packet_t10": 0.9923840220385675, + "velocity_total": 0.9708471992653811, + "velocity_total_t01": 0.9515460055096419, + "velocity_total_t03": 0.9522152433425161, + "velocity_total_t05": 0.9574437098255281, + "velocity_total_t07": 0.970806611570248, + "velocity_total_t09": 0.9794268135904499, + "velocity_total_t10": 0.9756404040404041 + }, + "ddos-synonymousip_flood": { + "_n": 191.0, + "arc_length": 0.9764659685863875, + "causal_surprisal_flow": 0.4551235602094241, + "causal_surprisal_packet_max": 0.04541047120418848, + "causal_surprisal_packet_mean": 0.04189947643979057, + "causal_surprisal_packet_median": 0.0481696335078534, + "causal_surprisal_packet_trimmed10_mean": 0.04425759162303665, + "causal_surprisal_total": 0.01654136125654451, + "consistency_total": 0.995138219895288, + "curvature_flow": 0.004250261780104712, + "curvature_packet": 0.9900753926701571, + "curvature_total": 0.9754460732984294, + "direction_drift_flow": 0.0420696335078534, + "direction_drift_packet_max": 0.19461570680628273, + "direction_drift_packet_mean": 0.010813612565445042, + "direction_drift_packet_median": 0.014226178010471217, + "direction_drift_packet_trimmed10_mean": 0.011023036649214672, + "direction_drift_total": 0.009258638743455507, + "flow_consistency": 0.9961560209424084, + "jacobian_flow": 0.0036115183246073243, + "jacobian_packet": 0.4106910994764398, + "jacobian_total": 0.14173089005235606, + "kappa2_speed2norm_packet_mean": 0.33244397905759165, + "kappa2_speed2norm_packet_median": 0.28912984293193716, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2859340314136126, + "kinetic_energy": 0.9771507853403142, + "kinetic_flow": 0.909130890052356, + "kinetic_packet": 0.9938942408376964, + "packet_consistency": 0.9559371727748691, + "pna_flow": 0.0007528795811518327, + "pna_packet_max": 0.8618607329842932, + "pna_packet_mean": 0.33244397905759165, + "pna_packet_median": 0.28912984293193716, + "pna_packet_trimmed10_mean": 0.2859340314136126, + "terminal_flow": 0.9994607329842932, + "terminal_norm": 0.9993434554973821, + "terminal_packet": 0.9970460732984293, + "velocity_flow": 0.8942984293193718, + "velocity_flow_t01": 0.9064984293193716, + "velocity_flow_t03": 0.9035424083769633, + "velocity_flow_t05": 0.8998178010471204, + "velocity_flow_t07": 0.8902115183246073, + "velocity_flow_t09": 0.8927089005235602, + "velocity_flow_t10": 0.898469109947644, + "velocity_packet": 0.9881539267015707, + "velocity_packet_t01": 0.966619895287958, + "velocity_packet_t03": 0.9741612565445025, + "velocity_packet_t05": 0.9828628272251309, + "velocity_packet_t07": 0.9877685863874346, + "velocity_packet_t09": 0.9907570680628273, + "velocity_packet_t10": 0.9912429319371729, + "velocity_total": 0.9320303664921467, + "velocity_total_t01": 0.8962376963350787, + "velocity_total_t03": 0.9149287958115183, + "velocity_total_t05": 0.921144502617801, + "velocity_total_t07": 0.9304314136125654, + "velocity_total_t09": 0.9488806282722514, + "velocity_total_t10": 0.9529853403141362 + }, + "ddos-tcp_flood": { + "_n": 1198.0, + "arc_length": 0.9931160267111853, + "causal_surprisal_flow": 0.5574994991652755, + "causal_surprisal_packet_max": 0.6696994991652755, + "causal_surprisal_packet_mean": 0.6908889816360602, + "causal_surprisal_packet_median": 0.6934709515859766, + "causal_surprisal_packet_trimmed10_mean": 0.6916412353923206, + "causal_surprisal_total": 0.5848353923205343, + "consistency_total": 0.963858430717863, + "curvature_flow": 0.38419040066777965, + "curvature_packet": 0.8679020033388982, + "curvature_total": 0.7746070116861435, + "direction_drift_flow": 0.05260617696160267, + "direction_drift_packet_max": 0.0353737896494157, + "direction_drift_packet_mean": 0.006179298831385639, + "direction_drift_packet_median": 0.010232053422370614, + "direction_drift_packet_trimmed10_mean": 0.007975292153589318, + "direction_drift_total": 0.004576794657762947, + "flow_consistency": 0.9625480801335558, + "jacobian_flow": 0.05290150250417362, + "jacobian_packet": 0.7379252921535893, + "jacobian_total": 0.22102554257095158, + "kappa2_speed2norm_packet_mean": 0.0830676961602671, + "kappa2_speed2norm_packet_median": 0.09945751252086812, + "kappa2_speed2norm_packet_trimmed10_mean": 0.08236060100166945, + "kinetic_energy": 0.993146243739566, + "kinetic_flow": 0.9425771285475795, + "kinetic_packet": 0.9970475792988315, + "packet_consistency": 0.7264488313856428, + "pna_flow": 0.030807178631051747, + "pna_packet_max": 0.14088814691151919, + "pna_packet_mean": 0.0830676961602671, + "pna_packet_median": 0.09945751252086812, + "pna_packet_trimmed10_mean": 0.08236060100166945, + "terminal_flow": 0.9365876460767946, + "terminal_norm": 0.9922998330550917, + "terminal_packet": 0.993856594323873, + "velocity_flow": 0.9236026711185309, + "velocity_flow_t01": 0.9286943238731218, + "velocity_flow_t03": 0.9262217028380635, + "velocity_flow_t05": 0.9257163606010016, + "velocity_flow_t07": 0.9247269616026711, + "velocity_flow_t09": 0.9205849749582639, + "velocity_flow_t10": 0.9187621035058431, + "velocity_packet": 0.9898003338898165, + "velocity_packet_t01": 0.8301961602671117, + "velocity_packet_t03": 0.8980235392320535, + "velocity_packet_t05": 0.953137896494157, + "velocity_packet_t07": 0.9904874791318865, + "velocity_packet_t09": 0.9968248747913189, + "velocity_packet_t10": 0.9958699499165276, + "velocity_total": 0.9784874791318865, + "velocity_total_t01": 0.9586761268781303, + "velocity_total_t03": 0.9609332220367279, + "velocity_total_t05": 0.96881469115192, + "velocity_total_t07": 0.9792809682804674, + "velocity_total_t09": 0.9851360601001669, + "velocity_total_t10": 0.9827223706176961 + }, + "ddos-udp_flood": { + "_n": 9.0, + "arc_length": 0.944911111111111, + "causal_surprisal_flow": 0.4996888888888889, + "causal_surprisal_packet_max": 0.21222222222222223, + "causal_surprisal_packet_mean": 0.19828888888888888, + "causal_surprisal_packet_median": 0.2034, + "causal_surprisal_packet_trimmed10_mean": 0.20326666666666668, + "causal_surprisal_total": 0.17033333333333334, + "consistency_total": 0.8843333333333333, + "curvature_flow": 0.5669333333333333, + "curvature_packet": 0.7098888888888889, + "curvature_total": 0.6610666666666667, + "direction_drift_flow": 0.09402222222222222, + "direction_drift_packet_max": 0.33284444444444444, + "direction_drift_packet_mean": 0.08473333333333333, + "direction_drift_packet_median": 0.1071111111111111, + "direction_drift_packet_trimmed10_mean": 0.10113333333333333, + "direction_drift_total": 0.15113333333333331, + "flow_consistency": 0.8763333333333333, + "jacobian_flow": 0.16319999999999996, + "jacobian_packet": 0.6868444444444445, + "jacobian_total": 0.3726666666666666, + "kappa2_speed2norm_packet_mean": 0.4361555555555555, + "kappa2_speed2norm_packet_median": 0.48204444444444444, + "kappa2_speed2norm_packet_trimmed10_mean": 0.47644444444444445, + "kinetic_energy": 0.9457111111111111, + "kinetic_flow": 0.9156000000000001, + "kinetic_packet": 0.9583555555555555, + "packet_consistency": 0.8642444444444445, + "pna_flow": 0.037755555555555556, + "pna_packet_max": 0.41611111111111104, + "pna_packet_mean": 0.4361555555555555, + "pna_packet_median": 0.48204444444444444, + "pna_packet_trimmed10_mean": 0.47644444444444445, + "terminal_flow": 0.9770222222222222, + "terminal_norm": 0.9808222222222222, + "terminal_packet": 0.9478222222222221, + "velocity_flow": 0.9095111111111112, + "velocity_flow_t01": 0.812, + "velocity_flow_t03": 0.8126222222222221, + "velocity_flow_t05": 0.8150222222222222, + "velocity_flow_t07": 0.8791333333333334, + "velocity_flow_t09": 0.9197777777777778, + "velocity_flow_t10": 0.9245555555555556, + "velocity_packet": 0.8555333333333334, + "velocity_packet_t01": 0.7741111111111112, + "velocity_packet_t03": 0.7871111111111111, + "velocity_packet_t05": 0.7991333333333334, + "velocity_packet_t07": 0.7743777777777778, + "velocity_packet_t09": 0.6723333333333333, + "velocity_packet_t10": 0.6167555555555555, + "velocity_total": 0.8858444444444444, + "velocity_total_t01": 0.7881111111111111, + "velocity_total_t03": 0.7878222222222222, + "velocity_total_t05": 0.7854444444444444, + "velocity_total_t07": 0.8322666666666667, + "velocity_total_t09": 0.8549333333333333, + "velocity_total_t10": 0.8381333333333334 + }, + "ddos-udp_fragmentation": { + "_n": 22.0, + "arc_length": 0.7483909090909091, + "causal_surprisal_flow": 0.6396090909090909, + "causal_surprisal_packet_max": 0.44698181818181826, + "causal_surprisal_packet_mean": 0.4016727272727273, + "causal_surprisal_packet_median": 0.37030909090909087, + "causal_surprisal_packet_trimmed10_mean": 0.3846909090909091, + "causal_surprisal_total": 0.5680909090909091, + "consistency_total": 0.7217727272727272, + "curvature_flow": 0.44133636363636364, + "curvature_packet": 0.733409090909091, + "curvature_total": 0.7299818181818183, + "direction_drift_flow": 0.2487181818181818, + "direction_drift_packet_max": 0.4671181818181818, + "direction_drift_packet_mean": 0.41863636363636364, + "direction_drift_packet_median": 0.3943636363636363, + "direction_drift_packet_trimmed10_mean": 0.4198636363636364, + "direction_drift_total": 0.3628, + "flow_consistency": 0.7204454545454545, + "jacobian_flow": 0.22399090909090907, + "jacobian_packet": 0.4542454545454545, + "jacobian_total": 0.30645, + "kappa2_speed2norm_packet_mean": 0.6297454545454545, + "kappa2_speed2norm_packet_median": 0.6278818181818182, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6341636363636363, + "kinetic_energy": 0.7487, + "kinetic_flow": 0.7429272727272728, + "kinetic_packet": 0.6954363636363636, + "packet_consistency": 0.6625090909090909, + "pna_flow": 0.2558818181818182, + "pna_packet_max": 0.633990909090909, + "pna_packet_mean": 0.6297454545454545, + "pna_packet_median": 0.6278818181818182, + "pna_packet_trimmed10_mean": 0.6341636363636363, + "terminal_flow": 0.8209454545454546, + "terminal_norm": 0.7963181818181819, + "terminal_packet": 0.7432454545454545, + "velocity_flow": 0.7472909090909092, + "velocity_flow_t01": 0.7350000000000001, + "velocity_flow_t03": 0.7588818181818182, + "velocity_flow_t05": 0.753109090909091, + "velocity_flow_t07": 0.7484909090909091, + "velocity_flow_t09": 0.7666818181818182, + "velocity_flow_t10": 0.759190909090909, + "velocity_packet": 0.6544272727272726, + "velocity_packet_t01": 0.6721818181818181, + "velocity_packet_t03": 0.6675, + "velocity_packet_t05": 0.6654636363636365, + "velocity_packet_t07": 0.6555727272727273, + "velocity_packet_t09": 0.6582727272727272, + "velocity_packet_t10": 0.6515818181818182, + "velocity_total": 0.7280636363636364, + "velocity_total_t01": 0.7225454545454546, + "velocity_total_t03": 0.7282090909090909, + "velocity_total_t05": 0.7235454545454545, + "velocity_total_t07": 0.7303, + "velocity_total_t09": 0.7421363636363637, + "velocity_total_t10": 0.7448090909090909 + }, + "dictionarybruteforce": { + "_n": 20.0, + "arc_length": 0.70278, + "causal_surprisal_flow": 0.60716, + "causal_surprisal_packet_max": 0.44855, + "causal_surprisal_packet_mean": 0.46358, + "causal_surprisal_packet_median": 0.36019, + "causal_surprisal_packet_trimmed10_mean": 0.38451, + "causal_surprisal_total": 0.55493, + "consistency_total": 0.62548, + "curvature_flow": 0.6327999999999999, + "curvature_packet": 0.63912, + "curvature_total": 0.68582, + "direction_drift_flow": 0.22104999999999997, + "direction_drift_packet_max": 0.43265, + "direction_drift_packet_mean": 0.31381000000000003, + "direction_drift_packet_median": 0.28592999999999996, + "direction_drift_packet_trimmed10_mean": 0.32728, + "direction_drift_total": 0.27457, + "flow_consistency": 0.65125, + "jacobian_flow": 0.27223, + "jacobian_packet": 0.34256, + "jacobian_total": 0.33006, + "kappa2_speed2norm_packet_mean": 0.59907, + "kappa2_speed2norm_packet_median": 0.5717, + "kappa2_speed2norm_packet_trimmed10_mean": 0.61478, + "kinetic_energy": 0.7005399999999999, + "kinetic_flow": 0.7455999999999999, + "kinetic_packet": 0.56214, + "packet_consistency": 0.43013, + "pna_flow": 0.36580999999999997, + "pna_packet_max": 0.5604100000000001, + "pna_packet_mean": 0.59907, + "pna_packet_median": 0.5717, + "pna_packet_trimmed10_mean": 0.61478, + "terminal_flow": 0.8495699999999999, + "terminal_norm": 0.8204899999999999, + "terminal_packet": 0.7176899999999999, + "velocity_flow": 0.72754, + "velocity_flow_t01": 0.67605, + "velocity_flow_t03": 0.67396, + "velocity_flow_t05": 0.68747, + "velocity_flow_t07": 0.7032400000000001, + "velocity_flow_t09": 0.76345, + "velocity_flow_t10": 0.77747, + "velocity_packet": 0.61052, + "velocity_packet_t01": 0.60742, + "velocity_packet_t03": 0.60471, + "velocity_packet_t05": 0.5988100000000001, + "velocity_packet_t07": 0.58895, + "velocity_packet_t09": 0.62864, + "velocity_packet_t10": 0.6269499999999999, + "velocity_total": 0.71099, + "velocity_total_t01": 0.66175, + "velocity_total_t03": 0.6565300000000001, + "velocity_total_t05": 0.65559, + "velocity_total_t07": 0.68174, + "velocity_total_t09": 0.7481800000000001, + "velocity_total_t10": 0.7438499999999999 + }, + "dns_spoofing": { + "_n": 163.0, + "arc_length": 0.7490576687116564, + "causal_surprisal_flow": 0.5979668711656442, + "causal_surprisal_packet_max": 0.48739018404907974, + "causal_surprisal_packet_mean": 0.4796981595092024, + "causal_surprisal_packet_median": 0.4807828220858895, + "causal_surprisal_packet_trimmed10_mean": 0.4778466257668711, + "causal_surprisal_total": 0.5617312883435582, + "consistency_total": 0.6845239263803681, + "curvature_flow": 0.5894907975460122, + "curvature_packet": 0.7212306748466257, + "curvature_total": 0.7160417177914111, + "direction_drift_flow": 0.2505754601226994, + "direction_drift_packet_max": 0.4772306748466258, + "direction_drift_packet_mean": 0.3816220858895706, + "direction_drift_packet_median": 0.3947484662576687, + "direction_drift_packet_trimmed10_mean": 0.3927447852760736, + "direction_drift_total": 0.32118282208588955, + "flow_consistency": 0.6789386503067485, + "jacobian_flow": 0.22787239263803682, + "jacobian_packet": 0.5089411042944786, + "jacobian_total": 0.3683239263803681, + "kappa2_speed2norm_packet_mean": 0.6227791411042944, + "kappa2_speed2norm_packet_median": 0.6199840490797546, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6294969325153373, + "kinetic_energy": 0.7481791411042944, + "kinetic_flow": 0.7267042944785276, + "kinetic_packet": 0.6576699386503068, + "packet_consistency": 0.6261282208588956, + "pna_flow": 0.259279754601227, + "pna_packet_max": 0.6265006134969325, + "pna_packet_mean": 0.6227791411042944, + "pna_packet_median": 0.6199840490797546, + "pna_packet_trimmed10_mean": 0.6294969325153373, + "terminal_flow": 0.7694736196319019, + "terminal_norm": 0.7852466257668712, + "terminal_packet": 0.7520184049079753, + "velocity_flow": 0.7551312883435584, + "velocity_flow_t01": 0.7031619631901841, + "velocity_flow_t03": 0.7248184049079754, + "velocity_flow_t05": 0.7406147239263803, + "velocity_flow_t07": 0.745361963190184, + "velocity_flow_t09": 0.7662711656441717, + "velocity_flow_t10": 0.7700736196319018, + "velocity_packet": 0.6890993865030676, + "velocity_packet_t01": 0.6750171779141104, + "velocity_packet_t03": 0.6746625766871166, + "velocity_packet_t05": 0.6699656441717792, + "velocity_packet_t07": 0.6742269938650307, + "velocity_packet_t09": 0.7090245398773006, + "velocity_packet_t10": 0.6623631901840491, + "velocity_total": 0.751755828220859, + "velocity_total_t01": 0.7257361963190183, + "velocity_total_t03": 0.7332429447852762, + "velocity_total_t05": 0.7397766871165645, + "velocity_total_t07": 0.7448638036809816, + "velocity_total_t09": 0.7670625766871166, + "velocity_total_t10": 0.7622079754601228 + }, + "dos-http_flood": { + "_n": 714.0, + "arc_length": 0.962086274509804, + "causal_surprisal_flow": 0.3700619047619048, + "causal_surprisal_packet_max": 0.596064425770308, + "causal_surprisal_packet_mean": 0.5483355742296919, + "causal_surprisal_packet_median": 0.5413126050420168, + "causal_surprisal_packet_trimmed10_mean": 0.5428666666666667, + "causal_surprisal_total": 0.4505235294117647, + "consistency_total": 0.9185042016806723, + "curvature_flow": 0.4196056022408964, + "curvature_packet": 0.964814005602241, + "curvature_total": 0.9391537815126051, + "direction_drift_flow": 0.15656134453781514, + "direction_drift_packet_max": 0.4254644257703081, + "direction_drift_packet_mean": 0.12613193277310925, + "direction_drift_packet_median": 0.12659131652661065, + "direction_drift_packet_trimmed10_mean": 0.13484005602240895, + "direction_drift_total": 0.08732380952380953, + "flow_consistency": 0.8620014005602242, + "jacobian_flow": 0.26754145658263306, + "jacobian_packet": 0.6993252100840337, + "jacobian_total": 0.5490810924369747, + "kappa2_speed2norm_packet_mean": 0.8161025210084034, + "kappa2_speed2norm_packet_median": 0.8064434173669468, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8223865546218487, + "kinetic_energy": 0.9621504201680672, + "kinetic_flow": 0.8409240896358543, + "kinetic_packet": 0.952410644257703, + "packet_consistency": 0.9061560224089636, + "pna_flow": 0.09136750700280113, + "pna_packet_max": 0.8901802521008404, + "pna_packet_mean": 0.8161025210084034, + "pna_packet_median": 0.8064434173669468, + "pna_packet_trimmed10_mean": 0.8223865546218487, + "terminal_flow": 0.9675484593837537, + "terminal_norm": 0.9872361344537816, + "terminal_packet": 0.9819722689075631, + "velocity_flow": 0.8481246498599441, + "velocity_flow_t01": 0.6478871148459384, + "velocity_flow_t03": 0.6667478991596639, + "velocity_flow_t05": 0.7987182072829132, + "velocity_flow_t07": 0.8433719887955182, + "velocity_flow_t09": 0.8623406162464987, + "velocity_flow_t10": 0.8707745098039216, + "velocity_packet": 0.9494110644257703, + "velocity_packet_t01": 0.9383492997198879, + "velocity_packet_t03": 0.9439943977591037, + "velocity_packet_t05": 0.9479501400560225, + "velocity_packet_t07": 0.9495470588235292, + "velocity_packet_t09": 0.95384593837535, + "velocity_packet_t10": 0.8995316526610644, + "velocity_total": 0.9272081232492998, + "velocity_total_t01": 0.8475977591036413, + "velocity_total_t03": 0.8569719887955181, + "velocity_total_t05": 0.8901019607843137, + "velocity_total_t07": 0.922584593837535, + "velocity_total_t09": 0.9505288515406163, + "velocity_total_t10": 0.944895238095238 + }, + "dos-syn_flood": { + "_n": 836.0, + "arc_length": 0.9830078947368419, + "causal_surprisal_flow": 0.7343770334928229, + "causal_surprisal_packet_max": 0.6835053827751196, + "causal_surprisal_packet_mean": 0.7522162679425839, + "causal_surprisal_packet_median": 0.8049509569377993, + "causal_surprisal_packet_trimmed10_mean": 0.7710404306220096, + "causal_surprisal_total": 0.8267791866028709, + "consistency_total": 0.9844155502392345, + "curvature_flow": 0.1732025119617225, + "curvature_packet": 0.856133014354067, + "curvature_total": 0.7398845693779905, + "direction_drift_flow": 0.11897607655502393, + "direction_drift_packet_max": 0.15896184210526315, + "direction_drift_packet_mean": 0.029219856459330146, + "direction_drift_packet_median": 0.05571483253588517, + "direction_drift_packet_trimmed10_mean": 0.033472009569377986, + "direction_drift_total": 0.022271770334928234, + "flow_consistency": 0.9791581339712918, + "jacobian_flow": 0.10837200956937798, + "jacobian_packet": 0.5356791866028707, + "jacobian_total": 0.2246662679425837, + "kappa2_speed2norm_packet_mean": 0.2616205741626795, + "kappa2_speed2norm_packet_median": 0.15860693779904306, + "kappa2_speed2norm_packet_trimmed10_mean": 0.21212081339712918, + "kinetic_energy": 0.9832849282296652, + "kinetic_flow": 0.9154133971291866, + "kinetic_packet": 0.9966141148325359, + "packet_consistency": 0.97528995215311, + "pna_flow": 0.028035765550239233, + "pna_packet_max": 0.5828334928229665, + "pna_packet_mean": 0.2616205741626795, + "pna_packet_median": 0.15860693779904306, + "pna_packet_trimmed10_mean": 0.21212081339712918, + "terminal_flow": 0.9891282296650719, + "terminal_norm": 0.9980456937799043, + "terminal_packet": 0.9970748803827751, + "velocity_flow": 0.8979214114832534, + "velocity_flow_t01": 0.8968834928229666, + "velocity_flow_t03": 0.8984193779904307, + "velocity_flow_t05": 0.9006976076555024, + "velocity_flow_t07": 0.8991074162679425, + "velocity_flow_t09": 0.8939107655502393, + "velocity_flow_t10": 0.8921021531100479, + "velocity_packet": 0.9843444976076555, + "velocity_packet_t01": 0.9074736842105262, + "velocity_packet_t03": 0.9345167464114832, + "velocity_packet_t05": 0.9610133971291865, + "velocity_packet_t07": 0.9860712918660287, + "velocity_packet_t09": 0.9902614832535885, + "velocity_packet_t10": 0.9808093301435407, + "velocity_total": 0.9540244019138756, + "velocity_total_t01": 0.9244275119617225, + "velocity_total_t03": 0.934962918660287, + "velocity_total_t05": 0.9430521531100479, + "velocity_total_t07": 0.9544897129186602, + "velocity_total_t09": 0.9658009569377991, + "velocity_total_t10": 0.9607787081339713 + }, + "dos-tcp_flood": { + "_n": 1084.0, + "arc_length": 0.9877928044280444, + "causal_surprisal_flow": 0.7508758302583026, + "causal_surprisal_packet_max": 0.6509809963099631, + "causal_surprisal_packet_mean": 0.6777105166051661, + "causal_surprisal_packet_median": 0.6809035055350554, + "causal_surprisal_packet_trimmed10_mean": 0.678091512915129, + "causal_surprisal_total": 0.8251616236162361, + "consistency_total": 0.9807714022140221, + "curvature_flow": 0.5263989852398524, + "curvature_packet": 0.9653125461254612, + "curvature_total": 0.9163220479704798, + "direction_drift_flow": 0.10511743542435424, + "direction_drift_packet_max": 0.2892864391143911, + "direction_drift_packet_mean": 0.16375553505535057, + "direction_drift_packet_median": 0.1670721402214022, + "direction_drift_packet_trimmed10_mean": 0.17282481549815498, + "direction_drift_total": 0.08595811808118081, + "flow_consistency": 0.9790640221402215, + "jacobian_flow": 0.12593782287822877, + "jacobian_packet": 0.6653121771217712, + "jacobian_total": 0.3075130996309963, + "kappa2_speed2norm_packet_mean": 0.3906173431734318, + "kappa2_speed2norm_packet_median": 0.3192418819188192, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3576411439114391, + "kinetic_energy": 0.9879998154981549, + "kinetic_flow": 0.9150084870848709, + "kinetic_packet": 0.9960459409594097, + "packet_consistency": 0.760958856088561, + "pna_flow": 0.07247767527675275, + "pna_packet_max": 0.6282809963099631, + "pna_packet_mean": 0.3906173431734318, + "pna_packet_median": 0.3192418819188192, + "pna_packet_trimmed10_mean": 0.3576411439114391, + "terminal_flow": 0.9834752767527675, + "terminal_norm": 0.9966549815498155, + "terminal_packet": 0.9967252767527675, + "velocity_flow": 0.9110250922509225, + "velocity_flow_t01": 0.9037811808118081, + "velocity_flow_t03": 0.9161333948339484, + "velocity_flow_t05": 0.9203926199261994, + "velocity_flow_t07": 0.9139946494464943, + "velocity_flow_t09": 0.9003972324723246, + "velocity_flow_t10": 0.8903178966789667, + "velocity_packet": 0.9519092250922508, + "velocity_packet_t01": 0.8185579335793357, + "velocity_packet_t03": 0.871330996309963, + "velocity_packet_t05": 0.9178121771217713, + "velocity_packet_t07": 0.9550780442804429, + "velocity_packet_t09": 0.9463448339483395, + "velocity_packet_t10": 0.9515701107011071, + "velocity_total": 0.9672416974169742, + "velocity_total_t01": 0.9446883763837638, + "velocity_total_t03": 0.9492435424354244, + "velocity_total_t05": 0.9557443726937271, + "velocity_total_t07": 0.9675870848708485, + "velocity_total_t09": 0.9687673431734318, + "velocity_total_t10": 0.9682125461254613 + }, + "dos-udp_flood": { + "_n": 201.0, + "arc_length": 0.9498039800995025, + "causal_surprisal_flow": 0.8895681592039801, + "causal_surprisal_packet_max": 0.5364577114427861, + "causal_surprisal_packet_mean": 0.35474029850746264, + "causal_surprisal_packet_median": 0.3106606965174129, + "causal_surprisal_packet_trimmed10_mean": 0.3366616915422886, + "causal_surprisal_total": 0.5236009950248757, + "consistency_total": 0.9947850746268658, + "curvature_flow": 0.4602208955223881, + "curvature_packet": 0.6423796019900498, + "curvature_total": 0.5992716417910449, + "direction_drift_flow": 0.05733333333333334, + "direction_drift_packet_max": 0.6206388059701493, + "direction_drift_packet_mean": 0.011419900497512448, + "direction_drift_packet_median": 0.010578109452736326, + "direction_drift_packet_trimmed10_mean": 0.009382089552238805, + "direction_drift_total": 0.025073631840796022, + "flow_consistency": 0.9949194029850748, + "jacobian_flow": 0.03974726368159204, + "jacobian_packet": 0.43949353233830846, + "jacobian_total": 0.15495522388059704, + "kappa2_speed2norm_packet_mean": 0.2874199004975125, + "kappa2_speed2norm_packet_median": 0.19963184079601992, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2206577114427861, + "kinetic_energy": 0.9517930348258705, + "kinetic_flow": 0.9841542288557216, + "kinetic_packet": 0.9860457711442786, + "packet_consistency": 0.9232467661691541, + "pna_flow": 0.018356218905472635, + "pna_packet_max": 0.8889562189054727, + "pna_packet_mean": 0.2874199004975125, + "pna_packet_median": 0.19963184079601992, + "pna_packet_trimmed10_mean": 0.2206577114427861, + "terminal_flow": 0.9960825870646766, + "terminal_norm": 0.9827592039800994, + "terminal_packet": 0.9840248756218906, + "velocity_flow": 0.9862686567164178, + "velocity_flow_t01": 0.9799363184079604, + "velocity_flow_t03": 0.9822248756218905, + "velocity_flow_t05": 0.9844348258706467, + "velocity_flow_t07": 0.9863592039800995, + "velocity_flow_t09": 0.9864885572139304, + "velocity_flow_t10": 0.9854537313432836, + "velocity_packet": 0.9732049751243781, + "velocity_packet_t01": 0.9746497512437811, + "velocity_packet_t03": 0.9739333333333333, + "velocity_packet_t05": 0.972865671641791, + "velocity_packet_t07": 0.9801422885572139, + "velocity_packet_t09": 0.9639303482587066, + "velocity_packet_t10": 0.8716517412935323, + "velocity_total": 0.922713432835821, + "velocity_total_t01": 0.9228119402985074, + "velocity_total_t03": 0.9213701492537313, + "velocity_total_t05": 0.9211820895522388, + "velocity_total_t07": 0.9261860696517414, + "velocity_total_t09": 0.9185870646766169, + "velocity_total_t10": 0.862579104477612 + }, + "mirai-greeth_flood": { + "_n": 12.0, + "arc_length": 0.57145, + "causal_surprisal_flow": 0.5468666666666666, + "causal_surprisal_packet_max": 0.39915, + "causal_surprisal_packet_mean": 0.4298166666666666, + "causal_surprisal_packet_median": 0.38983333333333337, + "causal_surprisal_packet_trimmed10_mean": 0.4114333333333333, + "causal_surprisal_total": 0.5386, + "consistency_total": 0.6573166666666665, + "curvature_flow": 0.44806666666666667, + "curvature_packet": 0.58345, + "curvature_total": 0.5693833333333334, + "direction_drift_flow": 0.3818666666666667, + "direction_drift_packet_max": 0.4849333333333333, + "direction_drift_packet_mean": 0.5056, + "direction_drift_packet_median": 0.5057, + "direction_drift_packet_trimmed10_mean": 0.5433666666666666, + "direction_drift_total": 0.39308333333333334, + "flow_consistency": 0.6262833333333334, + "jacobian_flow": 0.25103333333333333, + "jacobian_packet": 0.41845, + "jacobian_total": 0.3525, + "kappa2_speed2norm_packet_mean": 0.62105, + "kappa2_speed2norm_packet_median": 0.6005166666666666, + "kappa2_speed2norm_packet_trimmed10_mean": 0.64255, + "kinetic_energy": 0.5696666666666667, + "kinetic_flow": 0.5176833333333333, + "kinetic_packet": 0.5323166666666667, + "packet_consistency": 0.6835333333333334, + "pna_flow": 0.36688333333333334, + "pna_packet_max": 0.5557000000000001, + "pna_packet_mean": 0.62105, + "pna_packet_median": 0.6005166666666666, + "pna_packet_trimmed10_mean": 0.64255, + "terminal_flow": 0.5898166666666667, + "terminal_norm": 0.7097666666666668, + "terminal_packet": 0.7498166666666667, + "velocity_flow": 0.6048, + "velocity_flow_t01": 0.6310666666666667, + "velocity_flow_t03": 0.6096833333333334, + "velocity_flow_t05": 0.58555, + "velocity_flow_t07": 0.5719166666666666, + "velocity_flow_t09": 0.5972666666666667, + "velocity_flow_t10": 0.6289333333333333, + "velocity_packet": 0.5056333333333334, + "velocity_packet_t01": 0.5399666666666667, + "velocity_packet_t03": 0.5396, + "velocity_packet_t05": 0.5386666666666666, + "velocity_packet_t07": 0.5494833333333333, + "velocity_packet_t09": 0.5372333333333333, + "velocity_packet_t10": 0.46318333333333334, + "velocity_total": 0.6045666666666667, + "velocity_total_t01": 0.6488166666666667, + "velocity_total_t03": 0.6406, + "velocity_total_t05": 0.6219833333333333, + "velocity_total_t07": 0.6133166666666666, + "velocity_total_t09": 0.6231, + "velocity_total_t10": 0.5945166666666667 + }, + "mirai-greip_flood": { + "_n": 18.0, + "arc_length": 0.7792888888888889, + "causal_surprisal_flow": 0.6232666666666666, + "causal_surprisal_packet_max": 0.43097777777777774, + "causal_surprisal_packet_mean": 0.42633333333333334, + "causal_surprisal_packet_median": 0.4045222222222222, + "causal_surprisal_packet_trimmed10_mean": 0.4073777777777778, + "causal_surprisal_total": 0.5327666666666666, + "consistency_total": 0.7169222222222222, + "curvature_flow": 0.3709555555555555, + "curvature_packet": 0.6308777777777778, + "curvature_total": 0.6664222222222222, + "direction_drift_flow": 0.19185555555555553, + "direction_drift_packet_max": 0.5459444444444445, + "direction_drift_packet_mean": 0.3170777777777778, + "direction_drift_packet_median": 0.2701, + "direction_drift_packet_trimmed10_mean": 0.2972, + "direction_drift_total": 0.2715333333333333, + "flow_consistency": 0.7758555555555555, + "jacobian_flow": 0.2392111111111111, + "jacobian_packet": 0.3163222222222223, + "jacobian_total": 0.30966666666666665, + "kappa2_speed2norm_packet_mean": 0.5842, + "kappa2_speed2norm_packet_median": 0.5577555555555556, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5680555555555555, + "kinetic_energy": 0.7772444444444445, + "kinetic_flow": 0.7633333333333334, + "kinetic_packet": 0.6384333333333333, + "packet_consistency": 0.5050888888888889, + "pna_flow": 0.2079222222222222, + "pna_packet_max": 0.6214000000000001, + "pna_packet_mean": 0.5842, + "pna_packet_median": 0.5577555555555556, + "pna_packet_trimmed10_mean": 0.5680555555555555, + "terminal_flow": 0.8779555555555556, + "terminal_norm": 0.8557, + "terminal_packet": 0.7168222222222222, + "velocity_flow": 0.7942777777777777, + "velocity_flow_t01": 0.7068000000000001, + "velocity_flow_t03": 0.7261333333333333, + "velocity_flow_t05": 0.7577222222222222, + "velocity_flow_t07": 0.7749777777777778, + "velocity_flow_t09": 0.8105666666666667, + "velocity_flow_t10": 0.7874111111111111, + "velocity_packet": 0.6878222222222221, + "velocity_packet_t01": 0.6277111111111111, + "velocity_packet_t03": 0.6278999999999999, + "velocity_packet_t05": 0.6369333333333334, + "velocity_packet_t07": 0.6458111111111111, + "velocity_packet_t09": 0.6765555555555556, + "velocity_packet_t10": 0.7276444444444444, + "velocity_total": 0.7874333333333332, + "velocity_total_t01": 0.6928555555555556, + "velocity_total_t03": 0.7086888888888888, + "velocity_total_t05": 0.7359888888888888, + "velocity_total_t07": 0.7623222222222222, + "velocity_total_t09": 0.8161777777777778, + "velocity_total_t10": 0.7955666666666666 + }, + "mirai-udpplain": { + "_n": 9.0, + "arc_length": 0.5350222222222222, + "causal_surprisal_flow": 0.47855555555555557, + "causal_surprisal_packet_max": 0.44195555555555555, + "causal_surprisal_packet_mean": 0.4576222222222222, + "causal_surprisal_packet_median": 0.48639999999999994, + "causal_surprisal_packet_trimmed10_mean": 0.4678, + "causal_surprisal_total": 0.5116444444444445, + "consistency_total": 0.7764, + "curvature_flow": 0.4981333333333333, + "curvature_packet": 0.553711111111111, + "curvature_total": 0.5262222222222221, + "direction_drift_flow": 0.4583333333333333, + "direction_drift_packet_max": 0.4389555555555556, + "direction_drift_packet_mean": 0.5910666666666666, + "direction_drift_packet_median": 0.6066666666666666, + "direction_drift_packet_trimmed10_mean": 0.6288222222222222, + "direction_drift_total": 0.44953333333333334, + "flow_consistency": 0.7654444444444445, + "jacobian_flow": 0.3088666666666666, + "jacobian_packet": 0.7695333333333333, + "jacobian_total": 0.5214222222222222, + "kappa2_speed2norm_packet_mean": 0.4719555555555555, + "kappa2_speed2norm_packet_median": 0.4779777777777777, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4910666666666667, + "kinetic_energy": 0.5339777777777777, + "kinetic_flow": 0.48691111111111113, + "kinetic_packet": 0.4693777777777778, + "packet_consistency": 0.5506222222222221, + "pna_flow": 0.48108888888888884, + "pna_packet_max": 0.41986666666666667, + "pna_packet_mean": 0.4719555555555555, + "pna_packet_median": 0.4779777777777777, + "pna_packet_trimmed10_mean": 0.4910666666666667, + "terminal_flow": 0.6096444444444444, + "terminal_norm": 0.5708666666666666, + "terminal_packet": 0.5378666666666667, + "velocity_flow": 0.5688888888888889, + "velocity_flow_t01": 0.5811333333333333, + "velocity_flow_t03": 0.5865777777777778, + "velocity_flow_t05": 0.5665777777777778, + "velocity_flow_t07": 0.590111111111111, + "velocity_flow_t09": 0.6128888888888888, + "velocity_flow_t10": 0.5760666666666667, + "velocity_packet": 0.4916, + "velocity_packet_t01": 0.5096666666666666, + "velocity_packet_t03": 0.4851777777777777, + "velocity_packet_t05": 0.45988888888888885, + "velocity_packet_t07": 0.4572666666666667, + "velocity_packet_t09": 0.48246666666666665, + "velocity_packet_t10": 0.5064222222222223, + "velocity_total": 0.5649111111111111, + "velocity_total_t01": 0.5739555555555554, + "velocity_total_t03": 0.5561777777777778, + "velocity_total_t05": 0.5464444444444445, + "velocity_total_t07": 0.5594, + "velocity_total_t09": 0.5906, + "velocity_total_t10": 0.609488888888889 + }, + "mitm-arpspoofing": { + "_n": 134.0, + "arc_length": 0.748565671641791, + "causal_surprisal_flow": 0.5366932835820896, + "causal_surprisal_packet_max": 0.29940447761194033, + "causal_surprisal_packet_mean": 0.27834925373134334, + "causal_surprisal_packet_median": 0.2786253731343284, + "causal_surprisal_packet_trimmed10_mean": 0.27025820895522396, + "causal_surprisal_total": 0.47369402985074627, + "consistency_total": 0.6457537313432836, + "curvature_flow": 0.6314746268656717, + "curvature_packet": 0.6446388059701492, + "curvature_total": 0.6984485074626865, + "direction_drift_flow": 0.2267462686567164, + "direction_drift_packet_max": 0.3265402985074627, + "direction_drift_packet_mean": 0.27107014925373135, + "direction_drift_packet_median": 0.2809268656716418, + "direction_drift_packet_trimmed10_mean": 0.29201194029850747, + "direction_drift_total": 0.20148955223880594, + "flow_consistency": 0.6909597014925373, + "jacobian_flow": 0.3429, + "jacobian_packet": 0.4011970149253732, + "jacobian_total": 0.4393432835820895, + "kappa2_speed2norm_packet_mean": 0.550144776119403, + "kappa2_speed2norm_packet_median": 0.5610880597014926, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5715328358208955, + "kinetic_energy": 0.7476149253731343, + "kinetic_flow": 0.7155522388059702, + "kinetic_packet": 0.6363537313432837, + "packet_consistency": 0.3603970149253731, + "pna_flow": 0.3028522388059701, + "pna_packet_max": 0.5086328358208956, + "pna_packet_mean": 0.550144776119403, + "pna_packet_median": 0.5610880597014926, + "pna_packet_trimmed10_mean": 0.5715328358208955, + "terminal_flow": 0.8112641791044775, + "terminal_norm": 0.8211417910447761, + "terminal_packet": 0.7318149253731343, + "velocity_flow": 0.7338805970149254, + "velocity_flow_t01": 0.6361417910447762, + "velocity_flow_t03": 0.6607134328358208, + "velocity_flow_t05": 0.6965149253731343, + "velocity_flow_t07": 0.7175611940298507, + "velocity_flow_t09": 0.7644626865671642, + "velocity_flow_t10": 0.7563925373134328, + "velocity_packet": 0.605660447761194, + "velocity_packet_t01": 0.6039671641791045, + "velocity_packet_t03": 0.6042343283582089, + "velocity_packet_t05": 0.601110447761194, + "velocity_packet_t07": 0.5839985074626866, + "velocity_packet_t09": 0.6239283582089552, + "velocity_packet_t10": 0.6171014925373135, + "velocity_total": 0.741579104477612, + "velocity_total_t01": 0.6707895522388059, + "velocity_total_t03": 0.685241791044776, + "velocity_total_t05": 0.7018567164179105, + "velocity_total_t07": 0.7296044776119402, + "velocity_total_t09": 0.7756, + "velocity_total_t10": 0.7491776119402985 + }, + "recon-hostdiscovery": { + "_n": 179.0, + "arc_length": 0.7873374301675978, + "causal_surprisal_flow": 0.4318111731843576, + "causal_surprisal_packet_max": 0.5180703910614526, + "causal_surprisal_packet_mean": 0.5448078212290504, + "causal_surprisal_packet_median": 0.5583128491620112, + "causal_surprisal_packet_trimmed10_mean": 0.550949720670391, + "causal_surprisal_total": 0.457545251396648, + "consistency_total": 0.774964245810056, + "curvature_flow": 0.4146648044692738, + "curvature_packet": 0.6985251396648046, + "curvature_total": 0.6767039106145251, + "direction_drift_flow": 0.3140178770949721, + "direction_drift_packet_max": 0.2637206703910615, + "direction_drift_packet_mean": 0.2445195530726257, + "direction_drift_packet_median": 0.25162122905027934, + "direction_drift_packet_trimmed10_mean": 0.270463687150838, + "direction_drift_total": 0.1860703910614525, + "flow_consistency": 0.7721486033519553, + "jacobian_flow": 0.3839206703910615, + "jacobian_packet": 0.6947832402234637, + "jacobian_total": 0.6421877094972068, + "kappa2_speed2norm_packet_mean": 0.5192983240223463, + "kappa2_speed2norm_packet_median": 0.527736312849162, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5386536312849162, + "kinetic_energy": 0.7871720670391062, + "kinetic_flow": 0.6842279329608938, + "kinetic_packet": 0.7618670391061453, + "packet_consistency": 0.7167206703910615, + "pna_flow": 0.25573854748603353, + "pna_packet_max": 0.49110111731843575, + "pna_packet_mean": 0.5192983240223463, + "pna_packet_median": 0.527736312849162, + "pna_packet_trimmed10_mean": 0.5386536312849162, + "terminal_flow": 0.7788368715083799, + "terminal_norm": 0.807573184357542, + "terminal_packet": 0.7897474860335196, + "velocity_flow": 0.6970592178770949, + "velocity_flow_t01": 0.5011910614525139, + "velocity_flow_t03": 0.5746011173184358, + "velocity_flow_t05": 0.6587351955307262, + "velocity_flow_t07": 0.6852212290502794, + "velocity_flow_t09": 0.7355754189944133, + "velocity_flow_t10": 0.7324100558659217, + "velocity_packet": 0.7171754189944134, + "velocity_packet_t01": 0.6782301675977653, + "velocity_packet_t03": 0.6839195530726258, + "velocity_packet_t05": 0.6907905027932961, + "velocity_packet_t07": 0.7094670391061453, + "velocity_packet_t09": 0.7375061452513967, + "velocity_packet_t10": 0.7003284916201118, + "velocity_total": 0.7451944134078213, + "velocity_total_t01": 0.6440245810055866, + "velocity_total_t03": 0.6641284916201117, + "velocity_total_t05": 0.7014055865921788, + "velocity_total_t07": 0.7355340782122904, + "velocity_total_t09": 0.7889888268156425, + "velocity_total_t10": 0.7670983240223463 + }, + "recon-osscan": { + "_n": 371.0, + "arc_length": 0.9158274932614555, + "causal_surprisal_flow": 0.45080296495956873, + "causal_surprisal_packet_max": 0.5677180592991915, + "causal_surprisal_packet_mean": 0.594300808625337, + "causal_surprisal_packet_median": 0.6055811320754717, + "causal_surprisal_packet_trimmed10_mean": 0.6003601078167117, + "causal_surprisal_total": 0.47386792452830184, + "consistency_total": 0.8637773584905661, + "curvature_flow": 0.3651293800539083, + "curvature_packet": 0.8507598382749327, + "curvature_total": 0.8145018867924527, + "direction_drift_flow": 0.2216140161725067, + "direction_drift_packet_max": 0.34295687331536384, + "direction_drift_packet_mean": 0.27562938005390836, + "direction_drift_packet_median": 0.2787533692722372, + "direction_drift_packet_trimmed10_mean": 0.2911199460916442, + "direction_drift_total": 0.194433153638814, + "flow_consistency": 0.8652630727762802, + "jacobian_flow": 0.3771913746630728, + "jacobian_packet": 0.7405293800539083, + "jacobian_total": 0.6520533692722372, + "kappa2_speed2norm_packet_mean": 0.6847202156334231, + "kappa2_speed2norm_packet_median": 0.6905056603773585, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6931617250673855, + "kinetic_energy": 0.9159450134770889, + "kinetic_flow": 0.8115929919137467, + "kinetic_packet": 0.8915579514824796, + "packet_consistency": 0.7971245283018867, + "pna_flow": 0.13418436657681942, + "pna_packet_max": 0.6704824797843667, + "pna_packet_mean": 0.6847202156334231, + "pna_packet_median": 0.6905056603773585, + "pna_packet_trimmed10_mean": 0.6931617250673855, + "terminal_flow": 0.9182706199460917, + "terminal_norm": 0.937911051212938, + "terminal_packet": 0.9237466307277629, + "velocity_flow": 0.7934388140161724, + "velocity_flow_t01": 0.616977897574124, + "velocity_flow_t03": 0.6785698113207548, + "velocity_flow_t05": 0.7548528301886793, + "velocity_flow_t07": 0.7869380053908356, + "velocity_flow_t09": 0.8161741239892183, + "velocity_flow_t10": 0.8107040431266846, + "velocity_packet": 0.8446393530997304, + "velocity_packet_t01": 0.8140495956873315, + "velocity_packet_t03": 0.8199536388140162, + "velocity_packet_t05": 0.8217029649595687, + "velocity_packet_t07": 0.8224183288409704, + "velocity_packet_t09": 0.8466962264150942, + "velocity_packet_t10": 0.8222458221024258, + "velocity_total": 0.8703962264150944, + "velocity_total_t01": 0.7704830188679246, + "velocity_total_t03": 0.785478167115903, + "velocity_total_t05": 0.8193277628032345, + "velocity_total_t07": 0.8571924528301885, + "velocity_total_t09": 0.8904307277628033, + "velocity_total_t10": 0.8876706199460918 + }, + "recon-pingsweep": { + "_n": 6.0, + "arc_length": 0.9421999999999999, + "causal_surprisal_flow": 0.6661666666666667, + "causal_surprisal_packet_max": 0.6020333333333333, + "causal_surprisal_packet_mean": 0.5669, + "causal_surprisal_packet_median": 0.5987666666666667, + "causal_surprisal_packet_trimmed10_mean": 0.5686666666666665, + "causal_surprisal_total": 0.6654666666666667, + "consistency_total": 0.9369999999999999, + "curvature_flow": 0.6924333333333332, + "curvature_packet": 0.9569666666666666, + "curvature_total": 0.9531000000000001, + "direction_drift_flow": 0.13673333333333332, + "direction_drift_packet_max": 0.5769666666666667, + "direction_drift_packet_mean": 0.38969999999999994, + "direction_drift_packet_median": 0.4383333333333334, + "direction_drift_packet_trimmed10_mean": 0.34213333333333334, + "direction_drift_total": 0.4194, + "flow_consistency": 0.8318666666666666, + "jacobian_flow": 0.31620000000000004, + "jacobian_packet": 0.34186666666666665, + "jacobian_total": 0.14696666666666663, + "kappa2_speed2norm_packet_mean": 0.6293333333333333, + "kappa2_speed2norm_packet_median": 0.5177999999999999, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5840666666666667, + "kinetic_energy": 0.9435666666666667, + "kinetic_flow": 0.9057666666666666, + "kinetic_packet": 0.9586666666666667, + "packet_consistency": 0.8416666666666667, + "pna_flow": 0.18083333333333332, + "pna_packet_max": 0.7484666666666666, + "pna_packet_mean": 0.6293333333333333, + "pna_packet_median": 0.5177999999999999, + "pna_packet_trimmed10_mean": 0.5840666666666667, + "terminal_flow": 0.8802666666666668, + "terminal_norm": 0.9318333333333333, + "terminal_packet": 0.9313, + "velocity_flow": 0.8808666666666667, + "velocity_flow_t01": 0.8616333333333334, + "velocity_flow_t03": 0.8652333333333333, + "velocity_flow_t05": 0.8711, + "velocity_flow_t07": 0.8772666666666666, + "velocity_flow_t09": 0.8816333333333333, + "velocity_flow_t10": 0.8824, + "velocity_packet": 0.9137333333333333, + "velocity_packet_t01": 0.9291333333333334, + "velocity_packet_t03": 0.9329333333333334, + "velocity_packet_t05": 0.9361666666666667, + "velocity_packet_t07": 0.9360333333333334, + "velocity_packet_t09": 0.8374666666666667, + "velocity_packet_t10": 0.8682666666666667, + "velocity_total": 0.89, + "velocity_total_t01": 0.8869333333333334, + "velocity_total_t03": 0.8893666666666666, + "velocity_total_t05": 0.8951, + "velocity_total_t07": 0.8964, + "velocity_total_t09": 0.8662000000000001, + "velocity_total_t10": 0.8706666666666666 + }, + "recon-portscan": { + "_n": 397.0, + "arc_length": 0.8966518891687658, + "causal_surprisal_flow": 0.391567758186398, + "causal_surprisal_packet_max": 0.5733148614609572, + "causal_surprisal_packet_mean": 0.6059088161209069, + "causal_surprisal_packet_median": 0.6140942065491185, + "causal_surprisal_packet_trimmed10_mean": 0.610592443324937, + "causal_surprisal_total": 0.4268581863979849, + "consistency_total": 0.8549113350125944, + "curvature_flow": 0.3642629722921914, + "curvature_packet": 0.8839823677581864, + "curvature_total": 0.839023677581864, + "direction_drift_flow": 0.225744080604534, + "direction_drift_packet_max": 0.32426448362720406, + "direction_drift_packet_mean": 0.24570931989924433, + "direction_drift_packet_median": 0.25329471032745593, + "direction_drift_packet_trimmed10_mean": 0.25971914357682624, + "direction_drift_total": 0.1762337531486146, + "flow_consistency": 0.8490188916876575, + "jacobian_flow": 0.39738236775818647, + "jacobian_packet": 0.7474725440806046, + "jacobian_total": 0.6678634760705289, + "kappa2_speed2norm_packet_mean": 0.6914100755667506, + "kappa2_speed2norm_packet_median": 0.7021884130982368, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7046609571788414, + "kinetic_energy": 0.8968261964735517, + "kinetic_flow": 0.7963027707808564, + "kinetic_packet": 0.8920418136020151, + "packet_consistency": 0.8043068010075568, + "pna_flow": 0.1578221662468514, + "pna_packet_max": 0.6760705289672544, + "pna_packet_mean": 0.6914100755667506, + "pna_packet_median": 0.7021884130982368, + "pna_packet_trimmed10_mean": 0.7046609571788414, + "terminal_flow": 0.9075586901763223, + "terminal_norm": 0.9200025188916876, + "terminal_packet": 0.9046231738035265, + "velocity_flow": 0.787221662468514, + "velocity_flow_t01": 0.602134508816121, + "velocity_flow_t03": 0.6577697732997482, + "velocity_flow_t05": 0.760606549118388, + "velocity_flow_t07": 0.7879607052896724, + "velocity_flow_t09": 0.811837783375315, + "velocity_flow_t10": 0.794601007556675, + "velocity_packet": 0.8601254408060454, + "velocity_packet_t01": 0.836312846347607, + "velocity_packet_t03": 0.8422770780856423, + "velocity_packet_t05": 0.8455803526448363, + "velocity_packet_t07": 0.8513141057934508, + "velocity_packet_t09": 0.8646906801007557, + "velocity_packet_t10": 0.8423969773299749, + "velocity_total": 0.8641103274559194, + "velocity_total_t01": 0.7757566750629723, + "velocity_total_t03": 0.7908483627204033, + "velocity_total_t05": 0.8258921914357682, + "velocity_total_t07": 0.861983879093199, + "velocity_total_t09": 0.884198992443325, + "velocity_total_t10": 0.8710216624685139 + }, + "sqlinjection": { + "_n": 15.0, + "arc_length": 0.7316133333333333, + "causal_surprisal_flow": 0.4982266666666667, + "causal_surprisal_packet_max": 0.3888666666666667, + "causal_surprisal_packet_mean": 0.42608, + "causal_surprisal_packet_median": 0.43532000000000004, + "causal_surprisal_packet_trimmed10_mean": 0.43034666666666666, + "causal_surprisal_total": 0.5009733333333333, + "consistency_total": 0.6849333333333334, + "curvature_flow": 0.5092399999999999, + "curvature_packet": 0.46653333333333336, + "curvature_total": 0.49156, + "direction_drift_flow": 0.24934666666666663, + "direction_drift_packet_max": 0.405, + "direction_drift_packet_mean": 0.4534266666666667, + "direction_drift_packet_median": 0.46588, + "direction_drift_packet_trimmed10_mean": 0.4669066666666667, + "direction_drift_total": 0.32956, + "flow_consistency": 0.7387466666666667, + "jacobian_flow": 0.47052, + "jacobian_packet": 0.3861066666666667, + "jacobian_total": 0.5464800000000001, + "kappa2_speed2norm_packet_mean": 0.40535999999999994, + "kappa2_speed2norm_packet_median": 0.43551999999999996, + "kappa2_speed2norm_packet_trimmed10_mean": 0.41190666666666664, + "kinetic_energy": 0.7316133333333334, + "kinetic_flow": 0.7176133333333333, + "kinetic_packet": 0.6213333333333333, + "packet_consistency": 0.44236, + "pna_flow": 0.38267999999999996, + "pna_packet_max": 0.3760133333333333, + "pna_packet_mean": 0.40535999999999994, + "pna_packet_median": 0.43551999999999996, + "pna_packet_trimmed10_mean": 0.41190666666666664, + "terminal_flow": 0.8285733333333334, + "terminal_norm": 0.7997466666666668, + "terminal_packet": 0.681, + "velocity_flow": 0.7252400000000001, + "velocity_flow_t01": 0.6566666666666667, + "velocity_flow_t03": 0.6704933333333334, + "velocity_flow_t05": 0.6758933333333333, + "velocity_flow_t07": 0.7079866666666667, + "velocity_flow_t09": 0.7457066666666667, + "velocity_flow_t10": 0.6711733333333334, + "velocity_packet": 0.5592933333333333, + "velocity_packet_t01": 0.49672000000000005, + "velocity_packet_t03": 0.4928666666666667, + "velocity_packet_t05": 0.4854, + "velocity_packet_t07": 0.4778, + "velocity_packet_t09": 0.5285733333333333, + "velocity_packet_t10": 0.6302000000000001, + "velocity_total": 0.7289599999999999, + "velocity_total_t01": 0.6292266666666667, + "velocity_total_t03": 0.6398133333333333, + "velocity_total_t05": 0.6522533333333334, + "velocity_total_t07": 0.68556, + "velocity_total_t09": 0.7424, + "velocity_total_t10": 0.6742266666666666 + }, + "uploading_attack": { + "_n": 5.0, + "arc_length": 0.7674000000000001, + "causal_surprisal_flow": 0.46576, + "causal_surprisal_packet_max": 0.40816, + "causal_surprisal_packet_mean": 0.43564, + "causal_surprisal_packet_median": 0.45168, + "causal_surprisal_packet_trimmed10_mean": 0.43988000000000005, + "causal_surprisal_total": 0.59428, + "consistency_total": 0.83064, + "curvature_flow": 0.64944, + "curvature_packet": 0.6099600000000001, + "curvature_total": 0.667, + "direction_drift_flow": 0.32087999999999994, + "direction_drift_packet_max": 0.10220000000000001, + "direction_drift_packet_mean": 0.15699999999999997, + "direction_drift_packet_median": 0.16576000000000002, + "direction_drift_packet_trimmed10_mean": 0.19908000000000003, + "direction_drift_total": 0.10624000000000003, + "flow_consistency": 0.8879600000000001, + "jacobian_flow": 0.41328000000000004, + "jacobian_packet": 0.43300000000000005, + "jacobian_total": 0.57128, + "kappa2_speed2norm_packet_mean": 0.44087999999999994, + "kappa2_speed2norm_packet_median": 0.44488000000000005, + "kappa2_speed2norm_packet_trimmed10_mean": 0.45484, + "kinetic_energy": 0.7642, + "kinetic_flow": 0.6466000000000001, + "kinetic_packet": 0.69648, + "packet_consistency": 0.3792, + "pna_flow": 0.35384000000000004, + "pna_packet_max": 0.35728000000000004, + "pna_packet_mean": 0.44087999999999994, + "pna_packet_median": 0.44488000000000005, + "pna_packet_trimmed10_mean": 0.45484, + "terminal_flow": 0.6998, + "terminal_norm": 0.7534400000000001, + "terminal_packet": 0.7196799999999999, + "velocity_flow": 0.67448, + "velocity_flow_t01": 0.44936, + "velocity_flow_t03": 0.49084, + "velocity_flow_t05": 0.64584, + "velocity_flow_t07": 0.66628, + "velocity_flow_t09": 0.72168, + "velocity_flow_t10": 0.70608, + "velocity_packet": 0.54748, + "velocity_packet_t01": 0.39476, + "velocity_packet_t03": 0.41991999999999996, + "velocity_packet_t05": 0.45244, + "velocity_packet_t07": 0.48356, + "velocity_packet_t09": 0.62304, + "velocity_packet_t10": 0.67232, + "velocity_total": 0.71992, + "velocity_total_t01": 0.4875999999999999, + "velocity_total_t03": 0.54628, + "velocity_total_t05": 0.63184, + "velocity_total_t07": 0.6916800000000001, + "velocity_total_t09": 0.75256, + "velocity_total_t10": 0.75096 + }, + "vulnerabilityscan": { + "_n": 598.0, + "arc_length": 0.7856765886287627, + "causal_surprisal_flow": 0.4063520066889632, + "causal_surprisal_packet_max": 0.4957617056856187, + "causal_surprisal_packet_mean": 0.5207244147157191, + "causal_surprisal_packet_median": 0.5354284280936455, + "causal_surprisal_packet_trimmed10_mean": 0.5250454849498327, + "causal_surprisal_total": 0.42875535117056857, + "consistency_total": 0.7013491638795986, + "curvature_flow": 0.4299073578595317, + "curvature_packet": 0.6609732441471571, + "curvature_total": 0.6441, + "direction_drift_flow": 0.27703478260869563, + "direction_drift_packet_max": 0.33079331103678933, + "direction_drift_packet_mean": 0.29226371237458193, + "direction_drift_packet_median": 0.28791872909698996, + "direction_drift_packet_trimmed10_mean": 0.29322123745819395, + "direction_drift_total": 0.2566578595317726, + "flow_consistency": 0.7063384615384616, + "jacobian_flow": 0.44535685618729093, + "jacobian_packet": 0.5865498327759197, + "jacobian_total": 0.557732441471572, + "kappa2_speed2norm_packet_mean": 0.526433110367893, + "kappa2_speed2norm_packet_median": 0.530109364548495, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5292013377926421, + "kinetic_energy": 0.7855648829431437, + "kinetic_flow": 0.7165906354515049, + "kinetic_packet": 0.7511391304347826, + "packet_consistency": 0.6232071906354515, + "pna_flow": 0.25227959866220734, + "pna_packet_max": 0.5172926421404682, + "pna_packet_mean": 0.526433110367893, + "pna_packet_median": 0.530109364548495, + "pna_packet_trimmed10_mean": 0.5292013377926421, + "terminal_flow": 0.7796230769230769, + "terminal_norm": 0.8108394648829431, + "terminal_packet": 0.7891207357859533, + "velocity_flow": 0.695866220735786, + "velocity_flow_t01": 0.5573060200668897, + "velocity_flow_t03": 0.5745678929765886, + "velocity_flow_t05": 0.6337933110367893, + "velocity_flow_t07": 0.6733769230769231, + "velocity_flow_t09": 0.7215150501672241, + "velocity_flow_t10": 0.725347491638796, + "velocity_packet": 0.7142224080267559, + "velocity_packet_t01": 0.6707802675585283, + "velocity_packet_t03": 0.6758153846153845, + "velocity_packet_t05": 0.6816230769230769, + "velocity_packet_t07": 0.6891207357859531, + "velocity_packet_t09": 0.7121792642140468, + "velocity_packet_t10": 0.7301710702341138, + "velocity_total": 0.7414331103678931, + "velocity_total_t01": 0.6508886287625418, + "velocity_total_t03": 0.6584498327759197, + "velocity_total_t05": 0.6763508361204014, + "velocity_total_t07": 0.7112088628762541, + "velocity_total_t09": 0.7653120401337793, + "velocity_total_t10": 0.765196321070234 + }, + "xss": { + "_n": 11.0, + "arc_length": 0.8147636363636364, + "causal_surprisal_flow": 0.6024727272727273, + "causal_surprisal_packet_max": 0.40152727272727273, + "causal_surprisal_packet_mean": 0.4101272727272727, + "causal_surprisal_packet_median": 0.43399999999999994, + "causal_surprisal_packet_trimmed10_mean": 0.4227818181818182, + "causal_surprisal_total": 0.5947818181818181, + "consistency_total": 0.6802909090909091, + "curvature_flow": 0.5728545454545455, + "curvature_packet": 0.7222363636363637, + "curvature_total": 0.696509090909091, + "direction_drift_flow": 0.24616363636363636, + "direction_drift_packet_max": 0.2616545454545455, + "direction_drift_packet_mean": 0.28481818181818186, + "direction_drift_packet_median": 0.2872, + "direction_drift_packet_trimmed10_mean": 0.3098181818181818, + "direction_drift_total": 0.18758181818181818, + "flow_consistency": 0.7319818181818183, + "jacobian_flow": 0.2691454545454546, + "jacobian_packet": 0.4555272727272727, + "jacobian_total": 0.3155636363636363, + "kappa2_speed2norm_packet_mean": 0.5504545454545454, + "kappa2_speed2norm_packet_median": 0.572490909090909, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5578363636363636, + "kinetic_energy": 0.8134363636363636, + "kinetic_flow": 0.7506545454545455, + "kinetic_packet": 0.6679272727272728, + "packet_consistency": 0.4978181818181818, + "pna_flow": 0.22241818181818182, + "pna_packet_max": 0.5084909090909091, + "pna_packet_mean": 0.5504545454545454, + "pna_packet_median": 0.572490909090909, + "pna_packet_trimmed10_mean": 0.5578363636363636, + "terminal_flow": 0.8549454545454547, + "terminal_norm": 0.8882363636363637, + "terminal_packet": 0.7410545454545454, + "velocity_flow": 0.7809090909090909, + "velocity_flow_t01": 0.6355818181818182, + "velocity_flow_t03": 0.6852181818181818, + "velocity_flow_t05": 0.7397636363636364, + "velocity_flow_t07": 0.7677090909090909, + "velocity_flow_t09": 0.8133090909090909, + "velocity_flow_t10": 0.8034181818181818, + "velocity_packet": 0.7096181818181818, + "velocity_packet_t01": 0.6469272727272727, + "velocity_packet_t03": 0.6611090909090909, + "velocity_packet_t05": 0.6734363636363636, + "velocity_packet_t07": 0.7027090909090908, + "velocity_packet_t09": 0.7069090909090909, + "velocity_packet_t10": 0.6933090909090909, + "velocity_total": 0.7880363636363636, + "velocity_total_t01": 0.6776, + "velocity_total_t03": 0.7237818181818183, + "velocity_total_t05": 0.7462909090909091, + "velocity_total_t07": 0.7796727272727273, + "velocity_total_t09": 0.8396181818181818, + "velocity_total_t10": 0.8010909090909091 + } + }, + "classes": [ + "backdoor_malware", + "browserhijacking", + "commandinjection", + "ddos-ack_fragmentation", + "ddos-http_flood", + "ddos-icmp_flood", + "ddos-icmp_fragmentation", + "ddos-pshack_flood", + "ddos-rstfinflood", + "ddos-slowloris", + "ddos-syn_flood", + "ddos-synonymousip_flood", + "ddos-tcp_flood", + "ddos-udp_flood", + "ddos-udp_fragmentation", + "dictionarybruteforce", + "dns_spoofing", + "dos-http_flood", + "dos-syn_flood", + "dos-tcp_flood", + "dos-udp_flood", + "mirai-greeth_flood", + "mirai-greip_flood", + "mirai-udpplain", + "mitm-arpspoofing", + "recon-hostdiscovery", + "recon-osscan", + "recon-pingsweep", + "recon-portscan", + "sqlinjection", + "uploading_attack", + "vulnerabilityscan", + "xss" + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/config.yaml b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/config.yaml new file mode 100644 index 0000000..8f6051c --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/config.yaml @@ -0,0 +1,35 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 42 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 10000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42 +seed: 42 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 20000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/history.json b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/history.json new file mode 100644 index 0000000..91d2230 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.2867102195055058, + 0.9259555905293195, + 0.7255043738927597, + 0.6166488222586803, + 0.5367347674492078, + 0.48945341813258636, + 0.4528657526541979, + 0.4244499542774298, + 0.3960287013115027, + 0.37846705393913466, + 0.3633267084757487, + 0.3543014312401796, + 0.34729172862493074, + 0.3343265148309561, + 0.32876198643293136, + 0.325213298583642, + 0.31610122934365886, + 0.31690118480951357, + 0.31219814603145307, + 0.306425684537643, + 0.3051931025126042, + 0.3030571249815134, + 0.2957018101826692, + 0.2938763812566415, + 0.29065050681432086, + 0.29242547200276303, + 0.28463515639305115, + 0.2877236757522974, + 0.2820634383421678, + 0.2816112904976576, + 0.28045241649334246, + 0.2783871048536056, + 0.2756313983446512, + 0.271827302300013, + 0.2772192053305797, + 0.27175478828259003, + 0.27257580482042754, + 0.2737694902297778, + 0.27068638228453124, + 0.27124750193877095, + 0.26755956541269255, + 0.2703365221237525, + 0.26722864195322377, + 0.2664863597124051, + 0.2673849845543886, + 0.2680678726770939, + 0.2657894423374763, + 0.2658129834975952, + 0.26694354529564196, + 0.266000271989749 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.39263521, + "auroc_disc_nll_ch3": 0.7204111849999999, + "auroc_disc_nll_ch4": 0.524783235, + "auroc_disc_nll_ch5": 0.7346909500000001, + "auroc_disc_nll_ch6": 0.46576689999999993, + "auroc_disc_nll_ch7": 0.9127441500000001, + "auroc_disc_nll_total": 0.6153175799999999, + "auroc_terminal_flow": 0.95261315, + "auroc_terminal_norm": 0.989163385, + "auroc_terminal_packet": 0.95109096 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.35209663999999996, + "auroc_disc_nll_ch3": 0.36715701, + "auroc_disc_nll_ch4": 0.369342615, + "auroc_disc_nll_ch5": 0.41380857, + "auroc_disc_nll_ch6": 0.49564555, + "auroc_disc_nll_ch7": 0.93700457, + "auroc_disc_nll_total": 0.53736814, + "auroc_terminal_flow": 0.96274213, + "auroc_terminal_norm": 0.99508461, + "auroc_terminal_packet": 0.99054971 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.34159879, + "auroc_disc_nll_ch3": 0.302726735, + "auroc_disc_nll_ch4": 0.46510658999999993, + "auroc_disc_nll_ch5": 0.40291992499999996, + "auroc_disc_nll_ch6": 0.49749598, + "auroc_disc_nll_ch7": 0.899555405, + "auroc_disc_nll_total": 0.52993183, + "auroc_terminal_flow": 0.95852129, + "auroc_terminal_norm": 0.996111615, + "auroc_terminal_packet": 0.9732752100000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.32931716, + "auroc_disc_nll_ch3": 0.294504415, + "auroc_disc_nll_ch4": 0.47051976, + "auroc_disc_nll_ch5": 0.34378916, + "auroc_disc_nll_ch6": 0.49698177999999993, + "auroc_disc_nll_ch7": 0.90775334, + "auroc_disc_nll_total": 0.530556795, + "auroc_terminal_flow": 0.9573868600000001, + "auroc_terminal_norm": 0.99628893, + "auroc_terminal_packet": 0.9871727 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.33850926000000003, + "auroc_disc_nll_ch3": 0.302667, + "auroc_disc_nll_ch4": 0.47164958500000004, + "auroc_disc_nll_ch5": 0.33830547, + "auroc_disc_nll_ch6": 0.47829309999999997, + "auroc_disc_nll_ch7": 0.90518176, + "auroc_disc_nll_total": 0.52709052, + "auroc_terminal_flow": 0.9580024, + "auroc_terminal_norm": 0.9967448199999999, + "auroc_terminal_packet": 0.99121509 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/model.pt b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/model.pt new file mode 100644 index 0000000..04389bd Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/model.pt differ diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/phase1.log b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/phase1.log new file mode 100644 index 0000000..60ce74a --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/phase1.log @@ -0,0 +1,69 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store +[data] kept 8,986,875 of 8,993,376 (min_len=2) +[data] train=74,565 val=18,642 attack=20,000 +[data] val=18,642 attack=20,000 +[eval] scoring val=5,000 atk=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.1s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] atk done 3.6s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/phase1_scores.npz b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/phase1_scores.npz new file mode 100644 index 0000000..d8119b2 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/phase1_summary.json b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/phase1_summary.json new file mode 100644 index 0000000..5a4762e --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed42/phase1_summary.json @@ -0,0 +1,267 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.3354939600000001, + "auprc": 0.5921669236120197 + }, + "disc_nll_ch3": { + "auroc": 0.29844436, + "auprc": 0.6488406012275032 + }, + "disc_nll_ch4": { + "auroc": 0.47456553999999995, + "auprc": 0.6272500695614571 + }, + "disc_nll_ch5": { + "auroc": 0.33494518, + "auprc": 0.603041362273659 + }, + "disc_nll_ch6": { + "auroc": 0.48660410000000004, + "auprc": 0.6066516665195917 + }, + "disc_nll_ch7": { + "auroc": 0.9066705400000001, + "auprc": 0.9486834925559745 + }, + "disc_nll_total": { + "auroc": 0.53367302, + "auprc": 0.7233000706321784 + }, + "terminal_flow": { + "auroc": 0.96264299, + "auprc": 0.9769593787046147 + }, + "terminal_norm": { + "auroc": 0.9966167600000001, + "auprc": 0.9978712229914865 + }, + "terminal_packet": { + "auroc": 0.9900809, + "auprc": 0.9940485831150678 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 591.0, + "disc_nll_ch2": 0.23216311336717432, + "disc_nll_ch3": 0.05535905245346874, + "disc_nll_ch4": 0.3866331641285956, + "disc_nll_ch5": 0.023546531302876476, + "disc_nll_ch6": 0.4629292724196277, + "disc_nll_ch7": 0.9783424703891709, + "disc_nll_total": 0.4649011844331642, + "terminal_flow": 0.9938458544839256, + "terminal_norm": 0.9989438240270728, + "terminal_packet": 0.9980774957698815 + }, + "DrDoS_LDAP": { + "_n": 558.0, + "disc_nll_ch2": 0.229241935483871, + "disc_nll_ch3": 0.05410860215053768, + "disc_nll_ch4": 0.38217025089605733, + "disc_nll_ch5": 3.5842293906806087e-07, + "disc_nll_ch6": 0.45495519713261645, + "disc_nll_ch7": 0.9815935483870968, + "disc_nll_total": 0.4614706093189964, + "terminal_flow": 0.999000358422939, + "terminal_norm": 1.0, + "terminal_packet": 1.0 + }, + "DrDoS_MSSQL": { + "_n": 594.0, + "disc_nll_ch2": 0.2231124579124579, + "disc_nll_ch3": 0.048455555555555564, + "disc_nll_ch4": 0.3949993265993266, + "disc_nll_ch5": 0.010602356902356901, + "disc_nll_ch6": 0.5144488215488215, + "disc_nll_ch7": 0.9788474747474748, + "disc_nll_total": 0.44722592592592586, + "terminal_flow": 0.9905353535353535, + "terminal_norm": 0.9996161616161617, + "terminal_packet": 0.9989760942760944 + }, + "DrDoS_NTP": { + "_n": 580.0, + "disc_nll_ch2": 0.8528058620689655, + "disc_nll_ch3": 0.3423875862068966, + "disc_nll_ch4": 0.2634779310344827, + "disc_nll_ch5": 0.38799620689655173, + "disc_nll_ch6": 0.43581275862068963, + "disc_nll_ch7": 0.5935237931034483, + "disc_nll_total": 0.49817896551724145, + "terminal_flow": 0.9889189655172412, + "terminal_norm": 0.9839568965517241, + "terminal_packet": 0.9752437931034482 + }, + "DrDoS_NetBIOS": { + "_n": 597.0, + "disc_nll_ch2": 0.22025058626465666, + "disc_nll_ch3": 0.033857621440536015, + "disc_nll_ch4": 0.4467430485762144, + "disc_nll_ch5": 0.505534338358459, + "disc_nll_ch6": 0.5824582914572864, + "disc_nll_ch7": 0.9787932998324957, + "disc_nll_total": 0.44800569514237853, + "terminal_flow": 0.9678291457286433, + "terminal_norm": 0.9971832495812396, + "terminal_packet": 0.9710435510887773 + }, + "DrDoS_SNMP": { + "_n": 565.0, + "disc_nll_ch2": 0.22891008849557526, + "disc_nll_ch3": 0.05291646017699119, + "disc_nll_ch4": 0.385938407079646, + "disc_nll_ch5": 0.026261946902654865, + "disc_nll_ch6": 0.4621706194690266, + "disc_nll_ch7": 0.9814322123893805, + "disc_nll_total": 0.46066513274336285, + "terminal_flow": 0.9973001769911505, + "terminal_norm": 0.9998463716814159, + "terminal_packet": 0.9984095575221239 + }, + "DrDoS_SSDP": { + "_n": 523.0, + "disc_nll_ch2": 0.5039059273422563, + "disc_nll_ch3": 0.2262868068833652, + "disc_nll_ch4": 0.3964573613766731, + "disc_nll_ch5": 0.27281759082217977, + "disc_nll_ch6": 0.4911089866156788, + "disc_nll_ch7": 0.7498917782026768, + "disc_nll_total": 0.37254722753346076, + "terminal_flow": 0.9868527724665392, + "terminal_norm": 0.9971258126195028, + "terminal_packet": 0.9839151051625239 + }, + "DrDoS_UDP": { + "_n": 534.0, + "disc_nll_ch2": 0.5112441947565544, + "disc_nll_ch3": 0.2317295880149813, + "disc_nll_ch4": 0.3952258426966292, + "disc_nll_ch5": 0.2786295880149813, + "disc_nll_ch6": 0.49047528089887643, + "disc_nll_ch7": 0.7437022471910112, + "disc_nll_total": 0.3707895131086142, + "terminal_flow": 0.987692883895131, + "terminal_norm": 0.9973033707865169, + "terminal_packet": 0.9838898876404495 + }, + "LDAP": { + "_n": 560.0, + "disc_nll_ch2": 0.2302339285714286, + "disc_nll_ch3": 0.05413857142857147, + "disc_nll_ch4": 0.3822210714285714, + "disc_nll_ch5": 1.7857142857142874e-06, + "disc_nll_ch6": 0.45496749999999997, + "disc_nll_ch7": 0.9815896428571429, + "disc_nll_total": 0.4614882142857143, + "terminal_flow": 0.9989975, + "terminal_norm": 0.9999996428571429, + "terminal_packet": 1.0 + }, + "MSSQL": { + "_n": 598.0, + "disc_nll_ch2": 0.2232150501672241, + "disc_nll_ch3": 0.048527090301003356, + "disc_nll_ch4": 0.3954705685618729, + "disc_nll_ch5": 0.011083946488294314, + "disc_nll_ch6": 0.5164742474916388, + "disc_nll_ch7": 0.9788391304347825, + "disc_nll_total": 0.4473100334448161, + "terminal_flow": 0.9904448160535118, + "terminal_norm": 0.999600668896321, + "terminal_packet": 0.9989247491638795 + }, + "NetBIOS": { + "_n": 782.0, + "disc_nll_ch2": 0.22109718670076728, + "disc_nll_ch3": 0.03457902813299233, + "disc_nll_ch4": 0.44511304347826086, + "disc_nll_ch5": 0.5074281329923274, + "disc_nll_ch6": 0.5796626598465473, + "disc_nll_ch7": 0.9785764705882353, + "disc_nll_total": 0.44754322250639383, + "terminal_flow": 0.9682386189258312, + "terminal_norm": 0.9972097186700767, + "terminal_packet": 0.9706010230179029 + }, + "Portmap": { + "_n": 202.0, + "disc_nll_ch2": 0.22036336633663367, + "disc_nll_ch3": 0.03382376237623763, + "disc_nll_ch4": 0.44596336633663364, + "disc_nll_ch5": 0.5076019801980198, + "disc_nll_ch6": 0.5826108910891089, + "disc_nll_ch7": 0.9787980198019802, + "disc_nll_total": 0.4479544554455445, + "terminal_flow": 0.9685366336633663, + "terminal_norm": 0.9972772277227722, + "terminal_packet": 0.9722039603960396 + }, + "Syn": { + "_n": 1669.0, + "disc_nll_ch2": 0.3040408627920911, + "disc_nll_ch3": 0.9912909526662673, + "disc_nll_ch4": 0.8076360695026962, + "disc_nll_ch5": 0.8229303774715399, + "disc_nll_ch6": 0.45070557219892154, + "disc_nll_ch7": 0.9948764529658478, + "disc_nll_total": 0.9803869382863991, + "terminal_flow": 0.866658058717795, + "terminal_norm": 0.9935122828040743, + "terminal_packet": 0.9980496105452368 + }, + "TFTP": { + "_n": 534.0, + "disc_nll_ch2": 0.4310722846441947, + "disc_nll_ch3": 0.24674756554307115, + "disc_nll_ch4": 0.39273520599250933, + "disc_nll_ch5": 0.24612322097378275, + "disc_nll_ch6": 0.4783992509363296, + "disc_nll_ch7": 0.7648513108614232, + "disc_nll_total": 0.2210187265917603, + "terminal_flow": 0.9895082397003745, + "terminal_norm": 0.9988, + "terminal_packet": 0.9952846441947565 + }, + "UDP": { + "_n": 688.0, + "disc_nll_ch2": 0.5122622093023256, + "disc_nll_ch3": 0.2333191860465116, + "disc_nll_ch4": 0.3948258720930233, + "disc_nll_ch5": 0.2799293604651163, + "disc_nll_ch6": 0.49064505813953485, + "disc_nll_ch7": 0.7421058139534884, + "disc_nll_total": 0.37338837209302317, + "terminal_flow": 0.9876043604651163, + "terminal_norm": 0.9973468023255814, + "terminal_packet": 0.9837674418604652 + }, + "UDPLag": { + "_n": 424.0, + "disc_nll_ch2": 0.22479669811320757, + "disc_nll_ch3": 0.8535471698113208, + "disc_nll_ch4": 0.6942009433962264, + "disc_nll_ch5": 0.6882457547169812, + "disc_nll_ch6": 0.4055627358490566, + "disc_nll_ch7": 0.9645641509433962, + "disc_nll_total": 0.8274952830188678, + "terminal_flow": 0.8854705188679245, + "terminal_norm": 0.9939396226415094, + "terminal_packet": 0.9964929245283018 + }, + "WebDDoS": { + "_n": 1.0, + "disc_nll_ch2": 0.07499999999999996, + "disc_nll_ch3": 0.09860000000000002, + "disc_nll_ch4": 0.9540000000000001, + "disc_nll_ch5": 0.8044, + "disc_nll_ch6": 0.7807999999999999, + "disc_nll_ch7": 0.494, + "disc_nll_total": 0.8686, + "terminal_flow": 0.5606, + "terminal_norm": 0.8712, + "terminal_packet": 0.7888 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/config.yaml b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/config.yaml new file mode 100644 index 0000000..b504d72 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/config.yaml @@ -0,0 +1,35 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 43 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 10000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43 +seed: 43 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 20000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/history.json b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/history.json new file mode 100644 index 0000000..0adc619 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.292019275518564, + 0.9199725542313013, + 0.7198571379368122, + 0.6052226714598827, + 0.5306343627281678, + 0.48145763155741567, + 0.4433212471313966, + 0.40839537061177766, + 0.38595986901185453, + 0.3686484014376616, + 0.3568838651363666, + 0.34453539817761153, + 0.3348421423863142, + 0.32274278692710096, + 0.32236637060458845, + 0.321748822927475, + 0.31312593817710876, + 0.30795446725992054, + 0.30514584214259416, + 0.30005958065008503, + 0.29298710975891507, + 0.29423417494847226, + 0.2915426744864537, + 0.28490148675747407, + 0.2844085892041524, + 0.2817957653449132, + 0.28163484808726186, + 0.2796165148417155, + 0.2763595176048768, + 0.2757503470549217, + 0.2748816586457766, + 0.275011685414192, + 0.2737867541802235, + 0.2719273968384816, + 0.27157718363480693, + 0.2684976768035155, + 0.2674804268739162, + 0.2636256836927854, + 0.26406865280408126, + 0.2653296784712718, + 0.26404650738606084, + 0.2637033279125507, + 0.26317251722017926, + 0.26497337031058776, + 0.2628246870560524, + 0.26198008962166613, + 0.2627824311837172, + 0.26519573346162456, + 0.26318935132943666, + 0.2614043748531586 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.39134297500000004, + "auroc_disc_nll_ch3": 0.562873315, + "auroc_disc_nll_ch4": 0.6391259549999999, + "auroc_disc_nll_ch5": 0.7562952799999999, + "auroc_disc_nll_ch6": 0.53289239, + "auroc_disc_nll_ch7": 0.95805768, + "auroc_disc_nll_total": 0.7581600949999999, + "auroc_terminal_flow": 0.962523125, + "auroc_terminal_norm": 0.994744985, + "auroc_terminal_packet": 0.9807274150000002 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.35549085999999996, + "auroc_disc_nll_ch3": 0.288879945, + "auroc_disc_nll_ch4": 0.593980775, + "auroc_disc_nll_ch5": 0.673292895, + "auroc_disc_nll_ch6": 0.6259145049999999, + "auroc_disc_nll_ch7": 0.9753305750000001, + "auroc_disc_nll_total": 0.6582634700000001, + "auroc_terminal_flow": 0.9682759299999999, + "auroc_terminal_norm": 0.9962453950000001, + "auroc_terminal_packet": 0.96445035 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.368361045, + "auroc_disc_nll_ch3": 0.244734515, + "auroc_disc_nll_ch4": 0.545350985, + "auroc_disc_nll_ch5": 0.526023805, + "auroc_disc_nll_ch6": 0.6085922650000001, + "auroc_disc_nll_ch7": 0.9703787799999999, + "auroc_disc_nll_total": 0.6431861050000001, + "auroc_terminal_flow": 0.9700757249999999, + "auroc_terminal_norm": 0.997424975, + "auroc_terminal_packet": 0.989577425 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.370635995, + "auroc_disc_nll_ch3": 0.263518175, + "auroc_disc_nll_ch4": 0.524727395, + "auroc_disc_nll_ch5": 0.46008479999999996, + "auroc_disc_nll_ch6": 0.5846083950000001, + "auroc_disc_nll_ch7": 0.956539065, + "auroc_disc_nll_total": 0.608777655, + "auroc_terminal_flow": 0.969026925, + "auroc_terminal_norm": 0.997618335, + "auroc_terminal_packet": 0.9908442949999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.364496825, + "auroc_disc_nll_ch3": 0.26151858, + "auroc_disc_nll_ch4": 0.527358085, + "auroc_disc_nll_ch5": 0.45979756000000005, + "auroc_disc_nll_ch6": 0.5830140749999999, + "auroc_disc_nll_ch7": 0.961862625, + "auroc_disc_nll_total": 0.620387465, + "auroc_terminal_flow": 0.97017764, + "auroc_terminal_norm": 0.997642915, + "auroc_terminal_packet": 0.9912573100000001 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/model.pt b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/model.pt new file mode 100644 index 0000000..39de049 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/model.pt differ diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/phase1.log b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/phase1.log new file mode 100644 index 0000000..3e4282a --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/phase1.log @@ -0,0 +1,69 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store +[data] kept 8,986,875 of 8,993,376 (min_len=2) +[data] train=74,565 val=18,642 attack=20,000 +[data] val=18,642 attack=20,000 +[eval] scoring val=5,000 atk=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.1s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] atk done 3.5s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/phase1_scores.npz b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/phase1_scores.npz new file mode 100644 index 0000000..41d6863 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/phase1_summary.json b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/phase1_summary.json new file mode 100644 index 0000000..dd9cda5 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed43/phase1_summary.json @@ -0,0 +1,267 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.35770712000000005, + "auprc": 0.6196391032025506 + }, + "disc_nll_ch3": { + "auroc": 0.26155155, + "auprc": 0.6336983220281424 + }, + "disc_nll_ch4": { + "auroc": 0.52921511, + "auprc": 0.6518213057955972 + }, + "disc_nll_ch5": { + "auroc": 0.46132491, + "auprc": 0.6314887985302501 + }, + "disc_nll_ch6": { + "auroc": 0.5832963899999999, + "auprc": 0.6651475490482732 + }, + "disc_nll_ch7": { + "auroc": 0.96352865, + "auprc": 0.976524980458189 + }, + "disc_nll_total": { + "auroc": 0.61885569, + "auprc": 0.7603222835374643 + }, + "terminal_flow": { + "auroc": 0.9687688300000001, + "auprc": 0.9798261992729617 + }, + "terminal_norm": { + "auroc": 0.9976998700000002, + "auprc": 0.9985156120663065 + }, + "terminal_packet": { + "auroc": 0.99022646, + "auprc": 0.9945052446656589 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 577.0, + "disc_nll_ch2": 0.25582512998266904, + "disc_nll_ch3": 0.025704852686308517, + "disc_nll_ch4": 0.5049332755632583, + "disc_nll_ch5": 0.1848116117850953, + "disc_nll_ch6": 0.6915568457538994, + "disc_nll_ch7": 0.9903315424610053, + "disc_nll_total": 0.6302123050259965, + "terminal_flow": 0.9909811091854419, + "terminal_norm": 0.9983450606585789, + "terminal_packet": 0.9958396880415945 + }, + "DrDoS_LDAP": { + "_n": 560.0, + "disc_nll_ch2": 0.25460142857142865, + "disc_nll_ch3": 0.023265714285714313, + "disc_nll_ch4": 0.5010917857142857, + "disc_nll_ch5": 0.1577725, + "disc_nll_ch6": 0.6979128571428572, + "disc_nll_ch7": 0.9910982142857143, + "disc_nll_total": 0.6364264285714285, + "terminal_flow": 0.9995882142857142, + "terminal_norm": 1.0, + "terminal_packet": 1.0 + }, + "DrDoS_MSSQL": { + "_n": 595.0, + "disc_nll_ch2": 0.2392712605042017, + "disc_nll_ch3": 0.03954285714285714, + "disc_nll_ch4": 0.5175936134453781, + "disc_nll_ch5": 0.40614991596638655, + "disc_nll_ch6": 0.6765078991596638, + "disc_nll_ch7": 0.9880968067226891, + "disc_nll_total": 0.5103949579831933, + "terminal_flow": 0.9885989915966387, + "terminal_norm": 0.9996685714285715, + "terminal_packet": 0.9993489075630252 + }, + "DrDoS_NTP": { + "_n": 525.0, + "disc_nll_ch2": 0.9173173333333333, + "disc_nll_ch3": 0.22556685714285715, + "disc_nll_ch4": 0.14884228571428573, + "disc_nll_ch5": 0.28668800000000005, + "disc_nll_ch6": 0.4488449523809524, + "disc_nll_ch7": 0.9051028571428572, + "disc_nll_total": 0.6916518095238096, + "terminal_flow": 0.9875238095238095, + "terminal_norm": 0.9905565714285713, + "terminal_packet": 0.9905222857142857 + }, + "DrDoS_NetBIOS": { + "_n": 594.0, + "disc_nll_ch2": 0.23591986531986534, + "disc_nll_ch3": 0.05016936026936024, + "disc_nll_ch4": 0.5289144781144781, + "disc_nll_ch5": 0.5712087542087542, + "disc_nll_ch6": 0.6385902356902357, + "disc_nll_ch7": 0.9781693602693602, + "disc_nll_total": 0.4520188552188552, + "terminal_flow": 0.9650632996632995, + "terminal_norm": 0.9974835016835017, + "terminal_packet": 0.961803367003367 + }, + "DrDoS_SNMP": { + "_n": 613.0, + "disc_nll_ch2": 0.25341174551386625, + "disc_nll_ch3": 0.024731810766721058, + "disc_nll_ch4": 0.5026972267536705, + "disc_nll_ch5": 0.17815628058727567, + "disc_nll_ch6": 0.6944845024469821, + "disc_nll_ch7": 0.9904893964110929, + "disc_nll_total": 0.6287011419249592, + "terminal_flow": 0.9979141924959218, + "terminal_norm": 0.9998763458401305, + "terminal_packet": 0.9980218597063621 + }, + "DrDoS_SSDP": { + "_n": 526.0, + "disc_nll_ch2": 0.501762927756654, + "disc_nll_ch3": 0.13248821292775662, + "disc_nll_ch4": 0.4772277566539924, + "disc_nll_ch5": 0.5166513307984791, + "disc_nll_ch6": 0.5638783269961978, + "disc_nll_ch7": 0.8947482889733841, + "disc_nll_total": 0.46303916349809887, + "terminal_flow": 0.9843433460076045, + "terminal_norm": 0.9982969581749049, + "terminal_packet": 0.9889673003802281 + }, + "DrDoS_UDP": { + "_n": 533.0, + "disc_nll_ch2": 0.5296484052532833, + "disc_nll_ch3": 0.14416923076923074, + "disc_nll_ch4": 0.4693741088180112, + "disc_nll_ch5": 0.5264705440900562, + "disc_nll_ch6": 0.5533771106941839, + "disc_nll_ch7": 0.8765189493433396, + "disc_nll_total": 0.46013395872420265, + "terminal_flow": 0.9840975609756097, + "terminal_norm": 0.9980048780487805, + "terminal_packet": 0.9879279549718574 + }, + "LDAP": { + "_n": 607.0, + "disc_nll_ch2": 0.2555215815485997, + "disc_nll_ch3": 0.023216144975288337, + "disc_nll_ch4": 0.5010988467874794, + "disc_nll_ch5": 0.15782570016474468, + "disc_nll_ch6": 0.6985291598023065, + "disc_nll_ch7": 0.9911011532125206, + "disc_nll_total": 0.6364253706754531, + "terminal_flow": 0.9995848434925865, + "terminal_norm": 0.9999983525535421, + "terminal_packet": 0.9999993410214167 + }, + "MSSQL": { + "_n": 603.0, + "disc_nll_ch2": 0.24026036484245442, + "disc_nll_ch3": 0.04054427860696517, + "disc_nll_ch4": 0.5176235489220564, + "disc_nll_ch5": 0.41003946932006635, + "disc_nll_ch6": 0.6733257048092869, + "disc_nll_ch7": 0.9877661691542289, + "disc_nll_total": 0.5047114427860696, + "terminal_flow": 0.9881502487562188, + "terminal_norm": 0.9996474295190713, + "terminal_packet": 0.9993031509121062 + }, + "NetBIOS": { + "_n": 781.0, + "disc_nll_ch2": 0.23792548015364917, + "disc_nll_ch3": 0.05206606914212545, + "disc_nll_ch4": 0.5282699103713189, + "disc_nll_ch5": 0.5671779769526248, + "disc_nll_ch6": 0.6293912932138284, + "disc_nll_ch7": 0.9773510883482714, + "disc_nll_total": 0.45086402048655566, + "terminal_flow": 0.9647423815620998, + "terminal_norm": 0.9974384122919334, + "terminal_packet": 0.9596699103713189 + }, + "Portmap": { + "_n": 218.0, + "disc_nll_ch2": 0.23685045871559635, + "disc_nll_ch3": 0.05227522935779814, + "disc_nll_ch4": 0.5278137614678899, + "disc_nll_ch5": 0.5577688073394496, + "disc_nll_ch6": 0.6335944954128441, + "disc_nll_ch7": 0.9774568807339449, + "disc_nll_total": 0.45096146788990826, + "terminal_flow": 0.965856880733945, + "terminal_norm": 0.9975954128440367, + "terminal_packet": 0.9632064220183487 + }, + "Syn": { + "_n": 1643.0, + "disc_nll_ch2": 0.335349726110773, + "disc_nll_ch3": 0.9925760194765673, + "disc_nll_ch4": 0.7420673158855751, + "disc_nll_ch5": 0.7499811320754717, + "disc_nll_ch6": 0.4398259281801583, + "disc_nll_ch7": 0.9953011564211808, + "disc_nll_total": 0.9782463785757761, + "terminal_flow": 0.9042450395617773, + "terminal_norm": 0.9957881923311016, + "terminal_packet": 0.998465855143031 + }, + "TFTP": { + "_n": 558.0, + "disc_nll_ch2": 0.5224164874551971, + "disc_nll_ch3": 0.15011541218637994, + "disc_nll_ch4": 0.4987397849462366, + "disc_nll_ch5": 0.4817261648745519, + "disc_nll_ch6": 0.5459745519713262, + "disc_nll_ch7": 0.960873835125448, + "disc_nll_total": 0.467547311827957, + "terminal_flow": 0.9880064516129031, + "terminal_norm": 0.999125806451613, + "terminal_packet": 0.9970598566308244 + }, + "UDP": { + "_n": 658.0, + "disc_nll_ch2": 0.536376291793313, + "disc_nll_ch3": 0.14696261398176289, + "disc_nll_ch4": 0.4687674772036474, + "disc_nll_ch5": 0.5232547112462006, + "disc_nll_ch6": 0.549884802431611, + "disc_nll_ch7": 0.8752440729483282, + "disc_nll_total": 0.45878996960486323, + "terminal_flow": 0.9841759878419453, + "terminal_norm": 0.998041641337386, + "terminal_packet": 0.9874445288753799 + }, + "UDPLag": { + "_n": 408.0, + "disc_nll_ch2": 0.21630147058823535, + "disc_nll_ch3": 0.8633161764705883, + "disc_nll_ch4": 0.6366205882352942, + "disc_nll_ch5": 0.665346568627451, + "disc_nll_ch6": 0.3891509803921569, + "disc_nll_ch7": 0.9752980392156863, + "disc_nll_total": 0.8506578431372548, + "terminal_flow": 0.9083553921568628, + "terminal_norm": 0.9958401960784314, + "terminal_packet": 0.9969191176470588 + }, + "WebDDoS": { + "_n": 1.0, + "disc_nll_ch2": 0.11119999999999997, + "disc_nll_ch3": 0.11099999999999999, + "disc_nll_ch4": 0.9162000000000001, + "disc_nll_ch5": 0.8158, + "disc_nll_ch6": 0.7605999999999999, + "disc_nll_ch7": 0.831, + "disc_nll_total": 0.8324, + "terminal_flow": 0.39659999999999995, + "terminal_norm": 0.7704, + "terminal_packet": 0.7864 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/config.yaml b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/config.yaml new file mode 100644 index 0000000..7d83c68 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/config.yaml @@ -0,0 +1,35 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 44 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 10000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44 +seed: 44 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 20000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/history.json b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/history.json new file mode 100644 index 0000000..1497b1b --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.2950647672017415, + 0.9292161021477137, + 0.7341550772006695, + 0.6189395571366335, + 0.5469062832685617, + 0.5009240737328162, + 0.46859470773965883, + 0.44223650220112926, + 0.4250727211817717, + 0.400471840149317, + 0.3801739666706476, + 0.36493676136701536, + 0.35842125843732786, + 0.3490793575079013, + 0.3367219192859454, + 0.3317532692200098, + 0.3295025985974532, + 0.32378773047373843, + 0.3208198960010822, + 0.30969652380698764, + 0.31199456331057424, + 0.3069333969018398, + 0.306467633216809, + 0.2998343690847739, + 0.29911144574483234, + 0.29594746766946256, + 0.2926397422949473, + 0.2944170328286978, + 0.28953974139996064, + 0.28738407981701386, + 0.28610873298767286, + 0.28543443710376054, + 0.2822232735462678, + 0.28180241890442675, + 0.28181831194804263, + 0.2824366153814854, + 0.27785624983983165, + 0.27767453973109907, + 0.2749203535226675, + 0.27874585680472547, + 0.27400337427090377, + 0.2731090982755025, + 0.2746552565158942, + 0.27237567687645936, + 0.2724008743579571, + 0.27389533550311357, + 0.27636091831402904, + 0.271907851482049, + 0.27387788280462605, + 0.272144893805186 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.340702235, + "auroc_disc_nll_ch3": 0.6261011900000001, + "auroc_disc_nll_ch4": 0.44488997, + "auroc_disc_nll_ch5": 0.61475583, + "auroc_disc_nll_ch6": 0.46339929500000004, + "auroc_disc_nll_ch7": 0.850613295, + "auroc_disc_nll_total": 0.3680529, + "auroc_terminal_flow": 0.9589729149999999, + "auroc_terminal_norm": 0.9828349599999999, + "auroc_terminal_packet": 0.7360988949999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.35035876, + "auroc_disc_nll_ch3": 0.30483683500000003, + "auroc_disc_nll_ch4": 0.42235631500000004, + "auroc_disc_nll_ch5": 0.51502388, + "auroc_disc_nll_ch6": 0.582623895, + "auroc_disc_nll_ch7": 0.834311115, + "auroc_disc_nll_total": 0.51764302, + "auroc_terminal_flow": 0.9584969150000002, + "auroc_terminal_norm": 0.9879315049999999, + "auroc_terminal_packet": 0.96391641 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.31325592, + "auroc_disc_nll_ch3": 0.25607267, + "auroc_disc_nll_ch4": 0.38237003, + "auroc_disc_nll_ch5": 0.390718165, + "auroc_disc_nll_ch6": 0.64795684, + "auroc_disc_nll_ch7": 0.90698576, + "auroc_disc_nll_total": 0.55291075, + "auroc_terminal_flow": 0.95988416, + "auroc_terminal_norm": 0.99443863, + "auroc_terminal_packet": 0.9858427250000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.34012091499999997, + "auroc_disc_nll_ch3": 0.24341608500000003, + "auroc_disc_nll_ch4": 0.38413281, + "auroc_disc_nll_ch5": 0.39965714, + "auroc_disc_nll_ch6": 0.62475751, + "auroc_disc_nll_ch7": 0.9045334700000001, + "auroc_disc_nll_total": 0.514646895, + "auroc_terminal_flow": 0.9623224149999999, + "auroc_terminal_norm": 0.9951926400000001, + "auroc_terminal_packet": 0.9899778450000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.34109378500000004, + "auroc_disc_nll_ch3": 0.23886419000000003, + "auroc_disc_nll_ch4": 0.38508345, + "auroc_disc_nll_ch5": 0.39202271499999997, + "auroc_disc_nll_ch6": 0.629516905, + "auroc_disc_nll_ch7": 0.9110172599999999, + "auroc_disc_nll_total": 0.5226673000000001, + "auroc_terminal_flow": 0.96047195, + "auroc_terminal_norm": 0.99605666, + "auroc_terminal_packet": 0.992203045 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/model.pt b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/model.pt new file mode 100644 index 0000000..ab8486e Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/model.pt differ diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/phase1.log b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/phase1.log new file mode 100644 index 0000000..fead36a --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/phase1.log @@ -0,0 +1,69 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/cicddos2019/processed/full_store +[data] kept 8,986,875 of 8,993,376 (min_len=2) +[data] train=74,565 val=18,642 attack=20,000 +[data] val=18,642 attack=20,000 +[eval] scoring val=5,000 atk=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.1s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] atk done 3.7s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/phase1_scores.npz b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/phase1_scores.npz new file mode 100644 index 0000000..809a573 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/phase1_summary.json b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/phase1_summary.json new file mode 100644 index 0000000..e095854 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicddos2019_seed44/phase1_summary.json @@ -0,0 +1,254 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.33721258, + "auprc": 0.565528025444571 + }, + "disc_nll_ch3": { + "auroc": 0.23433263999999998, + "auprc": 0.6295537806771652 + }, + "disc_nll_ch4": { + "auroc": 0.38865796, + "auprc": 0.5914133236205472 + }, + "disc_nll_ch5": { + "auroc": 0.38848918, + "auprc": 0.6184678540100789 + }, + "disc_nll_ch6": { + "auroc": 0.64043284, + "auprc": 0.6999132534558216 + }, + "disc_nll_ch7": { + "auroc": 0.91376068, + "auprc": 0.9571978995861569 + }, + "disc_nll_total": { + "auroc": 0.5252239000000001, + "auprc": 0.7236406037505421 + }, + "terminal_flow": { + "auroc": 0.96299726, + "auprc": 0.9764585451820091 + }, + "terminal_norm": { + "auroc": 0.9965549, + "auprc": 0.9977763469222896 + }, + "terminal_packet": { + "auroc": 0.99227392, + "auprc": 0.9957283608184421 + } + }, + "per_class": { + "DrDoS_DNS": { + "_n": 581.0, + "disc_nll_ch2": 0.24701135972461272, + "disc_nll_ch3": 0.03065370051635115, + "disc_nll_ch4": 0.03794664371772804, + "disc_nll_ch5": 0.05557693631669533, + "disc_nll_ch6": 0.7498447504302926, + "disc_nll_ch7": 0.9864688468158347, + "disc_nll_total": 0.47366884681583477, + "terminal_flow": 0.9957476764199656, + "terminal_norm": 0.9994616179001722, + "terminal_packet": 0.9993222030981068 + }, + "DrDoS_LDAP": { + "_n": 580.0, + "disc_nll_ch2": 0.23991137931034479, + "disc_nll_ch3": 0.03172758620689658, + "disc_nll_ch4": 0.002355172413793081, + "disc_nll_ch5": 0.031149310344827576, + "disc_nll_ch6": 0.7555131034482759, + "disc_nll_ch7": 0.9867537931034484, + "disc_nll_total": 0.47224344827586207, + "terminal_flow": 0.9981586206896551, + "terminal_norm": 0.9992962068965516, + "terminal_packet": 0.9992524137931035 + }, + "DrDoS_MSSQL": { + "_n": 545.0, + "disc_nll_ch2": 0.29202605504587154, + "disc_nll_ch3": 0.01549321100917432, + "disc_nll_ch4": 0.3986392660550459, + "disc_nll_ch5": 0.11513504587155965, + "disc_nll_ch6": 0.7274546788990826, + "disc_nll_ch7": 0.9867651376146789, + "disc_nll_total": 0.45548440366972476, + "terminal_flow": 0.9875471559633028, + "terminal_norm": 0.9996957798165137, + "terminal_packet": 0.9996818348623854 + }, + "DrDoS_NTP": { + "_n": 558.0, + "disc_nll_ch2": 0.7796655913978494, + "disc_nll_ch3": 0.13039569892473116, + "disc_nll_ch4": 0.39419928315412184, + "disc_nll_ch5": 0.537731541218638, + "disc_nll_ch6": 0.4653544802867384, + "disc_nll_ch7": 0.5586275985663083, + "disc_nll_total": 0.4337491039426523, + "terminal_flow": 0.991410752688172, + "terminal_norm": 0.9759562724014337, + "terminal_packet": 0.9391724014336919 + }, + "DrDoS_NetBIOS": { + "_n": 560.0, + "disc_nll_ch2": 0.3348285714285715, + "disc_nll_ch3": 0.00959428571428572, + "disc_nll_ch4": 0.5078696428571429, + "disc_nll_ch5": 0.5831267857142858, + "disc_nll_ch6": 0.7250725, + "disc_nll_ch7": 0.9875992857142858, + "disc_nll_total": 0.5034482142857142, + "terminal_flow": 0.9661642857142858, + "terminal_norm": 0.9984492857142857, + "terminal_packet": 0.9965521428571429 + }, + "DrDoS_SNMP": { + "_n": 587.0, + "disc_nll_ch2": 0.2472405451448041, + "disc_nll_ch3": 0.029556729131175487, + "disc_nll_ch4": 0.033340034071550236, + "disc_nll_ch5": 0.06511448040885862, + "disc_nll_ch6": 0.7561097103918228, + "disc_nll_ch7": 0.9880412265758092, + "disc_nll_total": 0.4745727427597955, + "terminal_flow": 0.9971066439522999, + "terminal_norm": 0.9997127768313457, + "terminal_packet": 0.9997781942078364 + }, + "DrDoS_SSDP": { + "_n": 548.0, + "disc_nll_ch2": 0.42447810218978105, + "disc_nll_ch3": 0.04670948905109489, + "disc_nll_ch4": 0.4264160583941606, + "disc_nll_ch5": 0.3992523722627737, + "disc_nll_ch6": 0.6311120437956205, + "disc_nll_ch7": 0.7477952554744525, + "disc_nll_total": 0.2818339416058394, + "terminal_flow": 0.9849689781021899, + "terminal_norm": 0.9984127737226278, + "terminal_packet": 0.9851547445255475 + }, + "DrDoS_UDP": { + "_n": 540.0, + "disc_nll_ch2": 0.4294311111111111, + "disc_nll_ch3": 0.05120925925925925, + "disc_nll_ch4": 0.42803296296296295, + "disc_nll_ch5": 0.42200796296296295, + "disc_nll_ch6": 0.6213085185185185, + "disc_nll_ch7": 0.7194492592592593, + "disc_nll_total": 0.26135407407407407, + "terminal_flow": 0.9848403703703704, + "terminal_norm": 0.998161111111111, + "terminal_packet": 0.9833685185185186 + }, + "LDAP": { + "_n": 585.0, + "disc_nll_ch2": 0.24028786324786322, + "disc_nll_ch3": 0.031177435897435924, + "disc_nll_ch4": 0.0015979487179486964, + "disc_nll_ch5": 0.02996205128205126, + "disc_nll_ch6": 0.7579596581196582, + "disc_nll_ch7": 0.9881251282051282, + "disc_nll_total": 0.4728868376068376, + "terminal_flow": 0.9992006837606838, + "terminal_norm": 0.9998044444444444, + "terminal_packet": 1.0 + }, + "MSSQL": { + "_n": 611.0, + "disc_nll_ch2": 0.29664615384615384, + "disc_nll_ch3": 0.014963011456628485, + "disc_nll_ch4": 0.4091800327332243, + "disc_nll_ch5": 0.1211770867430442, + "disc_nll_ch6": 0.7263463175122749, + "disc_nll_ch7": 0.9861918166939444, + "disc_nll_total": 0.4551371522094927, + "terminal_flow": 0.9869643207855973, + "terminal_norm": 0.9996815057283143, + "terminal_packet": 0.9996510638297871 + }, + "NetBIOS": { + "_n": 790.0, + "disc_nll_ch2": 0.3363741772151899, + "disc_nll_ch3": 0.009751392405063295, + "disc_nll_ch4": 0.5093967088607595, + "disc_nll_ch5": 0.5939007594936708, + "disc_nll_ch6": 0.7233354430379746, + "disc_nll_ch7": 0.9872754430379747, + "disc_nll_total": 0.49934025316455705, + "terminal_flow": 0.9661194936708861, + "terminal_norm": 0.9984437974683544, + "terminal_packet": 0.9965159493670886 + }, + "Portmap": { + "_n": 223.0, + "disc_nll_ch2": 0.33859192825112105, + "disc_nll_ch3": 0.014170403587443951, + "disc_nll_ch4": 0.5113641255605381, + "disc_nll_ch5": 0.5957730941704036, + "disc_nll_ch6": 0.7232618834080717, + "disc_nll_ch7": 0.9874062780269058, + "disc_nll_total": 0.5041739910313902, + "terminal_flow": 0.9655919282511211, + "terminal_norm": 0.9984385650224216, + "terminal_packet": 0.9964941704035875 + }, + "Syn": { + "_n": 1690.0, + "disc_nll_ch2": 0.30167656804733733, + "disc_nll_ch3": 0.9919758579881657, + "disc_nll_ch4": 0.7185307692307692, + "disc_nll_ch5": 0.7786001775147929, + "disc_nll_ch6": 0.47362958579881653, + "disc_nll_ch7": 0.9953065088757397, + "disc_nll_total": 0.9763994082840237, + "terminal_flow": 0.8770837869822485, + "terminal_norm": 0.9932726627218935, + "terminal_packet": 0.9966994082840237 + }, + "TFTP": { + "_n": 511.0, + "disc_nll_ch2": 0.3116285714285714, + "disc_nll_ch3": 0.07922230919765165, + "disc_nll_ch4": 0.2505248532289628, + "disc_nll_ch5": 0.15200156555772992, + "disc_nll_ch6": 0.6505589041095889, + "disc_nll_ch7": 0.8855647749510764, + "disc_nll_total": 0.24388962818003915, + "terminal_flow": 0.98653385518591, + "terminal_norm": 0.9991236790606652, + "terminal_packet": 0.9971268101761253 + }, + "UDP": { + "_n": 669.0, + "disc_nll_ch2": 0.42262421524663674, + "disc_nll_ch3": 0.04742212257100151, + "disc_nll_ch4": 0.4312777279521674, + "disc_nll_ch5": 0.4094781763826607, + "disc_nll_ch6": 0.6288914798206278, + "disc_nll_ch7": 0.7399671150971598, + "disc_nll_total": 0.2731946188340807, + "terminal_flow": 0.9847342301943198, + "terminal_norm": 0.9984514200298954, + "terminal_packet": 0.9847611360239164 + }, + "UDPLag": { + "_n": 422.0, + "disc_nll_ch2": 0.19725829383886256, + "disc_nll_ch3": 0.8602976303317535, + "disc_nll_ch4": 0.613488625592417, + "disc_nll_ch5": 0.709076777251185, + "disc_nll_ch6": 0.4018554502369668, + "disc_nll_ch7": 0.9500819905213271, + "disc_nll_total": 0.8000872037914691, + "terminal_flow": 0.8811701421800948, + "terminal_norm": 0.9940559241706162, + "terminal_packet": 0.9948990521327015 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/config.yaml b/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/config.yaml new file mode 100644 index 0000000..3c9218b --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/config.yaml @@ -0,0 +1,33 @@ +T: 64 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 42 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packets_npz: /home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/packets.npz +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed42 +seed: 42 +sigma: 0.1 +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/history.json b/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/history.json new file mode 100644 index 0000000..23d5570 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.284044256577125, + 0.9156272289080497, + 0.7042552186892583, + 0.5913106646293249, + 0.5247520842613318, + 0.4805309352202293, + 0.4502856884247217, + 0.4252478526188777, + 0.40640847117472917, + 0.39403591859035003, + 0.37745529413223267, + 0.3668914781166957, + 0.3600012468986022, + 0.35326185669654453, + 0.34645273135258603, + 0.34422130003953594, + 0.33843241440944183, + 0.33237966971519667, + 0.3266017009050418, + 0.3227172883657309, + 0.3232327523903969, + 0.31748698078669035, + 0.3149081682547545, + 0.3086839073743576, + 0.30705925593009364, + 0.3057502508163452, + 0.29932125027363116, + 0.301088721324236, + 0.3013279438018799, + 0.2981048119373811, + 0.29776064249185413, + 0.29432369959660065, + 0.2939563661049574, + 0.2892413154626504, + 0.2921492090592018, + 0.2902469589160039, + 0.28895592536681736, + 0.29156539608270693, + 0.2838160663078993, + 0.2891054963454222, + 0.2848423589498569, + 0.2846077741720738, + 0.2850860968614236, + 0.28271562319535476, + 0.28394696574944717, + 0.2826748566749768, + 0.2830434036560548, + 0.2849701566573901, + 0.282754130088366, + 0.2831448530539488 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.69241624, + "auroc_disc_nll_ch3": 0.62185724, + "auroc_disc_nll_ch4": 0.5859936287499999, + "auroc_disc_nll_ch5": 0.8043451525, + "auroc_disc_nll_ch6": 0.6622264775, + "auroc_disc_nll_ch7": 0.6534806449999999, + "auroc_disc_nll_total": 0.9629452262500001, + "auroc_terminal_flow": 0.9506905975, + "auroc_terminal_norm": 0.9658715762500001, + "auroc_terminal_packet": 0.9559415012499999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.701282355, + "auroc_disc_nll_ch3": 0.7908221375000001, + "auroc_disc_nll_ch4": 0.7383065225, + "auroc_disc_nll_ch5": 0.8583288125, + "auroc_disc_nll_ch6": 0.5195835725, + "auroc_disc_nll_ch7": 0.9533802975, + "auroc_disc_nll_total": 0.9821882237499999, + "auroc_terminal_flow": 0.9524715275, + "auroc_terminal_norm": 0.9701305037500001, + "auroc_terminal_packet": 0.9652146212499999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.7415651074999999, + "auroc_disc_nll_ch3": 0.88474555125, + "auroc_disc_nll_ch4": 0.81700329625, + "auroc_disc_nll_ch5": 0.89808813625, + "auroc_disc_nll_ch6": 0.50432675375, + "auroc_disc_nll_ch7": 0.8694620675, + "auroc_disc_nll_total": 0.98311764625, + "auroc_terminal_flow": 0.9608326487500001, + "auroc_terminal_norm": 0.9825778137500001, + "auroc_terminal_packet": 0.98955149 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.80019982, + "auroc_disc_nll_ch3": 0.8768053737500001, + "auroc_disc_nll_ch4": 0.807172285, + "auroc_disc_nll_ch5": 0.9052810962499999, + "auroc_disc_nll_ch6": 0.49626482625, + "auroc_disc_nll_ch7": 0.9310536925, + "auroc_disc_nll_total": 0.9831507325, + "auroc_terminal_flow": 0.9617766325, + "auroc_terminal_norm": 0.9838699312500001, + "auroc_terminal_packet": 0.98997664625 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.7950523975000001, + "auroc_disc_nll_ch3": 0.8641331862499999, + "auroc_disc_nll_ch4": 0.80894358125, + "auroc_disc_nll_ch5": 0.90404294125, + "auroc_disc_nll_ch6": 0.5021598625, + "auroc_disc_nll_ch7": 0.8897020925, + "auroc_disc_nll_total": 0.9828580287499998, + "auroc_terminal_flow": 0.96205434875, + "auroc_terminal_norm": 0.9861649325, + "auroc_terminal_packet": 0.9916208562500001 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/model.pt b/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/model.pt new file mode 100644 index 0000000..01812bf Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/model.pt differ diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/phase1.log b/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/phase1.log new file mode 100644 index 0000000..421efad --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/phase1.log @@ -0,0 +1,69 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/packets.npz +[data] kept 2,017,180 of 2,025,564 (min_len=2) +[data] train=1,210,760 val=302,690 attack=503,730 +[data] val=302,690 attack=503,730 +[eval] scoring val=5,000 atk=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.2s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] atk done 3.7s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/phase1_scores.npz b/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/phase1_scores.npz new file mode 100644 index 0000000..1bfa766 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/phase1_summary.json b/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/phase1_summary.json new file mode 100644 index 0000000..e6c1f6c --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicids2017_seed42/phase1_summary.json @@ -0,0 +1,202 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.79294358, + "auprc": 0.8980317438569447 + }, + "disc_nll_ch3": { + "auroc": 0.8678894899999999, + "auprc": 0.9269369894530718 + }, + "disc_nll_ch4": { + "auroc": 0.8109639200000001, + "auprc": 0.8920317765640645 + }, + "disc_nll_ch5": { + "auroc": 0.9047348500000001, + "auprc": 0.9543977858412638 + }, + "disc_nll_ch6": { + "auroc": 0.5062621199999999, + "auprc": 0.7122732333088884 + }, + "disc_nll_ch7": { + "auroc": 0.8875055900000001, + "auprc": 0.9474866285480887 + }, + "disc_nll_total": { + "auroc": 0.98314154, + "auprc": 0.9878495155700066 + }, + "terminal_flow": { + "auroc": 0.9661597500000001, + "auprc": 0.9557733308405861 + }, + "terminal_norm": { + "auroc": 0.98916834, + "auprc": 0.9912699819145854 + }, + "terminal_packet": { + "auroc": 0.9928666399999999, + "auprc": 0.9933448402480252 + } + }, + "per_class": { + "Botnet": { + "_n": 17.0, + "disc_nll_ch2": 0.7719882352941176, + "disc_nll_ch3": 0.7932941176470588, + "disc_nll_ch4": 0.8278000000000001, + "disc_nll_ch5": 0.9559529411764706, + "disc_nll_ch6": 0.7609764705882353, + "disc_nll_ch7": 0.9479764705882353, + "disc_nll_total": 0.7463176470588235, + "terminal_flow": 0.6477529411764706, + "terminal_norm": 0.9425176470588236, + "terminal_packet": 0.9723411764705882 + }, + "DDoS": { + "_n": 1904.0, + "disc_nll_ch2": 0.6989855042016807, + "disc_nll_ch3": 0.793219275210084, + "disc_nll_ch4": 0.9929438025210083, + "disc_nll_ch5": 0.9100661239495799, + "disc_nll_ch6": 0.8676600840336135, + "disc_nll_ch7": 0.5302011029411765, + "disc_nll_total": 0.9775593487394957, + "terminal_flow": 0.9730218487394958, + "terminal_norm": 0.9905405462184874, + "terminal_packet": 0.9949190126050419 + }, + "DoS GoldenEye": { + "_n": 132.0, + "disc_nll_ch2": 0.8994575757575757, + "disc_nll_ch3": 0.8714, + "disc_nll_ch4": 0.889639393939394, + "disc_nll_ch5": 0.8316128787878788, + "disc_nll_ch6": 0.8379469696969697, + "disc_nll_ch7": 0.4591833333333333, + "disc_nll_total": 0.9221075757575758, + "terminal_flow": 0.9755681818181818, + "terminal_norm": 0.9870848484848483, + "terminal_packet": 0.9906272727272727 + }, + "DoS Hulk": { + "_n": 3155.0, + "disc_nll_ch2": 0.6741920126782883, + "disc_nll_ch3": 0.7593238668779714, + "disc_nll_ch4": 0.9911720443740096, + "disc_nll_ch5": 0.8542187321711567, + "disc_nll_ch6": 0.8694154041204437, + "disc_nll_ch7": 0.955639936608558, + "disc_nll_total": 0.9709336925515056, + "terminal_flow": 0.9524738827258321, + "terminal_norm": 0.9826353090332804, + "terminal_packet": 0.9882716957210778 + }, + "DoS Slowhttptest": { + "_n": 27.0, + "disc_nll_ch2": 0.8668518518518519, + "disc_nll_ch3": 0.9048296296296297, + "disc_nll_ch4": 0.9289333333333333, + "disc_nll_ch5": 0.7590888888888889, + "disc_nll_ch6": 0.8806888888888889, + "disc_nll_ch7": 0.9373851851851852, + "disc_nll_total": 0.9523037037037037, + "terminal_flow": 0.9476962962962964, + "terminal_norm": 0.9892814814814814, + "terminal_packet": 0.9945407407407407 + }, + "DoS Slowloris": { + "_n": 58.0, + "disc_nll_ch2": 0.9363137931034482, + "disc_nll_ch3": 0.9124724137931034, + "disc_nll_ch4": 0.7374034482758621, + "disc_nll_ch5": 0.8361620689655173, + "disc_nll_ch6": 0.9901344827586207, + "disc_nll_ch7": 0.9923068965517241, + "disc_nll_total": 0.9937862068965517, + "terminal_flow": 0.9727655172413794, + "terminal_norm": 0.9867482758620689, + "terminal_packet": 0.9922689655172413 + }, + "FTP-Patator": { + "_n": 84.0, + "disc_nll_ch2": 0.9971166666666667, + "disc_nll_ch3": 0.07684761904761904, + "disc_nll_ch4": 0.876945238095238, + "disc_nll_ch5": 0.9212261904761905, + "disc_nll_ch6": 0.9915404761904761, + "disc_nll_ch7": 0.9751952380952381, + "disc_nll_total": 0.9920095238095237, + "terminal_flow": 0.9236690476190477, + "terminal_norm": 0.9094809523809524, + "terminal_packet": 0.9422333333333334 + }, + "Infiltration - Portscan": { + "_n": 1447.0, + "disc_nll_ch2": 0.7212114720110573, + "disc_nll_ch3": 0.9952955079474776, + "disc_nll_ch4": 0.6462450587422253, + "disc_nll_ch5": 0.8232062197650312, + "disc_nll_ch6": 0.01935217691776089, + "disc_nll_ch7": 0.9936764340013822, + "disc_nll_total": 0.9910052522460261, + "terminal_flow": 0.983960608154803, + "terminal_norm": 0.9979353144436766, + "terminal_packet": 0.9978530753282654 + }, + "Portscan": { + "_n": 3127.0, + "disc_nll_ch2": 0.986994819315638, + "disc_nll_ch3": 0.9977420530860249, + "disc_nll_ch4": 0.5913779341221619, + "disc_nll_ch5": 0.9999471058522545, + "disc_nll_ch6": 0.09878023664854493, + "disc_nll_ch7": 0.9993199232491206, + "disc_nll_total": 0.9991920690757915, + "terminal_flow": 0.9709283018867927, + "terminal_norm": 0.9984202750239846, + "terminal_packet": 0.9988386952350495 + }, + "SSH-Patator": { + "_n": 47.0, + "disc_nll_ch2": 0.9923914893617022, + "disc_nll_ch3": 0.0062425531914893475, + "disc_nll_ch4": 0.735131914893617, + "disc_nll_ch5": 0.618927659574468, + "disc_nll_ch6": 0.8685574468085107, + "disc_nll_ch7": 0.9430297872340426, + "disc_nll_total": 0.970187234042553, + "terminal_flow": 0.9073446808510638, + "terminal_norm": 0.6570382978723404, + "terminal_packet": 0.7756382978723403 + }, + "Web Attack - Brute Force": { + "_n": 1.0, + "disc_nll_ch2": 0.905, + "disc_nll_ch3": 0.09940000000000004, + "disc_nll_ch4": 0.00039999999999995595, + "disc_nll_ch5": 0.01200000000000001, + "disc_nll_ch6": 0.8522000000000001, + "disc_nll_ch7": 0.9824, + "disc_nll_total": 0.8350000000000001, + "terminal_flow": 0.9978, + "terminal_norm": 0.9256, + "terminal_packet": 0.8675999999999999 + }, + "Web Attack - XSS": { + "_n": 1.0, + "disc_nll_ch2": 0.6972, + "disc_nll_ch3": 0.09399999999999997, + "disc_nll_ch4": 0.00039999999999995595, + "disc_nll_ch5": 0.007000000000000006, + "disc_nll_ch6": 0.9865999999999999, + "disc_nll_ch7": 0.9736000000000001, + "disc_nll_total": 0.8684, + "terminal_flow": 0.9988, + "terminal_norm": 0.9444, + "terminal_packet": 0.9144 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/config.yaml b/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/config.yaml new file mode 100644 index 0000000..6c6fc9e --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/config.yaml @@ -0,0 +1,33 @@ +T: 64 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 43 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packets_npz: /home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/packets.npz +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed43 +seed: 43 +sigma: 0.1 +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/history.json b/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/history.json new file mode 100644 index 0000000..9facd74 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.287401034281804, + 0.9136823048958411, + 0.7024144774828202, + 0.5848577542182727, + 0.5183570675360851, + 0.47469354440004397, + 0.4455472972148504, + 0.41911104015814954, + 0.39924775331448287, + 0.3848633812024043, + 0.3737656642229129, + 0.3641993220035846, + 0.3565641190761175, + 0.34977483443724805, + 0.3384802624201163, + 0.33639455911440724, + 0.33298375209172565, + 0.32777213897460544, + 0.32684965164233476, + 0.31995341716668546, + 0.3170940318168738, + 0.3147313235661922, + 0.3111439576515785, + 0.30710773666699726, + 0.30701517982360643, + 0.3057618859486702, + 0.30133395470105684, + 0.3000747003616431, + 0.2985580838643588, + 0.2953324814637502, + 0.29362241732768524, + 0.2930751580458421, + 0.2926749739891443, + 0.28956843492312306, + 0.2885458584015186, + 0.2869402766227722, + 0.286944778301777, + 0.2849401900401482, + 0.2894530624915392, + 0.28584631207661754, + 0.28483155293342394, + 0.28437674733308643, + 0.2844077944755554, + 0.282418980048253, + 0.281206617752711, + 0.2827338469334138, + 0.28045000556187755, + 0.2835480322440465, + 0.2844840876567058, + 0.2811658894404387 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.5200047649999999, + "auroc_disc_nll_ch3": 0.87968618125, + "auroc_disc_nll_ch4": 0.77268731375, + "auroc_disc_nll_ch5": 0.84930518375, + "auroc_disc_nll_ch6": 0.7679825674999999, + "auroc_disc_nll_ch7": 0.7059829937500001, + "auroc_disc_nll_total": 0.9534610024999998, + "auroc_terminal_flow": 0.95872501375, + "auroc_terminal_norm": 0.9810878487499999, + "auroc_terminal_packet": 0.98016567625 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.6661727375, + "auroc_disc_nll_ch3": 0.6012280112499999, + "auroc_disc_nll_ch4": 0.65085252625, + "auroc_disc_nll_ch5": 0.85236380875, + "auroc_disc_nll_ch6": 0.7852858825, + "auroc_disc_nll_ch7": 0.6195870425000001, + "auroc_disc_nll_total": 0.9819519050000001, + "auroc_terminal_flow": 0.96117740875, + "auroc_terminal_norm": 0.97880153375, + "auroc_terminal_packet": 0.9833390362499999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.77302667875, + "auroc_disc_nll_ch3": 0.64830992875, + "auroc_disc_nll_ch4": 0.8029188325000002, + "auroc_disc_nll_ch5": 0.9122037412499999, + "auroc_disc_nll_ch6": 0.7798192037500001, + "auroc_disc_nll_ch7": 0.6396160125, + "auroc_disc_nll_total": 0.9814443575, + "auroc_terminal_flow": 0.9597935437499999, + "auroc_terminal_norm": 0.97585975, + "auroc_terminal_packet": 0.9780025762500001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.7431344187500001, + "auroc_disc_nll_ch3": 0.5923509687499999, + "auroc_disc_nll_ch4": 0.83289577, + "auroc_disc_nll_ch5": 0.91301837375, + "auroc_disc_nll_ch6": 0.7793886624999999, + "auroc_disc_nll_ch7": 0.684514885, + "auroc_disc_nll_total": 0.9828187874999998, + "auroc_terminal_flow": 0.9636977124999999, + "auroc_terminal_norm": 0.98415451625, + "auroc_terminal_packet": 0.99000833125 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.7640916362500001, + "auroc_disc_nll_ch3": 0.59174339875, + "auroc_disc_nll_ch4": 0.83558725625, + "auroc_disc_nll_ch5": 0.91569855875, + "auroc_disc_nll_ch6": 0.7774486775, + "auroc_disc_nll_ch7": 0.6575331874999999, + "auroc_disc_nll_total": 0.9825980575000001, + "auroc_terminal_flow": 0.96249609375, + "auroc_terminal_norm": 0.9862551087500001, + "auroc_terminal_packet": 0.991338335 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/model.pt b/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/model.pt new file mode 100644 index 0000000..f2f7be9 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/model.pt differ diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/phase1.log b/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/phase1.log new file mode 100644 index 0000000..81e046e --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/phase1.log @@ -0,0 +1,69 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/packets.npz +[data] kept 2,017,180 of 2,025,564 (min_len=2) +[data] train=1,210,760 val=302,690 attack=503,730 +[data] val=302,690 attack=503,730 +[eval] scoring val=5,000 atk=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.2s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] atk done 3.7s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/phase1_scores.npz b/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/phase1_scores.npz new file mode 100644 index 0000000..5d60ac7 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/phase1_summary.json b/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/phase1_summary.json new file mode 100644 index 0000000..ac125f5 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicids2017_seed43/phase1_summary.json @@ -0,0 +1,202 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.76638758, + "auprc": 0.8449240412989911 + }, + "disc_nll_ch3": { + "auroc": 0.59182071, + "auprc": 0.8215666564777556 + }, + "disc_nll_ch4": { + "auroc": 0.83799904, + "auprc": 0.8966366043827882 + }, + "disc_nll_ch5": { + "auroc": 0.91967994, + "auprc": 0.9631402266731285 + }, + "disc_nll_ch6": { + "auroc": 0.7794252899999999, + "auprc": 0.7983192360422458 + }, + "disc_nll_ch7": { + "auroc": 0.6583916400000001, + "auprc": 0.8491275968586098 + }, + "disc_nll_total": { + "auroc": 0.98416974, + "auprc": 0.9890280520595837 + }, + "terminal_flow": { + "auroc": 0.96083644, + "auprc": 0.9498820491670275 + }, + "terminal_norm": { + "auroc": 0.9867678799999999, + "auprc": 0.9895550849857143 + }, + "terminal_packet": { + "auroc": 0.99181546, + "auprc": 0.9940574288259538 + } + }, + "per_class": { + "Botnet": { + "_n": 17.0, + "disc_nll_ch2": 0.8401882352941176, + "disc_nll_ch3": 0.2967764705882353, + "disc_nll_ch4": 0.8128941176470588, + "disc_nll_ch5": 0.9619176470588235, + "disc_nll_ch6": 0.7462, + "disc_nll_ch7": 0.7597647058823529, + "disc_nll_total": 0.76, + "terminal_flow": 0.6838941176470588, + "terminal_norm": 0.9311647058823529, + "terminal_packet": 0.9608 + }, + "DDoS": { + "_n": 1904.0, + "disc_nll_ch2": 0.7428877100840336, + "disc_nll_ch3": 0.1920930672268908, + "disc_nll_ch4": 0.9714860294117647, + "disc_nll_ch5": 0.9530214285714286, + "disc_nll_ch6": 0.8696720588235294, + "disc_nll_ch7": 0.17391953781512604, + "disc_nll_total": 0.979722268907563, + "terminal_flow": 0.9678768907563026, + "terminal_norm": 0.9895762605042017, + "terminal_packet": 0.9954099789915966 + }, + "DoS GoldenEye": { + "_n": 132.0, + "disc_nll_ch2": 0.8889712121212121, + "disc_nll_ch3": 0.370630303030303, + "disc_nll_ch4": 0.896060606060606, + "disc_nll_ch5": 0.8699636363636365, + "disc_nll_ch6": 0.8439878787878788, + "disc_nll_ch7": 0.30188333333333334, + "disc_nll_total": 0.9177666666666666, + "terminal_flow": 0.9720121212121212, + "terminal_norm": 0.9858454545454545, + "terminal_packet": 0.9912621212121212 + }, + "DoS Hulk": { + "_n": 3155.0, + "disc_nll_ch2": 0.8045374960380347, + "disc_nll_ch3": 0.2734762916006339, + "disc_nll_ch4": 0.9791284944532488, + "disc_nll_ch5": 0.9267233597464343, + "disc_nll_ch6": 0.8691800633914422, + "disc_nll_ch7": 0.478044500792393, + "disc_nll_total": 0.9723956259904911, + "terminal_flow": 0.9446642789223454, + "terminal_norm": 0.9749792709984152, + "terminal_packet": 0.9836656735340729 + }, + "DoS Slowhttptest": { + "_n": 27.0, + "disc_nll_ch2": 0.8984, + "disc_nll_ch3": 0.7062814814814814, + "disc_nll_ch4": 0.8906888888888889, + "disc_nll_ch5": 0.8311185185185185, + "disc_nll_ch6": 0.8571777777777778, + "disc_nll_ch7": 0.7164296296296296, + "disc_nll_total": 0.9372518518518519, + "terminal_flow": 0.9454222222222222, + "terminal_norm": 0.9902518518518517, + "terminal_packet": 0.9967777777777778 + }, + "DoS Slowloris": { + "_n": 58.0, + "disc_nll_ch2": 0.9328068965517242, + "disc_nll_ch3": 0.8245896551724138, + "disc_nll_ch4": 0.6794068965517241, + "disc_nll_ch5": 0.8390896551724137, + "disc_nll_ch6": 0.9288793103448276, + "disc_nll_ch7": 0.9872551724137931, + "disc_nll_total": 0.9895103448275863, + "terminal_flow": 0.9708827586206896, + "terminal_norm": 0.9907862068965516, + "terminal_packet": 0.9972 + }, + "FTP-Patator": { + "_n": 84.0, + "disc_nll_ch2": 0.9972047619047619, + "disc_nll_ch3": 0.0673047619047619, + "disc_nll_ch4": 0.8034333333333333, + "disc_nll_ch5": 0.9093380952380952, + "disc_nll_ch6": 0.9914380952380952, + "disc_nll_ch7": 0.6169761904761903, + "disc_nll_total": 0.991252380952381, + "terminal_flow": 0.9306142857142858, + "terminal_norm": 0.902597619047619, + "terminal_packet": 0.9270404761904762 + }, + "Infiltration - Portscan": { + "_n": 1447.0, + "disc_nll_ch2": 0.4152293020041465, + "disc_nll_ch3": 0.9958931582584657, + "disc_nll_ch4": 0.6940811333794057, + "disc_nll_ch5": 0.7256279198341398, + "disc_nll_ch6": 0.6649545266067726, + "disc_nll_ch7": 0.9937695922598478, + "disc_nll_total": 0.9924201796821007, + "terminal_flow": 0.9797599170697995, + "terminal_norm": 0.998101589495508, + "terminal_packet": 0.9978492052522461 + }, + "Portscan": { + "_n": 3127.0, + "disc_nll_ch2": 0.8851992964502718, + "disc_nll_ch3": 0.9983511352734252, + "disc_nll_ch4": 0.6831288135593221, + "disc_nll_ch5": 0.999932075471698, + "disc_nll_ch6": 0.6735944355612409, + "disc_nll_ch7": 0.99896635753118, + "disc_nll_total": 0.9993124400383755, + "terminal_flow": 0.9667004157339303, + "terminal_norm": 0.9984334505916214, + "terminal_packet": 0.9993421170450911 + }, + "SSH-Patator": { + "_n": 47.0, + "disc_nll_ch2": 0.9948085106382979, + "disc_nll_ch3": 0.002600000000000007, + "disc_nll_ch4": 0.7997021276595744, + "disc_nll_ch5": 0.062212765957446806, + "disc_nll_ch6": 0.8858212765957447, + "disc_nll_ch7": 0.01707659574468082, + "disc_nll_total": 0.9790553191489363, + "terminal_flow": 0.9061404255319149, + "terminal_norm": 0.7081148936170213, + "terminal_packet": 0.8316127659574469 + }, + "Web Attack - Brute Force": { + "_n": 1.0, + "disc_nll_ch2": 0.9376, + "disc_nll_ch3": 0.04620000000000002, + "disc_nll_ch4": 0.01539999999999997, + "disc_nll_ch5": 0.03080000000000005, + "disc_nll_ch6": 0.7727999999999999, + "disc_nll_ch7": 0.3496, + "disc_nll_total": 0.7702, + "terminal_flow": 0.9974000000000001, + "terminal_norm": 0.9138, + "terminal_packet": 0.8288 + }, + "Web Attack - XSS": { + "_n": 1.0, + "disc_nll_ch2": 0.801, + "disc_nll_ch3": 0.056599999999999984, + "disc_nll_ch4": 0.008199999999999985, + "disc_nll_ch5": 0.028800000000000048, + "disc_nll_ch6": 0.8174, + "disc_nll_ch7": 0.4436, + "disc_nll_total": 0.7024, + "terminal_flow": 0.9992, + "terminal_norm": 0.9344, + "terminal_packet": 0.8814000000000001 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/config.yaml b/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/config.yaml new file mode 100644 index 0000000..923dd8a --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/config.yaml @@ -0,0 +1,33 @@ +T: 64 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 44 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packets_npz: /home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/packets.npz +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed44 +seed: 44 +sigma: 0.1 +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/history.json b/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/history.json new file mode 100644 index 0000000..32bd3af --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.2839362774139795, + 0.9118730364701687, + 0.7023283839225769, + 0.5845583020112454, + 0.5216053166450598, + 0.4806575316649217, + 0.45254102731362367, + 0.4253230889638265, + 0.4102378907876137, + 0.3861000759479327, + 0.37070659032234776, + 0.3644821147123973, + 0.3519192697146, + 0.34689726202915877, + 0.33661556778809965, + 0.33548905987005967, + 0.32997972002396214, + 0.3254376130226331, + 0.3216159060979501, + 0.3170334635636745, + 0.3157719243795444, + 0.3137761354446411, + 0.31396174125182325, + 0.30767122293129945, + 0.30164366578444457, + 0.30234012695459217, + 0.2995076867250296, + 0.29854960854236895, + 0.2935573863677489, + 0.29262179136276245, + 0.29483098555833864, + 0.2898033811495854, + 0.28919932628289247, + 0.2871825370268944, + 0.28392259509135515, + 0.2870946778700902, + 0.28427376731848103, + 0.28401545301461834, + 0.2833182895794893, + 0.28388489897434527, + 0.2825651489771329, + 0.2779269592884259, + 0.27999947086358684, + 0.28206712542436063, + 0.2813183856316102, + 0.2797689812305646, + 0.2821173117710994, + 0.28128801630093503, + 0.2805019158583421, + 0.2803074656388698 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.66095074, + "auroc_disc_nll_ch3": 0.8592554875, + "auroc_disc_nll_ch4": 0.79221816625, + "auroc_disc_nll_ch5": 0.9640298387500001, + "auroc_disc_nll_ch6": 0.7675210475, + "auroc_disc_nll_ch7": 0.57385044625, + "auroc_disc_nll_total": 0.95518698625, + "auroc_terminal_flow": 0.9601809999999998, + "auroc_terminal_norm": 0.89804293875, + "auroc_terminal_packet": 0.7006821562500001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.6808646425, + "auroc_disc_nll_ch3": 0.6295739425000001, + "auroc_disc_nll_ch4": 0.533770815, + "auroc_disc_nll_ch5": 0.8945895075000001, + "auroc_disc_nll_ch6": 0.7791739525000001, + "auroc_disc_nll_ch7": 0.637193395, + "auroc_disc_nll_total": 0.97589718375, + "auroc_terminal_flow": 0.9632332475000001, + "auroc_terminal_norm": 0.9693317862499999, + "auroc_terminal_packet": 0.970520335 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.7346415199999999, + "auroc_disc_nll_ch3": 0.62545320875, + "auroc_disc_nll_ch4": 0.5894701275, + "auroc_disc_nll_ch5": 0.89871804125, + "auroc_disc_nll_ch6": 0.7754528975, + "auroc_disc_nll_ch7": 0.650944265, + "auroc_disc_nll_total": 0.98655844375, + "auroc_terminal_flow": 0.96455893125, + "auroc_terminal_norm": 0.9808708662500001, + "auroc_terminal_packet": 0.98747547875 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.7803323625, + "auroc_disc_nll_ch3": 0.606884795, + "auroc_disc_nll_ch4": 0.6047246225, + "auroc_disc_nll_ch5": 0.8971882, + "auroc_disc_nll_ch6": 0.767113955, + "auroc_disc_nll_ch7": 0.69765396625, + "auroc_disc_nll_total": 0.9866224712499999, + "auroc_terminal_flow": 0.962140085, + "auroc_terminal_norm": 0.9877912225000001, + "auroc_terminal_packet": 0.99422136125 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.7801850475000001, + "auroc_disc_nll_ch3": 0.60654838, + "auroc_disc_nll_ch4": 0.6049755349999999, + "auroc_disc_nll_ch5": 0.89287664, + "auroc_disc_nll_ch6": 0.7715280287499999, + "auroc_disc_nll_ch7": 0.69675733625, + "auroc_disc_nll_total": 0.9854637524999998, + "auroc_terminal_flow": 0.9633488024999999, + "auroc_terminal_norm": 0.98859201125, + "auroc_terminal_packet": 0.9946057200000001 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/model.pt b/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/model.pt new file mode 100644 index 0000000..f8a9ba4 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/model.pt differ diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/phase1.log b/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/phase1.log new file mode 100644 index 0000000..90392ef --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/phase1.log @@ -0,0 +1,69 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/cicids2017/processed/packets.npz +[data] kept 2,017,180 of 2,025,564 (min_len=2) +[data] train=1,210,760 val=302,690 attack=503,730 +[data] val=302,690 attack=503,730 +[eval] scoring val=5,000 atk=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.1s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] atk done 3.5s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/phase1_scores.npz b/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/phase1_scores.npz new file mode 100644 index 0000000..0d2c078 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/phase1_summary.json b/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/phase1_summary.json new file mode 100644 index 0000000..ed3cbd6 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_cicids2017_seed44/phase1_summary.json @@ -0,0 +1,202 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.77746114, + "auprc": 0.8727540215720468 + }, + "disc_nll_ch3": { + "auroc": 0.60719393, + "auprc": 0.8251196288074117 + }, + "disc_nll_ch4": { + "auroc": 0.60449708, + "auprc": 0.8266181556489286 + }, + "disc_nll_ch5": { + "auroc": 0.8922299300000001, + "auprc": 0.953556189562725 + }, + "disc_nll_ch6": { + "auroc": 0.7668351099999999, + "auprc": 0.7983677200879904 + }, + "disc_nll_ch7": { + "auroc": 0.69775038, + "auprc": 0.8545069092555793 + }, + "disc_nll_total": { + "auroc": 0.98427962, + "auprc": 0.9869511651540532 + }, + "terminal_flow": { + "auroc": 0.9613461, + "auprc": 0.9475408548873382 + }, + "terminal_norm": { + "auroc": 0.98938423, + "auprc": 0.9914543310199493 + }, + "terminal_packet": { + "auroc": 0.99493232, + "auprc": 0.9966079598058257 + } + }, + "per_class": { + "Botnet": { + "_n": 17.0, + "disc_nll_ch2": 0.8170823529411765, + "disc_nll_ch3": 0.3762470588235294, + "disc_nll_ch4": 0.9024235294117647, + "disc_nll_ch5": 0.9774941176470588, + "disc_nll_ch6": 0.7413411764705883, + "disc_nll_ch7": 0.5499058823529412, + "disc_nll_total": 0.8163764705882353, + "terminal_flow": 0.5851529411764705, + "terminal_norm": 0.9227058823529412, + "terminal_packet": 0.9690941176470588 + }, + "DDoS": { + "_n": 1904.0, + "disc_nll_ch2": 0.780462762605042, + "disc_nll_ch3": 0.25925288865546214, + "disc_nll_ch4": 0.9933015756302521, + "disc_nll_ch5": 0.9327721113445379, + "disc_nll_ch6": 0.8756933298319328, + "disc_nll_ch7": 0.30219275210084034, + "disc_nll_total": 0.9795600840336136, + "terminal_flow": 0.9694293067226891, + "terminal_norm": 0.9892189075630252, + "terminal_packet": 0.9957981092436976 + }, + "DoS GoldenEye": { + "_n": 132.0, + "disc_nll_ch2": 0.9173439393939394, + "disc_nll_ch3": 0.32858030303030306, + "disc_nll_ch4": 0.9019924242424243, + "disc_nll_ch5": 0.8883196969696969, + "disc_nll_ch6": 0.8423772727272728, + "disc_nll_ch7": 0.4636590909090909, + "disc_nll_total": 0.9199606060606059, + "terminal_flow": 0.9746151515151515, + "terminal_norm": 0.9875242424242424, + "terminal_packet": 0.9941818181818183 + }, + "DoS Hulk": { + "_n": 3155.0, + "disc_nll_ch2": 0.7286093185419968, + "disc_nll_ch3": 0.28436925515055467, + "disc_nll_ch4": 0.991083676703645, + "disc_nll_ch5": 0.9057733755942946, + "disc_nll_ch6": 0.8728757527733757, + "disc_nll_ch7": 0.5183021870047544, + "disc_nll_total": 0.9737094136291602, + "terminal_flow": 0.947244500792393, + "terminal_norm": 0.983168209191759, + "terminal_packet": 0.9928304912836766 + }, + "DoS Slowhttptest": { + "_n": 27.0, + "disc_nll_ch2": 0.8389259259259261, + "disc_nll_ch3": 0.6098518518518519, + "disc_nll_ch4": 0.9391037037037037, + "disc_nll_ch5": 0.8976888888888889, + "disc_nll_ch6": 0.8677037037037036, + "disc_nll_ch7": 0.8368296296296296, + "disc_nll_total": 0.9195555555555556, + "terminal_flow": 0.9400740740740741, + "terminal_norm": 0.9861037037037036, + "terminal_packet": 0.9949481481481481 + }, + "DoS Slowloris": { + "_n": 58.0, + "disc_nll_ch2": 0.929803448275862, + "disc_nll_ch3": 0.8480862068965517, + "disc_nll_ch4": 0.8224172413793103, + "disc_nll_ch5": 0.8471793103448275, + "disc_nll_ch6": 0.9874655172413794, + "disc_nll_ch7": 0.977496551724138, + "disc_nll_total": 0.9916379310344828, + "terminal_flow": 0.9645620689655172, + "terminal_norm": 0.9825862068965517, + "terminal_packet": 0.9927551724137932 + }, + "FTP-Patator": { + "_n": 84.0, + "disc_nll_ch2": 0.9984071428571428, + "disc_nll_ch3": 0.08363809523809525, + "disc_nll_ch4": 0.9876833333333332, + "disc_nll_ch5": 0.9366714285714286, + "disc_nll_ch6": 0.9890119047619047, + "disc_nll_ch7": 0.6597976190476191, + "disc_nll_total": 0.9917833333333334, + "terminal_flow": 0.9297666666666666, + "terminal_norm": 0.9020357142857143, + "terminal_packet": 0.9395357142857141 + }, + "Infiltration - Portscan": { + "_n": 1447.0, + "disc_nll_ch2": 0.4999106427090533, + "disc_nll_ch3": 0.9953906012439531, + "disc_nll_ch4": 0.4544914996544575, + "disc_nll_ch5": 0.5811264685556323, + "disc_nll_ch6": 0.591448790601244, + "disc_nll_ch7": 0.9917076710435383, + "disc_nll_total": 0.9927788527988943, + "terminal_flow": 0.9780449205252247, + "terminal_norm": 0.9973643400138218, + "terminal_packet": 0.9957033863165171 + }, + "Portscan": { + "_n": 3127.0, + "disc_nll_ch2": 0.9346434282059484, + "disc_nll_ch3": 0.9971843939878478, + "disc_nll_ch4": 0.013779852894147744, + "disc_nll_ch5": 0.9999520307003519, + "disc_nll_ch6": 0.6590567316917173, + "disc_nll_ch7": 0.9977605372561561, + "disc_nll_total": 0.9980377358490565, + "terminal_flow": 0.9661861848417013, + "terminal_norm": 0.9984530860249441, + "terminal_packet": 0.999773201151263 + }, + "SSH-Patator": { + "_n": 47.0, + "disc_nll_ch2": 0.9946851063829787, + "disc_nll_ch3": 0.003429787234042551, + "disc_nll_ch4": 0.7303829787234042, + "disc_nll_ch5": 0.7397829787234041, + "disc_nll_ch6": 0.8721574468085108, + "disc_nll_ch7": 0.1346340425531915, + "disc_nll_total": 0.969727659574468, + "terminal_flow": 0.906331914893617, + "terminal_norm": 0.763072340425532, + "terminal_packet": 0.8743234042553192 + }, + "Web Attack - Brute Force": { + "_n": 1.0, + "disc_nll_ch2": 0.9381999999999999, + "disc_nll_ch3": 0.0, + "disc_nll_ch4": 0.6920000000000001, + "disc_nll_ch5": 0.08299999999999996, + "disc_nll_ch6": 0.8664000000000001, + "disc_nll_ch7": 0.1512, + "disc_nll_total": 0.8503999999999999, + "terminal_flow": 0.9958, + "terminal_norm": 0.9064, + "terminal_packet": 0.8308000000000001 + }, + "Web Attack - XSS": { + "_n": 1.0, + "disc_nll_ch2": 0.7332000000000001, + "disc_nll_ch3": 0.00039999999999995595, + "disc_nll_ch4": 0.6712, + "disc_nll_ch5": 0.06340000000000001, + "disc_nll_ch6": 0.9788, + "disc_nll_ch7": 0.14459999999999995, + "disc_nll_total": 0.852, + "terminal_flow": 0.9988, + "terminal_norm": 0.9289999999999999, + "terminal_packet": 0.8747999999999999 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/config.yaml b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/config.yaml new file mode 100644 index 0000000..7ef0703 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/config.yaml @@ -0,0 +1,35 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 42 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42 +seed: 42 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/history.json b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/history.json new file mode 100644 index 0000000..825755b --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.3451343438564203, + 1.0189627760495894, + 0.8192226657500634, + 0.6682005020288321, + 0.578651671226208, + 0.5261431603859632, + 0.49136022191781265, + 0.4578849642704695, + 0.4391142779435867, + 0.423497254267717, + 0.4009288457723764, + 0.3989990590474544, + 0.3869316180547078, + 0.37388888001441956, + 0.35705599723718107, + 0.3455433157774118, + 0.34315035129204774, + 0.3434122777902163, + 0.33899102073449355, + 0.3335422667173239, + 0.3291463905420059, + 0.31725273988185787, + 0.31309265509629863, + 0.31197200753749943, + 0.30847222606341046, + 0.3031338162911244, + 0.3080921169274893, + 0.30353581752532566, + 0.29657783493017537, + 0.29686952783511233, + 0.2938038924565682, + 0.28772585476056123, + 0.2951045296131036, + 0.2890090545018514, + 0.291133171472794, + 0.2822743084950325, + 0.2804111532675914, + 0.280767580637565, + 0.2833672207899583, + 0.27750411591468715, + 0.280562882622083, + 0.2768246019497896, + 0.27890792680092347, + 0.27311501709314495, + 0.27333801449873507, + 0.275347385651026, + 0.27786372907650775, + 0.27824555604885787, + 0.28038468689490587, + 0.2730980144861417 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.29710612750000004, + "auroc_disc_nll_ch3": 0.8556214150000001, + "auroc_disc_nll_ch4": 0.61999277, + "auroc_disc_nll_ch5": 0.885984945, + "auroc_disc_nll_ch6": 0.408188575, + "auroc_disc_nll_ch7": 0.89903385, + "auroc_disc_nll_total": 0.8106493, + "auroc_terminal_flow": 0.90840921, + "auroc_terminal_norm": 0.937590545, + "auroc_terminal_packet": 0.9445388674999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.37255346, + "auroc_disc_nll_ch3": 0.8835250375, + "auroc_disc_nll_ch4": 0.61403601, + "auroc_disc_nll_ch5": 0.852747165, + "auroc_disc_nll_ch6": 0.6931750175, + "auroc_disc_nll_ch7": 0.903418455, + "auroc_disc_nll_total": 0.875566335, + "auroc_terminal_flow": 0.91506552, + "auroc_terminal_norm": 0.9504140075, + "auroc_terminal_packet": 0.9592372650000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.38994182750000006, + "auroc_disc_nll_ch3": 0.8897534850000001, + "auroc_disc_nll_ch4": 0.83205632, + "auroc_disc_nll_ch5": 0.8691562349999999, + "auroc_disc_nll_ch6": 0.7527025975000001, + "auroc_disc_nll_ch7": 0.88571219, + "auroc_disc_nll_total": 0.9083930149999999, + "auroc_terminal_flow": 0.91188438, + "auroc_terminal_norm": 0.9569752125000001, + "auroc_terminal_packet": 0.9616509200000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.39582073749999996, + "auroc_disc_nll_ch3": 0.8895412375, + "auroc_disc_nll_ch4": 0.8296310499999999, + "auroc_disc_nll_ch5": 0.8671039775, + "auroc_disc_nll_ch6": 0.769744065, + "auroc_disc_nll_ch7": 0.8857031774999999, + "auroc_disc_nll_total": 0.9122930800000001, + "auroc_terminal_flow": 0.9171533575, + "auroc_terminal_norm": 0.96061033, + "auroc_terminal_packet": 0.9672488924999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.398856445, + "auroc_disc_nll_ch3": 0.8876780750000001, + "auroc_disc_nll_ch4": 0.8475317725, + "auroc_disc_nll_ch5": 0.8671175500000001, + "auroc_disc_nll_ch6": 0.7658042975, + "auroc_disc_nll_ch7": 0.8911490499999999, + "auroc_disc_nll_total": 0.9138512624999999, + "auroc_terminal_flow": 0.91873531, + "auroc_terminal_norm": 0.9611636275000001, + "auroc_terminal_packet": 0.9675926300000001 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/model.pt b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/model.pt new file mode 100644 index 0000000..eee94b1 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/model.pt differ diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/phase1.log b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/phase1.log new file mode 100644 index 0000000..e08250a --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/phase1.log @@ -0,0 +1,69 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] kept 3,797,530 of 8,193,621 (min_len=2) +[data] train=77,636 val=10,000 attack=20,000 +[data] val=10,000 attack=20,000 +[eval] scoring val=5,000 atk=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.1s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] atk done 3.6s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/phase1_scores.npz b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/phase1_scores.npz new file mode 100644 index 0000000..2895b16 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/phase1_summary.json b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/phase1_summary.json new file mode 100644 index 0000000..7ba579a --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed42/phase1_summary.json @@ -0,0 +1,462 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.39345205, + "auprc": 0.7019606945080185 + }, + "disc_nll_ch3": { + "auroc": 0.88697663, + "auprc": 0.9478469606878743 + }, + "disc_nll_ch4": { + "auroc": 0.8478819900000001, + "auprc": 0.9110411813850544 + }, + "disc_nll_ch5": { + "auroc": 0.86391673, + "auprc": 0.9399071661599596 + }, + "disc_nll_ch6": { + "auroc": 0.7654273300000001, + "auprc": 0.8571028117038093 + }, + "disc_nll_ch7": { + "auroc": 0.8885935300000001, + "auprc": 0.9533410097141604 + }, + "disc_nll_total": { + "auroc": 0.91297342, + "auprc": 0.9605997161555969 + }, + "terminal_flow": { + "auroc": 0.9195047000000002, + "auprc": 0.9427186528275964 + }, + "terminal_norm": { + "auroc": 0.96285946, + "auprc": 0.9804010228410001 + }, + "terminal_packet": { + "auroc": 0.9669349800000001, + "auprc": 0.9853254029921089 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 9.0, + "disc_nll_ch2": 0.7578, + "disc_nll_ch3": 0.6171444444444445, + "disc_nll_ch4": 0.47783333333333333, + "disc_nll_ch5": 0.26426666666666665, + "disc_nll_ch6": 0.5752999999999999, + "disc_nll_ch7": 0.4770111111111111, + "disc_nll_total": 0.7084777777777779, + "terminal_flow": 0.9220222222222223, + "terminal_norm": 0.9105111111111112, + "terminal_packet": 0.8681777777777778 + }, + "commandinjection": { + "_n": 11.0, + "disc_nll_ch2": 0.5770545454545455, + "disc_nll_ch3": 0.4024, + "disc_nll_ch4": 0.5353454545454546, + "disc_nll_ch5": 0.4326727272727272, + "disc_nll_ch6": 0.5741090909090909, + "disc_nll_ch7": 0.46129090909090903, + "disc_nll_total": 0.5069636363636364, + "terminal_flow": 0.7791272727272727, + "terminal_norm": 0.8652181818181819, + "terminal_packet": 0.8912363636363636 + }, + "ddos-ack_fragmentation": { + "_n": 310.0, + "disc_nll_ch2": 0.386618064516129, + "disc_nll_ch3": 0.7439051612903225, + "disc_nll_ch4": 0.6839993548387097, + "disc_nll_ch5": 0.7966503225806452, + "disc_nll_ch6": 0.9189393548387098, + "disc_nll_ch7": 0.954378064516129, + "disc_nll_total": 0.9562019354838708, + "terminal_flow": 0.9792954838709677, + "terminal_norm": 0.9855851612903226, + "terminal_packet": 0.9836083870967741 + }, + "ddos-http_flood": { + "_n": 918.0, + "disc_nll_ch2": 0.4058583877995643, + "disc_nll_ch3": 0.9582910675381264, + "disc_nll_ch4": 0.9084618736383443, + "disc_nll_ch5": 0.874457734204793, + "disc_nll_ch6": 0.8591274509803921, + "disc_nll_ch7": 0.9076117647058825, + "disc_nll_total": 0.9709847494553376, + "terminal_flow": 0.9074124183006537, + "terminal_norm": 0.9815287581699348, + "terminal_packet": 0.991338779956427 + }, + "ddos-icmp_flood": { + "_n": 24.0, + "disc_nll_ch2": 0.5454749999999999, + "disc_nll_ch3": 0.407525, + "disc_nll_ch4": 0.5325916666666667, + "disc_nll_ch5": 0.48503333333333326, + "disc_nll_ch6": 0.5473166666666667, + "disc_nll_ch7": 0.53815, + "disc_nll_total": 0.5440333333333334, + "terminal_flow": 0.6194833333333333, + "terminal_norm": 0.72605, + "terminal_packet": 0.720525 + }, + "ddos-icmp_fragmentation": { + "_n": 37.0, + "disc_nll_ch2": 0.6050162162162163, + "disc_nll_ch3": 0.4821783783783784, + "disc_nll_ch4": 0.5655513513513514, + "disc_nll_ch5": 0.47990270270270274, + "disc_nll_ch6": 0.6306324324324324, + "disc_nll_ch7": 0.5716324324324324, + "disc_nll_total": 0.6500162162162162, + "terminal_flow": 0.7816270270270272, + "terminal_norm": 0.8598702702702703, + "terminal_packet": 0.8797567567567568 + }, + "ddos-pshack_flood": { + "_n": 1030.0, + "disc_nll_ch2": 0.10922116504854368, + "disc_nll_ch3": 0.996820582524272, + "disc_nll_ch4": 0.976141359223301, + "disc_nll_ch5": 0.9404520388349514, + "disc_nll_ch6": 0.9985398058252426, + "disc_nll_ch7": 0.9954444660194175, + "disc_nll_total": 0.9986982524271846, + "terminal_flow": 0.9601757281553397, + "terminal_norm": 0.9873871844660195, + "terminal_packet": 0.993112427184466 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "disc_nll_ch2": 0.995, + "disc_nll_ch3": 0.7813, + "disc_nll_ch4": 0.9541999999999999, + "disc_nll_ch5": 0.09510000000000002, + "disc_nll_ch6": 0.9648, + "disc_nll_ch7": 0.3559, + "disc_nll_total": 0.9710000000000001, + "terminal_flow": 0.9561000000000001, + "terminal_norm": 0.8920999999999999, + "terminal_packet": 0.9601000000000001 + }, + "ddos-slowloris": { + "_n": 304.0, + "disc_nll_ch2": 0.8477052631578947, + "disc_nll_ch3": 0.8325532894736842, + "disc_nll_ch4": 0.8413039473684211, + "disc_nll_ch5": 0.8093065789473683, + "disc_nll_ch6": 0.9023223684210525, + "disc_nll_ch7": 0.7750875, + "disc_nll_total": 0.9402177631578947, + "terminal_flow": 0.9000289473684212, + "terminal_norm": 0.9401539473684211, + "terminal_packet": 0.9673467105263158 + }, + "ddos-syn_flood": { + "_n": 1195.0, + "disc_nll_ch2": 0.10245958158995817, + "disc_nll_ch3": 0.9345899581589958, + "disc_nll_ch4": 0.9336546443514644, + "disc_nll_ch5": 0.9750006694560669, + "disc_nll_ch6": 0.6323004184100418, + "disc_nll_ch7": 0.8868105439330544, + "disc_nll_total": 0.8803944769874475, + "terminal_flow": 0.9804525523012552, + "terminal_norm": 0.9974158995815899, + "terminal_packet": 0.9983678661087867 + }, + "ddos-synonymousip_flood": { + "_n": 164.0, + "disc_nll_ch2": 0.8774853658536584, + "disc_nll_ch3": 0.9995487804878049, + "disc_nll_ch4": 0.976998780487805, + "disc_nll_ch5": 0.9781292682926829, + "disc_nll_ch6": 0.7037756097560977, + "disc_nll_ch7": 0.9984585365853659, + "disc_nll_total": 0.9962231707317074, + "terminal_flow": 0.9999731707317073, + "terminal_norm": 0.9999548780487806, + "terminal_packet": 0.9991865853658537 + }, + "ddos-tcp_flood": { + "_n": 1255.0, + "disc_nll_ch2": 0.0011013545816732848, + "disc_nll_ch3": 0.9991963346613546, + "disc_nll_ch4": 0.9748473306772908, + "disc_nll_ch5": 0.9375098007968128, + "disc_nll_ch6": 0.9144930677290838, + "disc_nll_ch7": 0.9988576892430279, + "disc_nll_total": 0.9936860557768925, + "terminal_flow": 0.9608036653386454, + "terminal_norm": 0.9928487649402391, + "terminal_packet": 0.9982478087649402 + }, + "ddos-udp_flood": { + "_n": 15.0, + "disc_nll_ch2": 0.8056266666666667, + "disc_nll_ch3": 0.3421333333333334, + "disc_nll_ch4": 0.29384, + "disc_nll_ch5": 0.20163999999999999, + "disc_nll_ch6": 0.27366666666666667, + "disc_nll_ch7": 0.2504133333333334, + "disc_nll_total": 0.6853733333333333, + "terminal_flow": 0.93256, + "terminal_norm": 0.9647466666666666, + "terminal_packet": 0.9848 + }, + "ddos-udp_fragmentation": { + "_n": 21.0, + "disc_nll_ch2": 0.5578190476190475, + "disc_nll_ch3": 0.4748190476190476, + "disc_nll_ch4": 0.38025714285714285, + "disc_nll_ch5": 0.406747619047619, + "disc_nll_ch6": 0.44457142857142856, + "disc_nll_ch7": 0.4708380952380952, + "disc_nll_total": 0.5265428571428571, + "terminal_flow": 0.7322095238095238, + "terminal_norm": 0.8501714285714285, + "terminal_packet": 0.8972380952380952 + }, + "dictionarybruteforce": { + "_n": 21.0, + "disc_nll_ch2": 0.7745333333333333, + "disc_nll_ch3": 0.6673333333333333, + "disc_nll_ch4": 0.6623619047619047, + "disc_nll_ch5": 0.4496190476190476, + "disc_nll_ch6": 0.6334190476190477, + "disc_nll_ch7": 0.49192380952380954, + "disc_nll_total": 0.8015523809523809, + "terminal_flow": 0.8725809523809523, + "terminal_norm": 0.8883428571428571, + "terminal_packet": 0.8873714285714286 + }, + "dns_spoofing": { + "_n": 165.0, + "disc_nll_ch2": 0.4666878787878788, + "disc_nll_ch3": 0.5800557575757576, + "disc_nll_ch4": 0.47236242424242425, + "disc_nll_ch5": 0.33808969696969693, + "disc_nll_ch6": 0.5038218181818181, + "disc_nll_ch7": 0.4961890909090909, + "disc_nll_total": 0.5550151515151516, + "terminal_flow": 0.7651624242424241, + "terminal_norm": 0.7881939393939394, + "terminal_packet": 0.7562593939393939 + }, + "dos-http_flood": { + "_n": 716.0, + "disc_nll_ch2": 0.2943578212290503, + "disc_nll_ch3": 0.916508938547486, + "disc_nll_ch4": 0.9041896648044694, + "disc_nll_ch5": 0.9356527932960894, + "disc_nll_ch6": 0.9288036312849162, + "disc_nll_ch7": 0.9463965083798883, + "disc_nll_total": 0.9726561452513967, + "terminal_flow": 0.8895050279329609, + "terminal_norm": 0.9762561452513967, + "terminal_packet": 0.9851318435754189 + }, + "dos-syn_flood": { + "_n": 844.0, + "disc_nll_ch2": 0.8157175355450237, + "disc_nll_ch3": 0.9570338862559241, + "disc_nll_ch4": 0.8611017772511849, + "disc_nll_ch5": 0.9871113744075828, + "disc_nll_ch6": 0.6131125592417062, + "disc_nll_ch7": 0.9749175355450237, + "disc_nll_total": 0.9648943127962085, + "terminal_flow": 0.9598104265402844, + "terminal_norm": 0.9930661137440759, + "terminal_packet": 0.9965016587677725 + }, + "dos-tcp_flood": { + "_n": 1098.0, + "disc_nll_ch2": 0.6997714025500911, + "disc_nll_ch3": 0.936279781420765, + "disc_nll_ch4": 0.8400595628415299, + "disc_nll_ch5": 0.9802823315118396, + "disc_nll_ch6": 0.7106116575591986, + "disc_nll_ch7": 0.9973315118397086, + "disc_nll_total": 0.9898772313296904, + "terminal_flow": 0.9519537340619307, + "terminal_norm": 0.9903085610200365, + "terminal_packet": 0.9972265938069217 + }, + "dos-udp_flood": { + "_n": 177.0, + "disc_nll_ch2": 0.8428225988700566, + "disc_nll_ch3": 0.5987039548022599, + "disc_nll_ch4": 0.016516384180790968, + "disc_nll_ch5": 0.0056372881355932205, + "disc_nll_ch6": 0.005301694915254238, + "disc_nll_ch7": 0.11253333333333332, + "disc_nll_total": 0.6109084745762712, + "terminal_flow": 0.9807785310734463, + "terminal_norm": 0.9882677966101694, + "terminal_packet": 0.9979514124293786 + }, + "mirai-greeth_flood": { + "_n": 8.0, + "disc_nll_ch2": 0.6191, + "disc_nll_ch3": 0.43862500000000004, + "disc_nll_ch4": 0.332575, + "disc_nll_ch5": 0.44245, + "disc_nll_ch6": 0.42862500000000003, + "disc_nll_ch7": 0.413025, + "disc_nll_total": 0.5829000000000001, + "terminal_flow": 0.601875, + "terminal_norm": 0.658875, + "terminal_packet": 0.639675 + }, + "mirai-greip_flood": { + "_n": 29.0, + "disc_nll_ch2": 0.6405931034482757, + "disc_nll_ch3": 0.4861586206896552, + "disc_nll_ch4": 0.637648275862069, + "disc_nll_ch5": 0.5717448275862069, + "disc_nll_ch6": 0.6854896551724138, + "disc_nll_ch7": 0.6585586206896552, + "disc_nll_total": 0.7396068965517242, + "terminal_flow": 0.8877655172413793, + "terminal_norm": 0.9506827586206896, + "terminal_packet": 0.9616689655172415 + }, + "mirai-udpplain": { + "_n": 9.0, + "disc_nll_ch2": 0.7249777777777777, + "disc_nll_ch3": 0.5829555555555554, + "disc_nll_ch4": 0.5218888888888888, + "disc_nll_ch5": 0.5543111111111111, + "disc_nll_ch6": 0.6020222222222222, + "disc_nll_ch7": 0.5687333333333333, + "disc_nll_total": 0.8099555555555555, + "terminal_flow": 0.8362666666666666, + "terminal_norm": 0.8524444444444444, + "terminal_packet": 0.8747777777777778 + }, + "mitm-arpspoofing": { + "_n": 135.0, + "disc_nll_ch2": 0.6246192592592592, + "disc_nll_ch3": 0.38052444444444444, + "disc_nll_ch4": 0.5619725925925927, + "disc_nll_ch5": 0.3725318518518519, + "disc_nll_ch6": 0.5756244444444445, + "disc_nll_ch7": 0.5219548148148148, + "disc_nll_total": 0.5906962962962963, + "terminal_flow": 0.7632681481481481, + "terminal_norm": 0.8503822222222223, + "terminal_packet": 0.8495866666666665 + }, + "recon-hostdiscovery": { + "_n": 165.0, + "disc_nll_ch2": 0.5407072727272727, + "disc_nll_ch3": 0.7140218181818182, + "disc_nll_ch4": 0.7053915151515151, + "disc_nll_ch5": 0.6610072727272727, + "disc_nll_ch6": 0.6111418181818182, + "disc_nll_ch7": 0.6931454545454545, + "disc_nll_total": 0.744730303030303, + "terminal_flow": 0.7994896969696971, + "terminal_norm": 0.8558448484848485, + "terminal_packet": 0.8184266666666666 + }, + "recon-osscan": { + "_n": 368.0, + "disc_nll_ch2": 0.4392815217391305, + "disc_nll_ch3": 0.8299070652173913, + "disc_nll_ch4": 0.8042472826086957, + "disc_nll_ch5": 0.8023024456521739, + "disc_nll_ch6": 0.7097266304347826, + "disc_nll_ch7": 0.8490494565217391, + "disc_nll_total": 0.856099456521739, + "terminal_flow": 0.8617853260869566, + "terminal_norm": 0.9344869565217392, + "terminal_packet": 0.9339815217391304 + }, + "recon-pingsweep": { + "_n": 8.0, + "disc_nll_ch2": 0.70765, + "disc_nll_ch3": 0.3606, + "disc_nll_ch4": 0.40037500000000004, + "disc_nll_ch5": 0.39227500000000004, + "disc_nll_ch6": 0.46769999999999995, + "disc_nll_ch7": 0.47502500000000003, + "disc_nll_total": 0.66695, + "terminal_flow": 0.816375, + "terminal_norm": 0.924525, + "terminal_packet": 0.899125 + }, + "recon-portscan": { + "_n": 370.0, + "disc_nll_ch2": 0.4472686486486487, + "disc_nll_ch3": 0.8631737837837836, + "disc_nll_ch4": 0.8449013513513512, + "disc_nll_ch5": 0.8382659459459461, + "disc_nll_ch6": 0.7842975675675674, + "disc_nll_ch7": 0.8915281081081081, + "disc_nll_total": 0.8934827027027027, + "terminal_flow": 0.8793940540540539, + "terminal_norm": 0.9292075675675676, + "terminal_packet": 0.9250286486486485 + }, + "sqlinjection": { + "_n": 11.0, + "disc_nll_ch2": 0.4840363636363637, + "disc_nll_ch3": 0.40803636363636364, + "disc_nll_ch4": 0.5335636363636364, + "disc_nll_ch5": 0.4224181818181818, + "disc_nll_ch6": 0.5377818181818181, + "disc_nll_ch7": 0.5103090909090909, + "disc_nll_total": 0.4582727272727273, + "terminal_flow": 0.6882727272727273, + "terminal_norm": 0.8124727272727272, + "terminal_packet": 0.8053999999999999 + }, + "uploading_attack": { + "_n": 3.0, + "disc_nll_ch2": 0.6301333333333333, + "disc_nll_ch3": 0.01846666666666667, + "disc_nll_ch4": 0.3583333333333333, + "disc_nll_ch5": 0.42933333333333334, + "disc_nll_ch6": 0.4413333333333333, + "disc_nll_ch7": 0.42979999999999996, + "disc_nll_total": 0.6097333333333333, + "terminal_flow": 0.8730666666666665, + "terminal_norm": 0.9533333333333334, + "terminal_packet": 0.9788000000000001 + }, + "vulnerabilityscan": { + "_n": 568.0, + "disc_nll_ch2": 0.4755663732394366, + "disc_nll_ch3": 0.6214818661971832, + "disc_nll_ch4": 0.6710450704225351, + "disc_nll_ch5": 0.6622857394366197, + "disc_nll_ch6": 0.6357633802816902, + "disc_nll_ch7": 0.6763827464788732, + "disc_nll_total": 0.6661815140845071, + "terminal_flow": 0.7236792253521126, + "terminal_norm": 0.8026088028169014, + "terminal_packet": 0.8093366197183098 + }, + "xss": { + "_n": 10.0, + "disc_nll_ch2": 0.59674, + "disc_nll_ch3": 0.5668, + "disc_nll_ch4": 0.47428, + "disc_nll_ch5": 0.36056, + "disc_nll_ch6": 0.5030399999999999, + "disc_nll_ch7": 0.39168000000000003, + "disc_nll_total": 0.61192, + "terminal_flow": 0.8780600000000001, + "terminal_norm": 0.87744, + "terminal_packet": 0.8008 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/config.yaml b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/config.yaml new file mode 100644 index 0000000..8f8e8b8 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/config.yaml @@ -0,0 +1,35 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 43 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43 +seed: 43 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/history.json b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/history.json new file mode 100644 index 0000000..14b7ff2 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.35255089478615, + 1.0229487877625685, + 0.814682431710072, + 0.6832699240782322, + 0.5982655409054879, + 0.5382934495424613, + 0.505637777157319, + 0.4754168712175809, + 0.4530838628609975, + 0.4327119604135171, + 0.4260847897101671, + 0.3998578572884584, + 0.39575607960040754, + 0.3743888239065806, + 0.37204300058193696, + 0.3664136200379103, + 0.3570109093800569, + 0.35006733811818636, + 0.34356084160315686, + 0.33781376022558945, + 0.33005379484249997, + 0.33045959319823826, + 0.3249832154848637, + 0.31572606701117295, + 0.3154842616655888, + 0.31734910148840684, + 0.31343468412374836, + 0.30184830534152496, + 0.30067308017840755, + 0.29727514202778155, + 0.29380372090217394, + 0.2986187048447438, + 0.2964024845606241, + 0.29161906013121974, + 0.29201429470991475, + 0.2917258151066609, + 0.2888767146147214, + 0.2857792706061632, + 0.28637102742989856, + 0.28260775483571565, + 0.2873204453633382, + 0.2897401417677219, + 0.28482922988060194, + 0.28515655986773664, + 0.2838776027544951, + 0.28321357033191585, + 0.2778308743085617, + 0.2858266700536777, + 0.2840514259460645, + 0.2803196700719687 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.28186696499999997, + "auroc_disc_nll_ch3": 0.83180524, + "auroc_disc_nll_ch4": 0.65117499, + "auroc_disc_nll_ch5": 0.8352857325, + "auroc_disc_nll_ch6": 0.6768126125, + "auroc_disc_nll_ch7": 0.899254635, + "auroc_disc_nll_total": 0.860670955, + "auroc_terminal_flow": 0.9119455925, + "auroc_terminal_norm": 0.9473361599999999, + "auroc_terminal_packet": 0.9496298025000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.36985331499999996, + "auroc_disc_nll_ch3": 0.893616405, + "auroc_disc_nll_ch4": 0.76981593, + "auroc_disc_nll_ch5": 0.872671345, + "auroc_disc_nll_ch6": 0.58500431, + "auroc_disc_nll_ch7": 0.920584125, + "auroc_disc_nll_total": 0.8750449424999999, + "auroc_terminal_flow": 0.918967425, + "auroc_terminal_norm": 0.9564705499999999, + "auroc_terminal_packet": 0.958190445 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.45417275999999995, + "auroc_disc_nll_ch3": 0.8534690975, + "auroc_disc_nll_ch4": 0.8228265749999999, + "auroc_disc_nll_ch5": 0.8654120475, + "auroc_disc_nll_ch6": 0.680100365, + "auroc_disc_nll_ch7": 0.9052933650000001, + "auroc_disc_nll_total": 0.8906287225, + "auroc_terminal_flow": 0.9221853225000001, + "auroc_terminal_norm": 0.9531496375, + "auroc_terminal_packet": 0.96114776 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.470933545, + "auroc_disc_nll_ch3": 0.8693676449999999, + "auroc_disc_nll_ch4": 0.8495964574999999, + "auroc_disc_nll_ch5": 0.8617935975, + "auroc_disc_nll_ch6": 0.73999828, + "auroc_disc_nll_ch7": 0.9129725575, + "auroc_disc_nll_total": 0.902283425, + "auroc_terminal_flow": 0.91805508, + "auroc_terminal_norm": 0.9566632724999999, + "auroc_terminal_packet": 0.9633923425 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.4750567925, + "auroc_disc_nll_ch3": 0.8672911824999999, + "auroc_disc_nll_ch4": 0.8428749675, + "auroc_disc_nll_ch5": 0.8595256375, + "auroc_disc_nll_ch6": 0.7362460475, + "auroc_disc_nll_ch7": 0.9066067425, + "auroc_disc_nll_total": 0.8958570349999999, + "auroc_terminal_flow": 0.9214929025, + "auroc_terminal_norm": 0.9575802174999999, + "auroc_terminal_packet": 0.96631694 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/model.pt b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/model.pt new file mode 100644 index 0000000..815d51b Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/model.pt differ diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/phase1.log b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/phase1.log new file mode 100644 index 0000000..a3ead85 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/phase1.log @@ -0,0 +1,69 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] kept 3,797,530 of 8,193,621 (min_len=2) +[data] train=77,636 val=10,000 attack=20,000 +[data] val=10,000 attack=20,000 +[eval] scoring val=5,000 atk=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.1s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] atk done 3.5s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/phase1_scores.npz b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/phase1_scores.npz new file mode 100644 index 0000000..f03d4ed Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/phase1_summary.json b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/phase1_summary.json new file mode 100644 index 0000000..02ed76b --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed43/phase1_summary.json @@ -0,0 +1,475 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.47195422, + "auprc": 0.7203379038798527 + }, + "disc_nll_ch3": { + "auroc": 0.8689585000000001, + "auprc": 0.9398126728160268 + }, + "disc_nll_ch4": { + "auroc": 0.8442272399999999, + "auprc": 0.9152576074808114 + }, + "disc_nll_ch5": { + "auroc": 0.8601446700000001, + "auprc": 0.9355678519281496 + }, + "disc_nll_ch6": { + "auroc": 0.73911466, + "auprc": 0.8428435455800742 + }, + "disc_nll_ch7": { + "auroc": 0.9070101800000001, + "auprc": 0.958541691451408 + }, + "disc_nll_total": { + "auroc": 0.8952268800000001, + "auprc": 0.9523699808246733 + }, + "terminal_flow": { + "auroc": 0.9219756, + "auprc": 0.940368211614934 + }, + "terminal_norm": { + "auroc": 0.96088709, + "auprc": 0.9784897632557201 + }, + "terminal_packet": { + "auroc": 0.9674055499999998, + "auprc": 0.9832033583827179 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 9.0, + "disc_nll_ch2": 0.6824222222222223, + "disc_nll_ch3": 0.2753777777777777, + "disc_nll_ch4": 0.4288666666666666, + "disc_nll_ch5": 0.44455555555555554, + "disc_nll_ch6": 0.5358888888888889, + "disc_nll_ch7": 0.5072666666666668, + "disc_nll_total": 0.6258222222222223, + "terminal_flow": 0.822888888888889, + "terminal_norm": 0.9141555555555556, + "terminal_packet": 0.9481999999999999 + }, + "browserhijacking": { + "_n": 3.0, + "disc_nll_ch2": 0.5084, + "disc_nll_ch3": 0.3675999999999999, + "disc_nll_ch4": 0.4284, + "disc_nll_ch5": 0.3958666666666667, + "disc_nll_ch6": 0.23586666666666672, + "disc_nll_ch7": 0.31126666666666664, + "disc_nll_total": 0.5149999999999999, + "terminal_flow": 0.8413999999999999, + "terminal_norm": 0.8948666666666666, + "terminal_packet": 0.8634666666666667 + }, + "commandinjection": { + "_n": 13.0, + "disc_nll_ch2": 0.6531461538461538, + "disc_nll_ch3": 0.46029999999999993, + "disc_nll_ch4": 0.41588461538461535, + "disc_nll_ch5": 0.30391538461538464, + "disc_nll_ch6": 0.4764846153846154, + "disc_nll_ch7": 0.42248461538461535, + "disc_nll_total": 0.6958846153846154, + "terminal_flow": 0.8605153846153846, + "terminal_norm": 0.8464538461538461, + "terminal_packet": 0.8367153846153846 + }, + "ddos-ack_fragmentation": { + "_n": 316.0, + "disc_nll_ch2": 0.13455379746835444, + "disc_nll_ch3": 0.40743544303797474, + "disc_nll_ch4": 0.7333132911392405, + "disc_nll_ch5": 0.7922930379746835, + "disc_nll_ch6": 0.9361044303797468, + "disc_nll_ch7": 0.9509537974683544, + "disc_nll_total": 0.9642221518987342, + "terminal_flow": 0.9858721518987341, + "terminal_norm": 0.9921335443037974, + "terminal_packet": 0.9897822784810126 + }, + "ddos-http_flood": { + "_n": 915.0, + "disc_nll_ch2": 0.4194045901639344, + "disc_nll_ch3": 0.9443068852459016, + "disc_nll_ch4": 0.8897986885245901, + "disc_nll_ch5": 0.8649114754098362, + "disc_nll_ch6": 0.7320918032786885, + "disc_nll_ch7": 0.948470601092896, + "disc_nll_total": 0.9675637158469945, + "terminal_flow": 0.938216830601093, + "terminal_norm": 0.987072568306011, + "terminal_packet": 0.9933818579234973 + }, + "ddos-icmp_flood": { + "_n": 20.0, + "disc_nll_ch2": 0.46537, + "disc_nll_ch3": 0.3924000000000001, + "disc_nll_ch4": 0.58684, + "disc_nll_ch5": 0.64653, + "disc_nll_ch6": 0.6059699999999999, + "disc_nll_ch7": 0.68674, + "disc_nll_total": 0.6067799999999999, + "terminal_flow": 0.6472799999999999, + "terminal_norm": 0.77093, + "terminal_packet": 0.79295 + }, + "ddos-icmp_fragmentation": { + "_n": 38.0, + "disc_nll_ch2": 0.6046684210526315, + "disc_nll_ch3": 0.28964736842105265, + "disc_nll_ch4": 0.42849473684210526, + "disc_nll_ch5": 0.4527842105263158, + "disc_nll_ch6": 0.5157526315789474, + "disc_nll_ch7": 0.6087315789473684, + "disc_nll_total": 0.5640052631578947, + "terminal_flow": 0.720842105263158, + "terminal_norm": 0.8447736842105261, + "terminal_packet": 0.8628210526315788 + }, + "ddos-pshack_flood": { + "_n": 1046.0, + "disc_nll_ch2": 0.38420630975143405, + "disc_nll_ch3": 0.9945378585086042, + "disc_nll_ch4": 0.9946969407265774, + "disc_nll_ch5": 0.9703847036328872, + "disc_nll_ch6": 0.999689101338432, + "disc_nll_ch7": 0.9914613766730402, + "disc_nll_total": 0.999927533460803, + "terminal_flow": 0.9500399617590821, + "terminal_norm": 0.9744011472275335, + "terminal_packet": 0.9819359464627152 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "disc_nll_ch2": 0.20590000000000003, + "disc_nll_ch3": 0.3931, + "disc_nll_ch4": 0.21499999999999997, + "disc_nll_ch5": 0.5707, + "disc_nll_ch6": 0.43620000000000003, + "disc_nll_ch7": 0.42210000000000003, + "disc_nll_total": 0.2294, + "terminal_flow": 0.1875, + "terminal_norm": 0.5209999999999999, + "terminal_packet": 0.6779 + }, + "ddos-slowloris": { + "_n": 314.0, + "disc_nll_ch2": 0.8430898089171975, + "disc_nll_ch3": 0.800315923566879, + "disc_nll_ch4": 0.8481254777070064, + "disc_nll_ch5": 0.8331136942675159, + "disc_nll_ch6": 0.897668152866242, + "disc_nll_ch7": 0.8340490445859872, + "disc_nll_total": 0.924673566878981, + "terminal_flow": 0.8891452229299364, + "terminal_norm": 0.9412987261146497, + "terminal_packet": 0.9697496815286625 + }, + "ddos-syn_flood": { + "_n": 1141.0, + "disc_nll_ch2": 0.12888028045574057, + "disc_nll_ch3": 0.9369693251533743, + "disc_nll_ch4": 0.8843318141980718, + "disc_nll_ch5": 0.91291393514461, + "disc_nll_ch6": 0.6474795793163891, + "disc_nll_ch7": 0.8789263803680981, + "disc_nll_total": 0.76036967572305, + "terminal_flow": 0.9720631025416301, + "terminal_norm": 0.9966958808063102, + "terminal_packet": 0.9979223488168273 + }, + "ddos-synonymousip_flood": { + "_n": 182.0, + "disc_nll_ch2": 0.8480923076923076, + "disc_nll_ch3": 0.9611868131868131, + "disc_nll_ch4": 0.7791890109890109, + "disc_nll_ch5": 0.6899483516483516, + "disc_nll_ch6": 0.620423076923077, + "disc_nll_ch7": 0.9760747252747253, + "disc_nll_total": 0.8753406593406594, + "terminal_flow": 0.9989021978021979, + "terminal_norm": 0.9989197802197802, + "terminal_packet": 0.9986714285714285 + }, + "ddos-tcp_flood": { + "_n": 1224.0, + "disc_nll_ch2": 0.3535862745098039, + "disc_nll_ch3": 0.995979411764706, + "disc_nll_ch4": 0.9933754901960785, + "disc_nll_ch5": 0.969202614379085, + "disc_nll_ch6": 0.9132913398692812, + "disc_nll_ch7": 0.998561274509804, + "disc_nll_total": 0.994877614379085, + "terminal_flow": 0.9463124183006537, + "terminal_norm": 0.9813117647058823, + "terminal_packet": 0.9911620915032681 + }, + "ddos-udp_flood": { + "_n": 10.0, + "disc_nll_ch2": 0.72192, + "disc_nll_ch3": 0.365, + "disc_nll_ch4": 0.61866, + "disc_nll_ch5": 0.29144, + "disc_nll_ch6": 0.37526, + "disc_nll_ch7": 0.33834, + "disc_nll_total": 0.68174, + "terminal_flow": 0.95924, + "terminal_norm": 0.9846400000000001, + "terminal_packet": 0.9952000000000001 + }, + "ddos-udp_fragmentation": { + "_n": 26.0, + "disc_nll_ch2": 0.5043384615384616, + "disc_nll_ch3": 0.5056384615384616, + "disc_nll_ch4": 0.29268461538461543, + "disc_nll_ch5": 0.24041538461538464, + "disc_nll_ch6": 0.38830769230769235, + "disc_nll_ch7": 0.3760307692307693, + "disc_nll_total": 0.5079461538461538, + "terminal_flow": 0.8086153846153846, + "terminal_norm": 0.8540153846153845, + "terminal_packet": 0.8475615384615385 + }, + "dictionarybruteforce": { + "_n": 19.0, + "disc_nll_ch2": 0.5366736842105263, + "disc_nll_ch3": 0.4318210526315789, + "disc_nll_ch4": 0.4531684210526316, + "disc_nll_ch5": 0.3267368421052631, + "disc_nll_ch6": 0.46473684210526317, + "disc_nll_ch7": 0.4822947368421052, + "disc_nll_total": 0.5385684210526316, + "terminal_flow": 0.8075684210526316, + "terminal_norm": 0.8541894736842105, + "terminal_packet": 0.8429473684210526 + }, + "dns_spoofing": { + "_n": 185.0, + "disc_nll_ch2": 0.4503524324324324, + "disc_nll_ch3": 0.5416724324324325, + "disc_nll_ch4": 0.5155324324324324, + "disc_nll_ch5": 0.34951891891891895, + "disc_nll_ch6": 0.4921232432432433, + "disc_nll_ch7": 0.5059843243243244, + "disc_nll_total": 0.5762064864864865, + "terminal_flow": 0.7647102702702702, + "terminal_norm": 0.8140335135135135, + "terminal_packet": 0.7981448648648648 + }, + "dos-http_flood": { + "_n": 704.0, + "disc_nll_ch2": 0.27128636363636366, + "disc_nll_ch3": 0.8875974431818181, + "disc_nll_ch4": 0.9069805397727272, + "disc_nll_ch5": 0.9417232954545455, + "disc_nll_ch6": 0.9086838068181818, + "disc_nll_ch7": 0.9623852272727272, + "disc_nll_total": 0.9766414772727272, + "terminal_flow": 0.9471701704545454, + "terminal_norm": 0.9861488636363637, + "terminal_packet": 0.9887471590909092 + }, + "dos-syn_flood": { + "_n": 874.0, + "disc_nll_ch2": 0.8205910755148742, + "disc_nll_ch3": 0.9431006864988559, + "disc_nll_ch4": 0.7627265446224256, + "disc_nll_ch5": 0.9769292906178489, + "disc_nll_ch6": 0.5856951945080092, + "disc_nll_ch7": 0.9781407322654463, + "disc_nll_total": 0.9529338672768878, + "terminal_flow": 0.9606887871853548, + "terminal_norm": 0.9945176201372997, + "terminal_packet": 0.998079405034325 + }, + "dos-tcp_flood": { + "_n": 1076.0, + "disc_nll_ch2": 0.8417161710037175, + "disc_nll_ch3": 0.954871375464684, + "disc_nll_ch4": 0.9642052044609666, + "disc_nll_ch5": 0.989986059479554, + "disc_nll_ch6": 0.760985687732342, + "disc_nll_ch7": 0.9985042750929367, + "disc_nll_total": 0.9936981412639405, + "terminal_flow": 0.9529276022304832, + "terminal_norm": 0.9858265799256506, + "terminal_packet": 0.993228252788104 + }, + "dos-udp_flood": { + "_n": 201.0, + "disc_nll_ch2": 0.5327253731343284, + "disc_nll_ch3": 0.666281592039801, + "disc_nll_ch4": 0.5297990049751244, + "disc_nll_ch5": 0.0201323383084577, + "disc_nll_ch6": 0.07877213930348256, + "disc_nll_ch7": 0.6362626865671642, + "disc_nll_total": 0.5341233830845771, + "terminal_flow": 0.9755512437810945, + "terminal_norm": 0.9707990049751244, + "terminal_packet": 0.9927293532338308 + }, + "mirai-greeth_flood": { + "_n": 16.0, + "disc_nll_ch2": 0.615675, + "disc_nll_ch3": 0.33965000000000006, + "disc_nll_ch4": 0.2968875, + "disc_nll_ch5": 0.347375, + "disc_nll_ch6": 0.354225, + "disc_nll_ch7": 0.348, + "disc_nll_total": 0.519825, + "terminal_flow": 0.5345624999999999, + "terminal_norm": 0.6004249999999999, + "terminal_packet": 0.6172000000000001 + }, + "mirai-greip_flood": { + "_n": 25.0, + "disc_nll_ch2": 0.579, + "disc_nll_ch3": 0.466568, + "disc_nll_ch4": 0.436168, + "disc_nll_ch5": 0.47120799999999996, + "disc_nll_ch6": 0.5780719999999999, + "disc_nll_ch7": 0.6177919999999999, + "disc_nll_total": 0.7136480000000001, + "terminal_flow": 0.845248, + "terminal_norm": 0.924144, + "terminal_packet": 0.9410959999999999 + }, + "mirai-udpplain": { + "_n": 8.0, + "disc_nll_ch2": 0.5824499999999999, + "disc_nll_ch3": 0.4376, + "disc_nll_ch4": 0.4611, + "disc_nll_ch5": 0.57085, + "disc_nll_ch6": 0.610425, + "disc_nll_ch7": 0.6832750000000001, + "disc_nll_total": 0.7939, + "terminal_flow": 0.853925, + "terminal_norm": 0.9055000000000001, + "terminal_packet": 0.8892 + }, + "mitm-arpspoofing": { + "_n": 137.0, + "disc_nll_ch2": 0.5565226277372263, + "disc_nll_ch3": 0.35895766423357667, + "disc_nll_ch4": 0.5432255474452555, + "disc_nll_ch5": 0.462029197080292, + "disc_nll_ch6": 0.6043452554744526, + "disc_nll_ch7": 0.607785401459854, + "disc_nll_total": 0.5976569343065694, + "terminal_flow": 0.7765591240875912, + "terminal_norm": 0.8640817518248176, + "terminal_packet": 0.8706204379562044 + }, + "recon-hostdiscovery": { + "_n": 163.0, + "disc_nll_ch2": 0.4691815950920245, + "disc_nll_ch3": 0.6949374233128836, + "disc_nll_ch4": 0.632360736196319, + "disc_nll_ch5": 0.7290711656441717, + "disc_nll_ch6": 0.5595656441717791, + "disc_nll_ch7": 0.7109472392638037, + "disc_nll_total": 0.7314208588957055, + "terminal_flow": 0.7548294478527606, + "terminal_norm": 0.8234134969325154, + "terminal_packet": 0.8034343558282209 + }, + "recon-osscan": { + "_n": 352.0, + "disc_nll_ch2": 0.46050681818181827, + "disc_nll_ch3": 0.8309346590909091, + "disc_nll_ch4": 0.7209448863636363, + "disc_nll_ch5": 0.8206301136363636, + "disc_nll_ch6": 0.5126909090909091, + "disc_nll_ch7": 0.8516170454545454, + "disc_nll_total": 0.867996590909091, + "terminal_flow": 0.8789136363636363, + "terminal_norm": 0.9417119318181818, + "terminal_packet": 0.94715 + }, + "recon-pingsweep": { + "_n": 4.0, + "disc_nll_ch2": 0.6587, + "disc_nll_ch3": 0.6417999999999999, + "disc_nll_ch4": 0.7421, + "disc_nll_ch5": 0.5247499999999999, + "disc_nll_ch6": 0.69285, + "disc_nll_ch7": 0.64415, + "disc_nll_total": 0.7024000000000001, + "terminal_flow": 0.69765, + "terminal_norm": 0.9550500000000001, + "terminal_packet": 0.9913 + }, + "recon-portscan": { + "_n": 385.0, + "disc_nll_ch2": 0.4355994805194805, + "disc_nll_ch3": 0.8608628571428572, + "disc_nll_ch4": 0.7311477922077922, + "disc_nll_ch5": 0.8659935064935065, + "disc_nll_ch6": 0.5907345454545454, + "disc_nll_ch7": 0.8995184415584416, + "disc_nll_total": 0.9017818181818181, + "terminal_flow": 0.8950306493506492, + "terminal_norm": 0.9487942857142858, + "terminal_packet": 0.959051948051948 + }, + "sqlinjection": { + "_n": 11.0, + "disc_nll_ch2": 0.7497454545454546, + "disc_nll_ch3": 0.5730363636363636, + "disc_nll_ch4": 0.6814909090909091, + "disc_nll_ch5": 0.5351818181818182, + "disc_nll_ch6": 0.7406545454545455, + "disc_nll_ch7": 0.6177272727272727, + "disc_nll_total": 0.7398545454545454, + "terminal_flow": 0.7271272727272727, + "terminal_norm": 0.8423454545454546, + "terminal_packet": 0.9055272727272727 + }, + "uploading_attack": { + "_n": 2.0, + "disc_nll_ch2": 0.4822, + "disc_nll_ch3": 0.6357, + "disc_nll_ch4": 0.536, + "disc_nll_ch5": 0.0721, + "disc_nll_ch6": 0.7998, + "disc_nll_ch7": 0.7013, + "disc_nll_total": 0.7005, + "terminal_flow": 0.9510000000000001, + "terminal_norm": 0.8661, + "terminal_packet": 0.8338 + }, + "vulnerabilityscan": { + "_n": 567.0, + "disc_nll_ch2": 0.4925560846560847, + "disc_nll_ch3": 0.6265977072310405, + "disc_nll_ch4": 0.6479853615520283, + "disc_nll_ch5": 0.6777068783068783, + "disc_nll_ch6": 0.6291463844797178, + "disc_nll_ch7": 0.7240462081128748, + "disc_nll_total": 0.6908320987654321, + "terminal_flow": 0.7204455026455027, + "terminal_norm": 0.8008846560846561, + "terminal_packet": 0.8172116402116403 + }, + "xss": { + "_n": 12.0, + "disc_nll_ch2": 0.5152166666666668, + "disc_nll_ch3": 0.39976666666666666, + "disc_nll_ch4": 0.4955666666666667, + "disc_nll_ch5": 0.3604333333333334, + "disc_nll_ch6": 0.65985, + "disc_nll_ch7": 0.6417666666666667, + "disc_nll_total": 0.57275, + "terminal_flow": 0.7809833333333333, + "terminal_norm": 0.8587499999999999, + "terminal_packet": 0.8759666666666667 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/config.yaml b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/config.yaml new file mode 100644 index 0000000..3b3e35c --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/config.yaml @@ -0,0 +1,35 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 44 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44 +seed: 44 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/history.json b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/history.json new file mode 100644 index 0000000..4b05bb9 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.3563822844089606, + 1.0203708929893298, + 0.822082397265312, + 0.6900521440383716, + 0.5951905281115801, + 0.5357616742451986, + 0.5013646070773785, + 0.47729267982336193, + 0.4561128119627635, + 0.42943872549594975, + 0.4164709792687343, + 0.39692185933773333, + 0.3969619488104796, + 0.38878022325344574, + 0.37115560663052094, + 0.36809116907608813, + 0.35623013973236084, + 0.35014645487834245, + 0.34665454885898495, + 0.3345312101718707, + 0.33900956924145037, + 0.32956158579924166, + 0.3245345163039672, + 0.3261544482830243, + 0.3189471837801811, + 0.31144371781593716, + 0.30972845814166927, + 0.3124387875581399, + 0.29881782065599394, + 0.30177197624475527, + 0.30279111862182617, + 0.3024083169607016, + 0.2963612324152237, + 0.2962083373314295, + 0.28887358002173597, + 0.28882795916153836, + 0.2920973079326825, + 0.2933601866929959, + 0.2890122276850236, + 0.28719204587814134, + 0.2824632208316754, + 0.28204045502039105, + 0.28056037234954345, + 0.28774339992266434, + 0.2878645108296321, + 0.27918315124817383, + 0.28149991157727366, + 0.2846956784144426, + 0.2854761569163738, + 0.2830487535550044 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.27530300499999993, + "auroc_disc_nll_ch3": 0.7934630949999999, + "auroc_disc_nll_ch4": 0.589169685, + "auroc_disc_nll_ch5": 0.7624557325, + "auroc_disc_nll_ch6": 0.6705569875, + "auroc_disc_nll_ch7": 0.8850768349999999, + "auroc_disc_nll_total": 0.8468859599999999, + "auroc_terminal_flow": 0.9006717025000001, + "auroc_terminal_norm": 0.9419992, + "auroc_terminal_packet": 0.9501101850000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.465725985, + "auroc_disc_nll_ch3": 0.8453297675, + "auroc_disc_nll_ch4": 0.616990145, + "auroc_disc_nll_ch5": 0.6314532875000001, + "auroc_disc_nll_ch6": 0.598507455, + "auroc_disc_nll_ch7": 0.8947576125, + "auroc_disc_nll_total": 0.87879275, + "auroc_terminal_flow": 0.91345529, + "auroc_terminal_norm": 0.95218849, + "auroc_terminal_packet": 0.957711475 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.42068871, + "auroc_disc_nll_ch3": 0.84643475, + "auroc_disc_nll_ch4": 0.76926278, + "auroc_disc_nll_ch5": 0.7857116725, + "auroc_disc_nll_ch6": 0.6977113575, + "auroc_disc_nll_ch7": 0.8827177549999999, + "auroc_disc_nll_total": 0.87332687, + "auroc_terminal_flow": 0.90635305, + "auroc_terminal_norm": 0.9556994624999999, + "auroc_terminal_packet": 0.9607960950000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.4406437475, + "auroc_disc_nll_ch3": 0.8195224050000001, + "auroc_disc_nll_ch4": 0.809538095, + "auroc_disc_nll_ch5": 0.7870710675, + "auroc_disc_nll_ch6": 0.7401474825000001, + "auroc_disc_nll_ch7": 0.891673545, + "auroc_disc_nll_total": 0.8866812774999999, + "auroc_terminal_flow": 0.9095687450000001, + "auroc_terminal_norm": 0.956268145, + "auroc_terminal_packet": 0.9679873575000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.4681385425, + "auroc_disc_nll_ch3": 0.8254060025000001, + "auroc_disc_nll_ch4": 0.8148967775, + "auroc_disc_nll_ch5": 0.8202599925, + "auroc_disc_nll_ch6": 0.723773865, + "auroc_disc_nll_ch7": 0.8860086925, + "auroc_disc_nll_total": 0.89196953, + "auroc_terminal_flow": 0.914127225, + "auroc_terminal_norm": 0.957011445, + "auroc_terminal_packet": 0.96652143 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/model.pt b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/model.pt new file mode 100644 index 0000000..ba86b22 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/model.pt differ diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/phase1.log b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/phase1.log new file mode 100644 index 0000000..1774d61 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/phase1.log @@ -0,0 +1,69 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] kept 3,797,530 of 8,193,621 (min_len=2) +[data] train=77,636 val=10,000 attack=20,000 +[data] val=10,000 attack=20,000 +[eval] scoring val=5,000 atk=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.0s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] atk done 3.5s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/phase1_scores.npz b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/phase1_scores.npz new file mode 100644 index 0000000..595ceed Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/phase1_summary.json b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/phase1_summary.json new file mode 100644 index 0000000..5c752aa --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_ciciot2023_seed44/phase1_summary.json @@ -0,0 +1,475 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.46673217, + "auprc": 0.7233470832912386 + }, + "disc_nll_ch3": { + "auroc": 0.8258304000000001, + "auprc": 0.9121820387765203 + }, + "disc_nll_ch4": { + "auroc": 0.81393012, + "auprc": 0.8794953997078989 + }, + "disc_nll_ch5": { + "auroc": 0.8180615, + "auprc": 0.9112032201213056 + }, + "disc_nll_ch6": { + "auroc": 0.72122194, + "auprc": 0.826962064219632 + }, + "disc_nll_ch7": { + "auroc": 0.88460267, + "auprc": 0.9501779521399945 + }, + "disc_nll_total": { + "auroc": 0.89012188, + "auprc": 0.9474730584069293 + }, + "terminal_flow": { + "auroc": 0.91442856, + "auprc": 0.9393258362491842 + }, + "terminal_norm": { + "auroc": 0.9574672200000001, + "auprc": 0.9764642243239419 + }, + "terminal_packet": { + "auroc": 0.9668456400000001, + "auprc": 0.9847654319187034 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 7.0, + "disc_nll_ch2": 0.5877428571428571, + "disc_nll_ch3": 0.42122857142857145, + "disc_nll_ch4": 0.39411428571428564, + "disc_nll_ch5": 0.3932857142857143, + "disc_nll_ch6": 0.43697142857142857, + "disc_nll_ch7": 0.31339999999999996, + "disc_nll_total": 0.6131428571428572, + "terminal_flow": 0.8094, + "terminal_norm": 0.9387428571428572, + "terminal_packet": 0.8762 + }, + "browserhijacking": { + "_n": 9.0, + "disc_nll_ch2": 0.7237333333333333, + "disc_nll_ch3": 0.5392222222222223, + "disc_nll_ch4": 0.5743333333333334, + "disc_nll_ch5": 0.41575555555555554, + "disc_nll_ch6": 0.5814222222222223, + "disc_nll_ch7": 0.5384666666666666, + "disc_nll_total": 0.7116222222222223, + "terminal_flow": 0.7209555555555556, + "terminal_norm": 0.7603333333333334, + "terminal_packet": 0.7623333333333334 + }, + "commandinjection": { + "_n": 11.0, + "disc_nll_ch2": 0.5567090909090909, + "disc_nll_ch3": 0.41958181818181817, + "disc_nll_ch4": 0.3407090909090909, + "disc_nll_ch5": 0.3397636363636364, + "disc_nll_ch6": 0.5820363636363637, + "disc_nll_ch7": 0.5065636363636363, + "disc_nll_total": 0.5405272727272727, + "terminal_flow": 0.8608363636363637, + "terminal_norm": 0.9241818181818182, + "terminal_packet": 0.9423454545454545 + }, + "ddos-ack_fragmentation": { + "_n": 340.0, + "disc_nll_ch2": 0.4695964705882353, + "disc_nll_ch3": 0.34929235294117644, + "disc_nll_ch4": 0.626050294117647, + "disc_nll_ch5": 0.7927558823529413, + "disc_nll_ch6": 0.9540952941176469, + "disc_nll_ch7": 0.9640947058823528, + "disc_nll_total": 0.9570076470588234, + "terminal_flow": 0.9773470588235295, + "terminal_norm": 0.9859982352941177, + "terminal_packet": 0.9843370588235294 + }, + "ddos-http_flood": { + "_n": 893.0, + "disc_nll_ch2": 0.3580564389697648, + "disc_nll_ch3": 0.9456709966405374, + "disc_nll_ch4": 0.9210739081746921, + "disc_nll_ch5": 0.9116531914893616, + "disc_nll_ch6": 0.85545195968645, + "disc_nll_ch7": 0.9505816349384097, + "disc_nll_total": 0.9725424412094065, + "terminal_flow": 0.9086134378499441, + "terminal_norm": 0.982869652855543, + "terminal_packet": 0.994404255319149 + }, + "ddos-icmp_flood": { + "_n": 20.0, + "disc_nll_ch2": 0.5569599999999999, + "disc_nll_ch3": 0.53844, + "disc_nll_ch4": 0.49064, + "disc_nll_ch5": 0.53641, + "disc_nll_ch6": 0.50733, + "disc_nll_ch7": 0.5589700000000002, + "disc_nll_total": 0.62736, + "terminal_flow": 0.66876, + "terminal_norm": 0.75312, + "terminal_packet": 0.7658999999999999 + }, + "ddos-icmp_fragmentation": { + "_n": 35.0, + "disc_nll_ch2": 0.6757771428571431, + "disc_nll_ch3": 0.30448, + "disc_nll_ch4": 0.39508, + "disc_nll_ch5": 0.40423428571428577, + "disc_nll_ch6": 0.4534285714285714, + "disc_nll_ch7": 0.41807428571428573, + "disc_nll_total": 0.6070628571428571, + "terminal_flow": 0.7555885714285714, + "terminal_norm": 0.8812342857142857, + "terminal_packet": 0.9156857142857143 + }, + "ddos-pshack_flood": { + "_n": 1065.0, + "disc_nll_ch2": 0.4854213145539906, + "disc_nll_ch3": 0.973506103286385, + "disc_nll_ch4": 0.9757361502347418, + "disc_nll_ch5": 0.8392499530516433, + "disc_nll_ch6": 0.9999924882629109, + "disc_nll_ch7": 0.9946313615023475, + "disc_nll_total": 0.9993333333333334, + "terminal_flow": 0.9507661971830986, + "terminal_norm": 0.9779468544600939, + "terminal_packet": 0.9923372769953052 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "disc_nll_ch2": 0.6177, + "disc_nll_ch3": 0.49905, + "disc_nll_ch4": 0.6102, + "disc_nll_ch5": 0.5605, + "disc_nll_ch6": 0.6549, + "disc_nll_ch7": 0.6201, + "disc_nll_total": 0.6208, + "terminal_flow": 0.5536, + "terminal_norm": 0.7121, + "terminal_packet": 0.7724 + }, + "ddos-slowloris": { + "_n": 336.0, + "disc_nll_ch2": 0.8360684523809525, + "disc_nll_ch3": 0.7871485119047619, + "disc_nll_ch4": 0.8530470238095238, + "disc_nll_ch5": 0.8523699404761904, + "disc_nll_ch6": 0.895870238095238, + "disc_nll_ch7": 0.7344440476190477, + "disc_nll_total": 0.9271005952380951, + "terminal_flow": 0.8886303571428572, + "terminal_norm": 0.9353821428571427, + "terminal_packet": 0.9616613095238095 + }, + "ddos-syn_flood": { + "_n": 1089.0, + "disc_nll_ch2": 0.14084921946740128, + "disc_nll_ch3": 0.9332378328741966, + "disc_nll_ch4": 0.8575182736455464, + "disc_nll_ch5": 0.9288718089990817, + "disc_nll_ch6": 0.6373605142332416, + "disc_nll_ch7": 0.9291603305785124, + "disc_nll_total": 0.7626097337006427, + "terminal_flow": 0.9794642791551883, + "terminal_norm": 0.9969267217630854, + "terminal_packet": 0.9984732782369146 + }, + "ddos-synonymousip_flood": { + "_n": 191.0, + "disc_nll_ch2": 0.9527633507853404, + "disc_nll_ch3": 0.9916460732984294, + "disc_nll_ch4": 0.9630062827225131, + "disc_nll_ch5": 0.9623905759162303, + "disc_nll_ch6": 0.6416031413612565, + "disc_nll_ch7": 0.9780408376963351, + "disc_nll_total": 0.9863633507853404, + "terminal_flow": 0.9988429319371728, + "terminal_norm": 0.9992450261780105, + "terminal_packet": 0.999730890052356 + }, + "ddos-tcp_flood": { + "_n": 1198.0, + "disc_nll_ch2": 0.19381944908180304, + "disc_nll_ch3": 0.9661016694490818, + "disc_nll_ch4": 0.9655, + "disc_nll_ch5": 0.6827739565943239, + "disc_nll_ch6": 0.7260288814691152, + "disc_nll_ch7": 0.9949529215358931, + "disc_nll_total": 0.955540734557596, + "terminal_flow": 0.9502569282136895, + "terminal_norm": 0.9818292153589315, + "terminal_packet": 0.9942485809682805 + }, + "ddos-udp_flood": { + "_n": 9.0, + "disc_nll_ch2": 0.41119999999999995, + "disc_nll_ch3": 0.2212666666666666, + "disc_nll_ch4": 0.19417777777777778, + "disc_nll_ch5": 0.1907111111111111, + "disc_nll_ch6": 0.1884222222222222, + "disc_nll_ch7": 0.11031111111111111, + "disc_nll_total": 0.24828888888888886, + "terminal_flow": 0.8449333333333332, + "terminal_norm": 0.9690222222222223, + "terminal_packet": 0.9900666666666665 + }, + "ddos-udp_fragmentation": { + "_n": 22.0, + "disc_nll_ch2": 0.6545363636363637, + "disc_nll_ch3": 0.43921818181818184, + "disc_nll_ch4": 0.3664090909090909, + "disc_nll_ch5": 0.41607272727272726, + "disc_nll_ch6": 0.5193454545454546, + "disc_nll_ch7": 0.5185818181818183, + "disc_nll_total": 0.6915363636363635, + "terminal_flow": 0.7645, + "terminal_norm": 0.8390454545454545, + "terminal_packet": 0.8613272727272728 + }, + "dictionarybruteforce": { + "_n": 20.0, + "disc_nll_ch2": 0.6582, + "disc_nll_ch3": 0.47637, + "disc_nll_ch4": 0.58515, + "disc_nll_ch5": 0.36777000000000004, + "disc_nll_ch6": 0.5842099999999999, + "disc_nll_ch7": 0.3225, + "disc_nll_total": 0.6339899999999999, + "terminal_flow": 0.75512, + "terminal_norm": 0.82255, + "terminal_packet": 0.83856 + }, + "dns_spoofing": { + "_n": 163.0, + "disc_nll_ch2": 0.4164036809815951, + "disc_nll_ch3": 0.5334036809815951, + "disc_nll_ch4": 0.44521349693251533, + "disc_nll_ch5": 0.410958282208589, + "disc_nll_ch6": 0.5390760736196318, + "disc_nll_ch7": 0.4391104294478527, + "disc_nll_total": 0.49718895705521476, + "terminal_flow": 0.759123926380368, + "terminal_norm": 0.8083079754601228, + "terminal_packet": 0.8163496932515337 + }, + "dos-http_flood": { + "_n": 714.0, + "disc_nll_ch2": 0.26885826330532214, + "disc_nll_ch3": 0.913419887955182, + "disc_nll_ch4": 0.9017284313725489, + "disc_nll_ch5": 0.9509745098039215, + "disc_nll_ch6": 0.9129407563025209, + "disc_nll_ch7": 0.9521330532212885, + "disc_nll_total": 0.973616806722689, + "terminal_flow": 0.9255372549019607, + "terminal_norm": 0.9816288515406162, + "terminal_packet": 0.989646218487395 + }, + "dos-syn_flood": { + "_n": 836.0, + "disc_nll_ch2": 0.845115071770335, + "disc_nll_ch3": 0.8460767942583732, + "disc_nll_ch4": 0.7643456937799044, + "disc_nll_ch5": 0.9755923444976076, + "disc_nll_ch6": 0.6130258373205741, + "disc_nll_ch7": 0.9790145933014354, + "disc_nll_total": 0.950744976076555, + "terminal_flow": 0.9566959330143541, + "terminal_norm": 0.9939299043062202, + "terminal_packet": 0.9983303827751197 + }, + "dos-tcp_flood": { + "_n": 1084.0, + "disc_nll_ch2": 0.8158553505535056, + "disc_nll_ch3": 0.7199680811808119, + "disc_nll_ch4": 0.8589678966789668, + "disc_nll_ch5": 0.9763258302583027, + "disc_nll_ch6": 0.635829335793358, + "disc_nll_ch7": 0.992380442804428, + "disc_nll_total": 0.9825036900369006, + "terminal_flow": 0.9382571955719556, + "terminal_norm": 0.9802675276752768, + "terminal_packet": 0.9946546125461254 + }, + "dos-udp_flood": { + "_n": 201.0, + "disc_nll_ch2": 0.5478606965174129, + "disc_nll_ch3": 0.6189940298507463, + "disc_nll_ch4": 0.058678606965174115, + "disc_nll_ch5": 0.03845671641791048, + "disc_nll_ch6": 0.03327064676616916, + "disc_nll_ch7": 0.014056716417910476, + "disc_nll_total": 0.5227303482587065, + "terminal_flow": 0.9713283582089552, + "terminal_norm": 0.9279940298507463, + "terminal_packet": 0.980955223880597 + }, + "mirai-greeth_flood": { + "_n": 12.0, + "disc_nll_ch2": 0.48668333333333336, + "disc_nll_ch3": 0.42285, + "disc_nll_ch4": 0.3562833333333334, + "disc_nll_ch5": 0.3248666666666667, + "disc_nll_ch6": 0.4134833333333333, + "disc_nll_ch7": 0.39980000000000004, + "disc_nll_total": 0.4209333333333333, + "terminal_flow": 0.5327000000000001, + "terminal_norm": 0.6915666666666667, + "terminal_packet": 0.73365 + }, + "mirai-greip_flood": { + "_n": 18.0, + "disc_nll_ch2": 0.7514555555555555, + "disc_nll_ch3": 0.4296777777777778, + "disc_nll_ch4": 0.5178333333333334, + "disc_nll_ch5": 0.4606222222222222, + "disc_nll_ch6": 0.5279333333333334, + "disc_nll_ch7": 0.5398333333333332, + "disc_nll_total": 0.6984222222222222, + "terminal_flow": 0.7780222222222222, + "terminal_norm": 0.8817444444444444, + "terminal_packet": 0.8683333333333334 + }, + "mirai-udpplain": { + "_n": 9.0, + "disc_nll_ch2": 0.3412, + "disc_nll_ch3": 0.5220444444444444, + "disc_nll_ch4": 0.4652666666666667, + "disc_nll_ch5": 0.5601999999999999, + "disc_nll_ch6": 0.6025111111111111, + "disc_nll_ch7": 0.5488888888888888, + "disc_nll_total": 0.4164222222222222, + "terminal_flow": 0.5750444444444446, + "terminal_norm": 0.7612444444444445, + "terminal_packet": 0.7469999999999999 + }, + "mitm-arpspoofing": { + "_n": 134.0, + "disc_nll_ch2": 0.5918925373134328, + "disc_nll_ch3": 0.32539701492537315, + "disc_nll_ch4": 0.4378492537313433, + "disc_nll_ch5": 0.32527462686567166, + "disc_nll_ch6": 0.5024388059701492, + "disc_nll_ch7": 0.5122134328358209, + "disc_nll_total": 0.5929641791044775, + "terminal_flow": 0.7117686567164179, + "terminal_norm": 0.8336029850746269, + "terminal_packet": 0.8464820895522387 + }, + "recon-hostdiscovery": { + "_n": 179.0, + "disc_nll_ch2": 0.39427486033519554, + "disc_nll_ch3": 0.6983256983240222, + "disc_nll_ch4": 0.6550463687150838, + "disc_nll_ch5": 0.7265290502793296, + "disc_nll_ch6": 0.6026977653631285, + "disc_nll_ch7": 0.7114502793296089, + "disc_nll_total": 0.7013212290502793, + "terminal_flow": 0.7815016759776536, + "terminal_norm": 0.8491340782122905, + "terminal_packet": 0.8094659217877095 + }, + "recon-osscan": { + "_n": 371.0, + "disc_nll_ch2": 0.4204846361185984, + "disc_nll_ch3": 0.8071959568733154, + "disc_nll_ch4": 0.7175064690026954, + "disc_nll_ch5": 0.799732884097035, + "disc_nll_ch6": 0.643866576819407, + "disc_nll_ch7": 0.8346803234501348, + "disc_nll_total": 0.8670361185983828, + "terminal_flow": 0.880145013477089, + "terminal_norm": 0.9394436657681939, + "terminal_packet": 0.9493234501347709 + }, + "recon-pingsweep": { + "_n": 6.0, + "disc_nll_ch2": 0.6706333333333333, + "disc_nll_ch3": 0.8626333333333334, + "disc_nll_ch4": 0.7615, + "disc_nll_ch5": 0.48343333333333327, + "disc_nll_ch6": 0.8658666666666667, + "disc_nll_ch7": 0.7415, + "disc_nll_total": 0.7964333333333333, + "terminal_flow": 0.8716, + "terminal_norm": 0.9193666666666666, + "terminal_packet": 0.9407333333333333 + }, + "recon-portscan": { + "_n": 397.0, + "disc_nll_ch2": 0.38279143576826197, + "disc_nll_ch3": 0.865288161209068, + "disc_nll_ch4": 0.7491813602015114, + "disc_nll_ch5": 0.8571622166246852, + "disc_nll_ch6": 0.6585760705289672, + "disc_nll_ch7": 0.8797216624685138, + "disc_nll_total": 0.8949924433249372, + "terminal_flow": 0.889791435768262, + "terminal_norm": 0.9267259445843828, + "terminal_packet": 0.9297083123425692 + }, + "sqlinjection": { + "_n": 15.0, + "disc_nll_ch2": 0.5140133333333333, + "disc_nll_ch3": 0.4281866666666666, + "disc_nll_ch4": 0.5888, + "disc_nll_ch5": 0.44922666666666666, + "disc_nll_ch6": 0.52824, + "disc_nll_ch7": 0.49002666666666667, + "disc_nll_total": 0.5632666666666667, + "terminal_flow": 0.6630533333333333, + "terminal_norm": 0.8259733333333333, + "terminal_packet": 0.8158799999999999 + }, + "uploading_attack": { + "_n": 5.0, + "disc_nll_ch2": 0.35075999999999996, + "disc_nll_ch3": 0.44580000000000003, + "disc_nll_ch4": 0.45936, + "disc_nll_ch5": 0.43784, + "disc_nll_ch6": 0.40771999999999997, + "disc_nll_ch7": 0.4788, + "disc_nll_total": 0.57084, + "terminal_flow": 0.81772, + "terminal_norm": 0.87132, + "terminal_packet": 0.6382 + }, + "vulnerabilityscan": { + "_n": 598.0, + "disc_nll_ch2": 0.46646371237458195, + "disc_nll_ch3": 0.6268622073578596, + "disc_nll_ch4": 0.6176357859531773, + "disc_nll_ch5": 0.6309387959866222, + "disc_nll_ch6": 0.5682117056856187, + "disc_nll_ch7": 0.6214397993311036, + "disc_nll_total": 0.7016493311036789, + "terminal_flow": 0.7116909698996655, + "terminal_norm": 0.807071237458194, + "terminal_packet": 0.8182408026755852 + }, + "xss": { + "_n": 11.0, + "disc_nll_ch2": 0.4392181818181818, + "disc_nll_ch3": 0.5074000000000001, + "disc_nll_ch4": 0.4516545454545454, + "disc_nll_ch5": 0.39663636363636356, + "disc_nll_ch6": 0.5604, + "disc_nll_ch7": 0.5079454545454546, + "disc_nll_total": 0.5448727272727274, + "terminal_flow": 0.8544181818181819, + "terminal_norm": 0.8994, + "terminal_packet": 0.7921636363636365 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/config.yaml b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/config.yaml new file mode 100644 index 0000000..d7139be --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/config.yaml @@ -0,0 +1,33 @@ +T: 64 +batch_size: 256 +benign_label: nontor +d_model: 128 +data_seed: 42 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packets_npz: /home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/packets.npz +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42 +seed: 42 +sigma: 0.1 +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/history.json b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/history.json new file mode 100644 index 0000000..1705028 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.3093054111187274, + 0.9362536928592584, + 0.7198827083294208, + 0.6217868985273899, + 0.5450755617557428, + 0.48740746959661824, + 0.4531983259396675, + 0.42711336872516537, + 0.39985028749857193, + 0.39165429121408707, + 0.37699049481978786, + 0.3679779989597125, + 0.35908030164547455, + 0.35362069194133466, + 0.3421435019908807, + 0.33057974699216014, + 0.3257299753335806, + 0.31768217300757384, + 0.31406054359215957, + 0.31263839587187153, + 0.3085604921365396, + 0.3031021539981549, + 0.30048235104634213, + 0.3002593960517492, + 0.2926175395647685, + 0.29177620777717006, + 0.2914025699480986, + 0.2878937025864919, + 0.28662748367358476, + 0.28145356705555546, + 0.27842538479046947, + 0.2781442254781723, + 0.2775879227198087, + 0.27504232372993076, + 0.27522869140673906, + 0.2714518190194399, + 0.2726575552653044, + 0.272085835536321, + 0.2712032538958085, + 0.2720896311295338, + 0.269386744652039, + 0.26932846086147505, + 0.26999907195568085, + 0.26568483198300386, + 0.26324146947799587, + 0.2671810526114244, + 0.26945129113319594, + 0.26830427195781315, + 0.2660488337278366, + 0.2662360484783466 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.672707681723858, + "auroc_disc_nll_ch3": 0.6906970666765662, + "auroc_disc_nll_ch4": 0.4656895304840456, + "auroc_disc_nll_ch5": 0.502904341692731, + "auroc_disc_nll_ch6": 0.413970338768007, + "auroc_disc_nll_ch7": 0.522518061016962, + "auroc_disc_nll_total": 0.5735031347741422, + "auroc_terminal_flow": 0.8741230879334456, + "auroc_terminal_norm": 0.9428941046885808, + "auroc_terminal_packet": 0.8658066380992302 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.6247469237297374, + "auroc_disc_nll_ch3": 0.7201296283852365, + "auroc_disc_nll_ch4": 0.39194791604011914, + "auroc_disc_nll_ch5": 0.4680433424464678, + "auroc_disc_nll_ch6": 0.4484354382668942, + "auroc_disc_nll_ch7": 0.6375265264578509, + "auroc_disc_nll_total": 0.5541089518454332, + "auroc_terminal_flow": 0.8899038926930769, + "auroc_terminal_norm": 0.9886343878755526, + "auroc_terminal_packet": 0.9880293778758534 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.7060899014315359, + "auroc_disc_nll_ch3": 0.7494223622973746, + "auroc_disc_nll_ch4": 0.4406814127770593, + "auroc_disc_nll_ch5": 0.5007760574869928, + "auroc_disc_nll_ch6": 0.4831387824802262, + "auroc_disc_nll_ch7": 0.6210185642912995, + "auroc_disc_nll_total": 0.6745723460384649, + "auroc_terminal_flow": 0.9050031507511053, + "auroc_terminal_norm": 0.9940299610350064, + "auroc_terminal_packet": 0.9930108422491053 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.6681052590523593, + "auroc_disc_nll_ch3": 0.7481210034096718, + "auroc_disc_nll_ch4": 0.4582850304314156, + "auroc_disc_nll_ch5": 0.49447990051051094, + "auroc_disc_nll_ch6": 0.4841214831884756, + "auroc_disc_nll_ch7": 0.6387981047562479, + "auroc_disc_nll_total": 0.6361821120041503, + "auroc_terminal_flow": 0.9044743837591351, + "auroc_terminal_norm": 0.9940057606350184, + "auroc_terminal_packet": 0.9934822213993564 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.7086747038622898, + "auroc_disc_nll_ch3": 0.7429666706452438, + "auroc_disc_nll_ch4": 0.46561537270495623, + "auroc_disc_nll_ch5": 0.49588276010495924, + "auroc_disc_nll_ch6": 0.4819062067682175, + "auroc_disc_nll_ch7": 0.6377101734252353, + "auroc_disc_nll_total": 0.6798028043329524, + "auroc_terminal_flow": 0.9139241700437581, + "auroc_terminal_norm": 0.9951443542111515, + "auroc_terminal_packet": 0.9953080006052449 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/model.pt b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/model.pt new file mode 100644 index 0000000..6205fe2 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/model.pt differ diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/phase1.log b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/phase1.log new file mode 100644 index 0000000..7fe72d6 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/phase1.log @@ -0,0 +1,35 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/packets.npz +[data] kept 66,189 of 103,079 (min_len=2) +[data] train=51,901 val=12,976 attack=1,312 +[data] val=12,976 attack=1,312 +[eval] scoring val=5,000 atk=1,312 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.1s +[score] 256/1,312 +[score] 512/1,312 +[score] 768/1,312 +[score] 1,024/1,312 +[score] 1,280/1,312 +[score] 1,312/1,312 +[eval] atk done 0.5s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/phase1_scores.npz b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/phase1_scores.npz new file mode 100644 index 0000000..97d4719 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/phase1_summary.json b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/phase1_summary.json new file mode 100644 index 0000000..fe535a1 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed42/phase1_summary.json @@ -0,0 +1,59 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.7066233231707317, + "auprc": 0.4149476482168391 + }, + "disc_nll_ch3": { + "auroc": 0.7434620426829268, + "auprc": 0.5220757439780012 + }, + "disc_nll_ch4": { + "auroc": 0.4629436737804878, + "auprc": 0.29567500283015946 + }, + "disc_nll_ch5": { + "auroc": 0.4937931402439025, + "auprc": 0.2200616348167093 + }, + "disc_nll_ch6": { + "auroc": 0.4795166158536585, + "auprc": 0.34360124993990215 + }, + "disc_nll_ch7": { + "auroc": 0.6406336890243902, + "auprc": 0.41856141776424555 + }, + "disc_nll_total": { + "auroc": 0.6790343750000001, + "auprc": 0.5038957905183965 + }, + "terminal_flow": { + "auroc": 0.9169880335365853, + "auprc": 0.6776373615840298 + }, + "terminal_norm": { + "auroc": 0.9946434451219512, + "auprc": 0.9740553056727949 + }, + "terminal_packet": { + "auroc": 0.9950306402439024, + "auprc": 0.9787061932712486 + } + }, + "per_class": { + "tor": { + "_n": 1312.0, + "disc_nll_ch2": 0.7066233231707317, + "disc_nll_ch3": 0.7434620426829268, + "disc_nll_ch4": 0.4629436737804878, + "disc_nll_ch5": 0.4937931402439025, + "disc_nll_ch6": 0.4795166158536585, + "disc_nll_ch7": 0.6406336890243902, + "disc_nll_total": 0.6790343750000001, + "terminal_flow": 0.9169880335365853, + "terminal_norm": 0.9946434451219512, + "terminal_packet": 0.9950306402439024 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/config.yaml b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/config.yaml new file mode 100644 index 0000000..ba07819 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/config.yaml @@ -0,0 +1,33 @@ +T: 64 +batch_size: 256 +benign_label: nontor +d_model: 128 +data_seed: 43 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packets_npz: /home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/packets.npz +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43 +seed: 43 +sigma: 0.1 +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/history.json b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/history.json new file mode 100644 index 0000000..c750727 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.3076146290852473, + 0.9313710897396772, + 0.7183441198789157, + 0.6043517024089129, + 0.5339294725503677, + 0.4813241698803046, + 0.4508297825470949, + 0.41913547500585896, + 0.40257821556849355, + 0.38724987629132396, + 0.38056472173103917, + 0.36554683171785796, + 0.3575979975553659, + 0.3508875454083467, + 0.339092955375329, + 0.3315985355621729, + 0.32351883940207654, + 0.319533102787458, + 0.322526359405273, + 0.31112444706452197, + 0.3063185291412549, + 0.30121036447011507, + 0.29915146491466427, + 0.2933585834808839, + 0.29029509081290317, + 0.28810339784010863, + 0.2846086774116907, + 0.282279120805936, + 0.2833934265833635, + 0.2815176095717993, + 0.27650309258546585, + 0.27516134350727767, + 0.2799790333478879, + 0.2748433217788354, + 0.27788212513312316, + 0.27124025577153915, + 0.27052632700174284, + 0.2712256472844344, + 0.27076648825254196, + 0.2662837176750868, + 0.2672026100066992, + 0.2667690802078981, + 0.2667683126070561, + 0.2647142796180187, + 0.26561674590294176, + 0.26747304583207154, + 0.2649999398451585, + 0.2684835776304587, + 0.26447109495982146, + 0.2636986030982091 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.6442616093782894, + "auroc_disc_nll_ch3": 0.7838755378127726, + "auroc_disc_nll_ch4": 0.3577909310998165, + "auroc_disc_nll_ch5": 0.44375145672310606, + "auroc_disc_nll_ch6": 0.42619336166581456, + "auroc_disc_nll_ch7": 0.6700210848921837, + "auroc_disc_nll_total": 0.7241527099278969, + "auroc_terminal_flow": 0.8624891568110733, + "auroc_terminal_norm": 0.9805182080990046, + "auroc_terminal_packet": 0.9694753071336201 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.6550347522442934, + "auroc_disc_nll_ch3": 0.6379980230857718, + "auroc_disc_nll_ch4": 0.3415143412040239, + "auroc_disc_nll_ch5": 0.38971090625093985, + "auroc_disc_nll_ch6": 0.44497762990210826, + "auroc_disc_nll_ch7": 0.7540064878217948, + "auroc_disc_nll_total": 0.657382543476136, + "auroc_terminal_flow": 0.9049417980380289, + "auroc_terminal_norm": 0.9768349894552043, + "auroc_terminal_packet": 0.980311241814156 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.6710062820009173, + "auroc_disc_nll_ch3": 0.669462537310908, + "auroc_disc_nll_ch4": 0.3734798976910469, + "auroc_disc_nll_ch5": 0.4046418481774984, + "auroc_disc_nll_ch6": 0.4782355582350907, + "auroc_disc_nll_ch7": 0.7148735305893056, + "auroc_disc_nll_total": 0.6719416979470543, + "auroc_terminal_flow": 0.9173435925799225, + "auroc_terminal_norm": 0.9931766619800908, + "auroc_terminal_packet": 0.9928161817501728 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.7159531503751767, + "auroc_disc_nll_ch3": 0.6745680581035157, + "auroc_disc_nll_ch4": 0.39319585195745993, + "auroc_disc_nll_ch5": 0.4313669607680972, + "auroc_disc_nll_ch6": 0.4784607335587651, + "auroc_disc_nll_ch7": 0.6891537918972361, + "auroc_disc_nll_total": 0.7037913333433581, + "auroc_terminal_flow": 0.9173983959129048, + "auroc_terminal_norm": 0.9948078394258819, + "auroc_terminal_packet": 0.9957145908205768 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.7183168010924484, + "auroc_disc_nll_ch3": 0.6723140727910439, + "auroc_disc_nll_ch4": 0.3953241067937807, + "auroc_disc_nll_ch5": 0.43485328683723795, + "auroc_disc_nll_ch6": 0.4780334379041232, + "auroc_disc_nll_ch7": 0.6918673792235572, + "auroc_disc_nll_total": 0.7114983383958378, + "auroc_terminal_flow": 0.9246398956986256, + "auroc_terminal_norm": 0.9954981382138882, + "auroc_terminal_packet": 0.9956053365876215 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/model.pt b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/model.pt new file mode 100644 index 0000000..7ff8110 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/model.pt differ diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/phase1.log b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/phase1.log new file mode 100644 index 0000000..bff36c5 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/phase1.log @@ -0,0 +1,35 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/packets.npz +[data] kept 66,189 of 103,079 (min_len=2) +[data] train=51,901 val=12,976 attack=1,312 +[data] val=12,976 attack=1,312 +[eval] scoring val=5,000 atk=1,312 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.1s +[score] 256/1,312 +[score] 512/1,312 +[score] 768/1,312 +[score] 1,024/1,312 +[score] 1,280/1,312 +[score] 1,312/1,312 +[eval] atk done 0.5s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/phase1_scores.npz b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/phase1_scores.npz new file mode 100644 index 0000000..ba2de0c Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/phase1_summary.json b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/phase1_summary.json new file mode 100644 index 0000000..8fe2170 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed43/phase1_summary.json @@ -0,0 +1,59 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.7181535060975609, + "auprc": 0.5444095943870865 + }, + "disc_nll_ch3": { + "auroc": 0.6675757621951219, + "auprc": 0.469060355952383 + }, + "disc_nll_ch4": { + "auroc": 0.3978492378048781, + "auprc": 0.3007462989301358 + }, + "disc_nll_ch5": { + "auroc": 0.43174603658536587, + "auprc": 0.2264105546915273 + }, + "disc_nll_ch6": { + "auroc": 0.47793216463414634, + "auprc": 0.33959333381405654 + }, + "disc_nll_ch7": { + "auroc": 0.6897387195121951, + "auprc": 0.5018943653903121 + }, + "disc_nll_total": { + "auroc": 0.7128315548780488, + "auprc": 0.5718534015961416 + }, + "terminal_flow": { + "auroc": 0.9273297256097561, + "auprc": 0.7107045173098664 + }, + "terminal_norm": { + "auroc": 0.9962733231707317, + "auprc": 0.981466028236921 + }, + "terminal_packet": { + "auroc": 0.9957731707317072, + "auprc": 0.9848071996888339 + } + }, + "per_class": { + "tor": { + "_n": 1312.0, + "disc_nll_ch2": 0.7181535060975609, + "disc_nll_ch3": 0.6675757621951219, + "disc_nll_ch4": 0.3978492378048781, + "disc_nll_ch5": 0.43174603658536587, + "disc_nll_ch6": 0.47793216463414634, + "disc_nll_ch7": 0.6897387195121951, + "disc_nll_total": 0.7128315548780488, + "terminal_flow": 0.9273297256097561, + "terminal_norm": 0.9962733231707317, + "terminal_packet": 0.9957731707317072 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/config.yaml b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/config.yaml new file mode 100644 index 0000000..0fcc9d1 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/config.yaml @@ -0,0 +1,33 @@ +T: 64 +batch_size: 256 +benign_label: nontor +d_model: 128 +data_seed: 44 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packets_npz: /home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/packets.npz +reference_mode: causal_packets +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44 +seed: 44 +sigma: 0.1 +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/history.json b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/history.json new file mode 100644 index 0000000..76f4061 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.3142383801631439, + 0.9383290868539077, + 0.7307040095329285, + 0.6097229382930658, + 0.5324517442629888, + 0.48784279976135647, + 0.4521561249708518, + 0.4241812450763507, + 0.40552798524881023, + 0.3890036932933025, + 0.38119009137153625, + 0.37170645594596863, + 0.367306255377256, + 0.35833270580340654, + 0.34686829493596005, + 0.34029000309797436, + 0.34044688099469894, + 0.32511132191389036, + 0.31498669508175975, + 0.3099100819000831, + 0.30742455063722074, + 0.3036362444743132, + 0.3009236401472336, + 0.2952129351787078, + 0.29574253849494153, + 0.29186036800726867, + 0.2887205313413571, + 0.2880259706423833, + 0.2871822584898044, + 0.2805281713222846, + 0.28182646326529676, + 0.2782986798347571, + 0.27783524149503463, + 0.27631588929738754, + 0.27749257821303147, + 0.27305458103999114, + 0.2722620971691914, + 0.26934984440986925, + 0.2719149803503966, + 0.27025822530954313, + 0.2685045966735253, + 0.26514532971076477, + 0.26972335233138156, + 0.266424835110322, + 0.2663809806108475, + 0.26839197331514114, + 0.2678925666289452, + 0.26852654761228806, + 0.2652878635204755, + 0.2684600632160138 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.6444772983801239, + "auroc_disc_nll_ch3": 0.8083445798622598, + "auroc_disc_nll_ch4": 0.3907046204907371, + "auroc_disc_nll_ch5": 0.4910022971583562, + "auroc_disc_nll_ch6": 0.45036568449069203, + "auroc_disc_nll_ch7": 0.7367827048434634, + "auroc_disc_nll_total": 0.7071137193242308, + "auroc_terminal_flow": 0.8576216164081532, + "auroc_terminal_norm": 0.9711531232143394, + "auroc_terminal_packet": 0.9686032703903642 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.6832148551453341, + "auroc_disc_nll_ch3": 0.78374519633808, + "auroc_disc_nll_ch4": 0.36201839441858896, + "auroc_disc_nll_ch5": 0.4480306395860275, + "auroc_disc_nll_ch6": 0.47541274604523176, + "auroc_disc_nll_ch7": 0.7124524920303148, + "auroc_disc_nll_total": 0.631686006623861, + "auroc_terminal_flow": 0.9176419271224926, + "auroc_terminal_norm": 0.988864467891943, + "auroc_terminal_packet": 0.9697894717922017 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.6720815844824215, + "auroc_disc_nll_ch3": 0.7039505155859974, + "auroc_disc_nll_ch4": 0.4104022776100719, + "auroc_disc_nll_ch5": 0.4659572033547863, + "auroc_disc_nll_ch6": 0.4760658044118974, + "auroc_disc_nll_ch7": 0.7541080472673755, + "auroc_disc_nll_total": 0.6571834775645845, + "auroc_terminal_flow": 0.9312704528623199, + "auroc_terminal_norm": 0.9953084705159243, + "auroc_terminal_packet": 0.9956653970463295 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.7268983099192505, + "auroc_disc_nll_ch3": 0.701235048616959, + "auroc_disc_nll_ch4": 0.4396982421581306, + "auroc_disc_nll_ch5": 0.4625924666739346, + "auroc_disc_nll_ch6": 0.46919180414686773, + "auroc_disc_nll_ch7": 0.7546743777442784, + "auroc_disc_nll_total": 0.7194069351297705, + "auroc_terminal_flow": 0.9370438342079938, + "auroc_terminal_norm": 0.9954008079644221, + "auroc_terminal_packet": 0.9948333320802382 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.7284167381714084, + "auroc_disc_nll_ch3": 0.6964180529814893, + "auroc_disc_nll_ch4": 0.448492679261526, + "auroc_disc_nll_ch5": 0.46244409237692097, + "auroc_disc_nll_ch6": 0.46562738479669785, + "auroc_disc_nll_ch7": 0.7565186009443325, + "auroc_disc_nll_total": 0.7281238369710685, + "auroc_terminal_flow": 0.9374740080655469, + "auroc_terminal_norm": 0.9956035156837388, + "auroc_terminal_packet": 0.9958026990729602 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/model.pt b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/model.pt new file mode 100644 index 0000000..9edbaec Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/model.pt differ diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/phase1.log b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/phase1.log new file mode 100644 index 0000000..42a8ff7 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/phase1.log @@ -0,0 +1,35 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/iscxtor2016/processed/packets.npz +[data] kept 66,189 of 103,079 (min_len=2) +[data] train=51,901 val=12,976 attack=1,312 +[data] val=12,976 attack=1,312 +[eval] scoring val=5,000 atk=1,312 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.1s +[score] 256/1,312 +[score] 512/1,312 +[score] 768/1,312 +[score] 1,024/1,312 +[score] 1,280/1,312 +[score] 1,312/1,312 +[eval] atk done 0.5s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/phase1_scores.npz b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/phase1_scores.npz new file mode 100644 index 0000000..f755280 Binary files /dev/null and b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/phase1_summary.json b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/phase1_summary.json new file mode 100644 index 0000000..b4f2b02 --- /dev/null +++ b/artifacts/route_comparison/route_ac_combo_iscxtor2016_seed44/phase1_summary.json @@ -0,0 +1,59 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.7278813262195122, + "auprc": 0.5246682116063918 + }, + "disc_nll_ch3": { + "auroc": 0.6948435975609757, + "auprc": 0.47036148694780705 + }, + "disc_nll_ch4": { + "auroc": 0.4479103658536585, + "auprc": 0.3400838594188321 + }, + "disc_nll_ch5": { + "auroc": 0.4621974085365854, + "auprc": 0.21012596740882417 + }, + "disc_nll_ch6": { + "auroc": 0.46636448170731704, + "auprc": 0.32709945757038983 + }, + "disc_nll_ch7": { + "auroc": 0.7568233231707318, + "auprc": 0.6576240726824016 + }, + "disc_nll_total": { + "auroc": 0.7270307926829268, + "auprc": 0.5413085096337609 + }, + "terminal_flow": { + "auroc": 0.9404432926829268, + "auprc": 0.71439727581882 + }, + "terminal_norm": { + "auroc": 0.9953120426829267, + "auprc": 0.9559237268722014 + }, + "terminal_packet": { + "auroc": 0.995004268292683, + "auprc": 0.9755284327814437 + } + }, + "per_class": { + "tor": { + "_n": 1312.0, + "disc_nll_ch2": 0.7278813262195122, + "disc_nll_ch3": 0.6948435975609757, + "disc_nll_ch4": 0.4479103658536585, + "disc_nll_ch5": 0.4621974085365854, + "disc_nll_ch6": 0.46636448170731704, + "disc_nll_ch7": 0.7568233231707318, + "disc_nll_total": 0.7270307926829268, + "terminal_flow": 0.9404432926829268, + "terminal_norm": 0.9953120426829267, + "terminal_packet": 0.995004268292683 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/config.yaml b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/config.yaml new file mode 100644 index 0000000..4485e64 --- /dev/null +++ b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/config.yaml @@ -0,0 +1,37 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 42 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features_spectral.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_flow: 0.3 +lambda_packet: 0.3 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packet_mask_ratio: 0.5 +packet_preprocess: mixed_dequant +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42 +seed: 42 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/history.json b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/history.json new file mode 100644 index 0000000..b03fd89 --- /dev/null +++ b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/history.json @@ -0,0 +1,243 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 2.35435544527494, + 2.0830415456722946, + 1.8203309040803175, + 1.6440928257428682, + 1.5232284038494794, + 1.4128879889463768, + 1.3444109207544572, + 1.281876414250105, + 1.237036026441134, + 1.2030063317372248, + 1.1605947323334522, + 1.1252210186077998, + 1.1245858776263702, + 1.0959692230591407, + 1.0786918997764587, + 1.065282451800811, + 1.059309178437942, + 1.0483461373891585, + 1.028967369825412, + 1.021410427032373, + 1.0239122311274211, + 1.010650443725097, + 0.9994347981917553, + 0.9896787099349194, + 0.9888498385747274, + 0.9864153999548692, + 0.9820853181374378, + 0.9691391602540628, + 0.96686801696435, + 0.9735104013711978, + 0.9612127618911939, + 0.9626948161002917, + 0.9654019077618917, + 0.9489048948654761, + 0.9475200986250852, + 0.9578507695442591, + 0.9396801682618948, + 0.9407118482467456, + 0.9388024898675772, + 0.9400967573508238, + 0.9425212802031101, + 0.9361468171462034, + 0.9382332960764567, + 0.9292092720667521, + 0.9372674731107858, + 0.9420890930371407, + 0.9305191345703907, + 0.9369449386229882, + 0.9329790075620016, + 0.941332737604777 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.2665704875, + "auroc_curvature_flow": 0.07402594500000001, + "auroc_curvature_packet": 0.082277355, + "auroc_curvature_total": 0.06561748, + "auroc_kappa2_speed2norm_packet_mean": 0.084095795, + "auroc_kappa2_speed2norm_packet_median": 0.0955323875, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.088789025, + "auroc_kinetic_energy": 0.26236684, + "auroc_kinetic_flow": 0.34951441250000004, + "auroc_kinetic_packet": 0.31101263749999997, + "auroc_terminal_flow": 0.8972247125, + "auroc_terminal_norm": 0.93336416, + "auroc_terminal_packet": 0.7261114325, + "auroc_velocity_flow": 0.318205825, + "auroc_velocity_packet": 0.5670153025, + "auroc_velocity_total": 0.411809915 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.599748995, + "auroc_curvature_flow": 0.063181235, + "auroc_curvature_packet": 0.1197404325, + "auroc_curvature_total": 0.062456182500000006, + "auroc_kappa2_speed2norm_packet_mean": 0.07891945, + "auroc_kappa2_speed2norm_packet_median": 0.079568945, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.0794993975, + "auroc_kinetic_energy": 0.534111685, + "auroc_kinetic_flow": 0.7700477625, + "auroc_kinetic_packet": 0.4476881875, + "auroc_terminal_flow": 0.9111277400000002, + "auroc_terminal_norm": 0.9535287299999999, + "auroc_terminal_packet": 0.7858499999999999, + "auroc_velocity_flow": 0.803799125, + "auroc_velocity_packet": 0.7438665499999999, + "auroc_velocity_total": 0.859698495 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.8882727275, + "auroc_curvature_flow": 0.06240584, + "auroc_curvature_packet": 0.7656555125, + "auroc_curvature_total": 0.163130985, + "auroc_kappa2_speed2norm_packet_mean": 0.3493828725, + "auroc_kappa2_speed2norm_packet_median": 0.3643148275, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.3452117325, + "auroc_kinetic_energy": 0.8817219725, + "auroc_kinetic_flow": 0.7750209725, + "auroc_kinetic_packet": 0.9044422725, + "auroc_terminal_flow": 0.9193672275, + "auroc_terminal_norm": 0.9626184750000001, + "auroc_terminal_packet": 0.93402327, + "auroc_velocity_flow": 0.7873097325, + "auroc_velocity_packet": 0.8326773875, + "auroc_velocity_total": 0.8811220524999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9180133925, + "auroc_curvature_flow": 0.06041530249999999, + "auroc_curvature_packet": 0.8637126900000001, + "auroc_curvature_total": 0.25151739500000003, + "auroc_kappa2_speed2norm_packet_mean": 0.334604615, + "auroc_kappa2_speed2norm_packet_median": 0.3318336925, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.328470575, + "auroc_kinetic_energy": 0.9148618774999999, + "auroc_kinetic_flow": 0.8048493975, + "auroc_kinetic_packet": 0.9405369800000001, + "auroc_terminal_flow": 0.9204983150000001, + "auroc_terminal_norm": 0.96460072, + "auroc_terminal_packet": 0.9462584325, + "auroc_velocity_flow": 0.7869450225, + "auroc_velocity_packet": 0.82897373, + "auroc_velocity_total": 0.8848393700000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9219913925000001, + "auroc_curvature_flow": 0.060706012499999996, + "auroc_curvature_packet": 0.905080265, + "auroc_curvature_total": 0.327946005, + "auroc_kappa2_speed2norm_packet_mean": 0.4157863275, + "auroc_kappa2_speed2norm_packet_median": 0.4233588325, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.415859945, + "auroc_kinetic_energy": 0.9193904649999999, + "auroc_kinetic_flow": 0.8209955525, + "auroc_kinetic_packet": 0.94434298, + "auroc_terminal_flow": 0.919424395, + "auroc_terminal_norm": 0.9653654549999999, + "auroc_terminal_packet": 0.9493533725000001, + "auroc_velocity_flow": 0.7858484699999999, + "auroc_velocity_packet": 0.819902975, + "auroc_velocity_total": 0.8842267975000001 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/model.pt b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/model.pt new file mode 100644 index 0000000..9aebc68 Binary files /dev/null and b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/model.pt differ diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/phase1.log b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/phase1.log new file mode 100644 index 0000000..31779cb --- /dev/null +++ b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/phase1.log @@ -0,0 +1,132 @@ +[config] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/config.yaml +[model] T=64 flow_dim=52 packet_dim=9 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets_source=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] using external flow features D=52 +[data] rows total=8,193,621 keep len>=2: 3,797,530 +[data] benign=97,045 attack=20,000 -> train=77,636 val=10,000 +[data] train=77,636 val=10,000 attack=20,000 +[eval] scoring val=5,000 and attack=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done in 11.9s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] attack done in 22.8s +[eval] score keys: 57 first 5: ['arc_length', 'causal_surprisal_flow', 'causal_surprisal_packet_max', 'causal_surprisal_packet_mean', 'causal_surprisal_packet_median'] +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/phase1_summary.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/phase1_scores.npz + +=== overall AUROC (sorted desc) === + terminal_norm AUROC=0.9634 AUPRC=0.9812 + terminal_packet AUROC=0.9472 AUPRC=0.9726 + kinetic_packet AUROC=0.9442 AUPRC=0.9717 + arc_length AUROC=0.9288 AUPRC=0.9626 + kinetic_energy AUROC=0.9273 AUPRC=0.9620 + terminal_flow AUROC=0.9205 AUPRC=0.9387 + velocity_total_t10 AUROC=0.9139 AUPRC=0.9470 + velocity_total_t09 AUROC=0.8998 AUPRC=0.9309 + velocity_packet_t10 AUROC=0.8928 AUPRC=0.9518 + velocity_total AUROC=0.8842 AUPRC=0.9220 + velocity_total_t07 AUROC=0.8777 AUPRC=0.9152 + curvature_packet AUROC=0.8656 AUPRC=0.8908 + causal_surprisal_packet_median AUROC=0.8526 AUPRC=0.9241 + velocity_packet_t09 AUROC=0.8485 AUPRC=0.9114 + consistency_total AUROC=0.8434 AUPRC=0.8929 + velocity_flow_t09 AUROC=0.8332 AUPRC=0.8311 + velocity_flow_t10 AUROC=0.8307 AUPRC=0.8296 + velocity_packet_t07 AUROC=0.8186 AUPRC=0.8897 + velocity_packet AUROC=0.8177 AUPRC=0.8967 + flow_consistency AUROC=0.8120 AUPRC=0.8810 + velocity_total_t05 AUROC=0.8083 AUPRC=0.8742 + kinetic_flow AUROC=0.7959 AUPRC=0.8224 + packet_consistency AUROC=0.7946 AUPRC=0.8629 + causal_surprisal_packet_trimmed10_mean AUROC=0.7845 AUPRC=0.8762 + velocity_flow AUROC=0.7839 AUPRC=0.8121 + velocity_flow_t07 AUROC=0.7761 AUPRC=0.8096 + causal_surprisal_packet_mean AUROC=0.7727 AUPRC=0.8524 + velocity_total_t03 AUROC=0.7708 AUPRC=0.8428 + velocity_flow_t05 AUROC=0.7550 AUPRC=0.8041 + velocity_flow_t03 AUROC=0.7547 AUPRC=0.8082 + velocity_flow_t01 AUROC=0.7542 AUPRC=0.8121 + velocity_packet_t05 AUROC=0.7287 AUPRC=0.8280 + velocity_total_t01 AUROC=0.7139 AUPRC=0.8045 + jacobian_packet AUROC=0.7139 AUPRC=0.8394 + causal_surprisal_packet_max AUROC=0.6964 AUPRC=0.7679 + velocity_packet_t03 AUROC=0.5788 AUPRC=0.7274 + direction_drift_packet_max AUROC=0.5353 AUPRC=0.7226 + jacobian_total AUROC=0.4761 AUPRC=0.6560 + velocity_packet_t01 AUROC=0.4760 AUPRC=0.6474 + direction_drift_packet_mean AUROC=0.4159 AUPRC=0.6340 + direction_drift_packet_trimmed10_mean AUROC=0.3822 AUPRC=0.6207 + direction_drift_packet_median AUROC=0.3461 AUPRC=0.5891 + pna_packet_max AUROC=0.3124 AUPRC=0.5460 + direction_drift_total AUROC=0.2985 AUPRC=0.5671 + causal_surprisal_total AUROC=0.2831 AUPRC=0.5487 + kappa2_speed2norm_packet_median AUROC=0.2807 AUPRC=0.5416 + pna_packet_median AUROC=0.2807 AUPRC=0.5416 + kappa2_speed2norm_packet_mean AUROC=0.2741 AUPRC=0.5351 + pna_packet_mean AUROC=0.2741 AUPRC=0.5351 + kappa2_speed2norm_packet_trimmed10_mean AUROC=0.2727 AUPRC=0.5390 + pna_packet_trimmed10_mean AUROC=0.2727 AUPRC=0.5390 + causal_surprisal_flow AUROC=0.2386 AUPRC=0.5215 + curvature_total AUROC=0.2372 AUPRC=0.5105 + direction_drift_flow AUROC=0.2261 AUPRC=0.5059 + jacobian_flow AUROC=0.2186 AUPRC=0.5144 + pna_flow AUROC=0.0720 AUPRC=0.4624 + curvature_flow AUROC=0.0572 AUPRC=0.4588 diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/phase1_scores.npz b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/phase1_scores.npz new file mode 100644 index 0000000..f91d56d Binary files /dev/null and b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/phase1_summary.json b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/phase1_summary.json new file mode 100644 index 0000000..cd7ae4e --- /dev/null +++ b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42/phase1_summary.json @@ -0,0 +1,2231 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42", + "config": { + "T": 64, + "attack_cap": 20000, + "batch_size": 256, + "benign_label": "normal", + "d_model": 128, + "data_seed": 42, + "device": "auto", + "epochs": 50, + "eval_batch_size": 512, + "eval_every": 10, + "eval_n": 20000, + "eval_n_steps": 8, + "flow_features_align": "auto", + "flow_features_path": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features_spectral.parquet", + "flows_parquet": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet", + "grad_clip": 1.0, + "lambda_flow": 0.3, + "lambda_packet": 0.3, + "lr": 0.0003, + "min_len": 2, + "mlp_ratio": 4.0, + "n_heads": 4, + "n_layers": 4, + "n_train": 10000, + "num_workers": 0, + "packet_mask_ratio": 0.5, + "packet_preprocess": "mixed_dequant", + "save_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed42", + "seed": 42, + "sigma": 0.1, + "source_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "time_dim": 64, + "token_dim": null, + "train_ratio": 0.8, + "use_ot": true, + "val_cap": 10000, + "weight_decay": 0.01 + }, + "n_val": 5000, + "n_atk": 10000, + "n_score_keys": 57, + "overall": { + "arc_length": { + "auroc": 0.92880575, + "auprc": 0.9626338229361919 + }, + "causal_surprisal_flow": { + "auroc": 0.23856639999999998, + "auprc": 0.5215294443311391 + }, + "causal_surprisal_packet_max": { + "auroc": 0.6964412200000001, + "auprc": 0.767947513193014 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.77269882, + "auprc": 0.8523502607799623 + }, + "causal_surprisal_packet_median": { + "auroc": 0.8526213399999999, + "auprc": 0.9241066528613706 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.78453598, + "auprc": 0.876183938590237 + }, + "causal_surprisal_total": { + "auroc": 0.2831024, + "auprc": 0.5486696422506754 + }, + "consistency_total": { + "auroc": 0.84343533, + "auprc": 0.8928653781367535 + }, + "curvature_flow": { + "auroc": 0.057165160000000007, + "auprc": 0.45884520707468346 + }, + "curvature_packet": { + "auroc": 0.86563185, + "auprc": 0.8908043313264682 + }, + "curvature_total": { + "auroc": 0.23717599, + "auprc": 0.5104755012736062 + }, + "direction_drift_flow": { + "auroc": 0.22606859, + "auprc": 0.5058685081963468 + }, + "direction_drift_packet_max": { + "auroc": 0.5353319400000001, + "auprc": 0.722550776949429 + }, + "direction_drift_packet_mean": { + "auroc": 0.41590725, + "auprc": 0.6339794832145303 + }, + "direction_drift_packet_median": { + "auroc": 0.34605557, + "auprc": 0.5890766124771725 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.38217958, + "auprc": 0.6206961610111592 + }, + "direction_drift_total": { + "auroc": 0.29846680000000003, + "auprc": 0.5671387282674123 + }, + "flow_consistency": { + "auroc": 0.8120135700000001, + "auprc": 0.8809747203490104 + }, + "jacobian_flow": { + "auroc": 0.21860279, + "auprc": 0.5144067782844589 + }, + "jacobian_packet": { + "auroc": 0.71385967, + "auprc": 0.8393849878168804 + }, + "jacobian_total": { + "auroc": 0.47614325, + "auprc": 0.6560185776336311 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.27410471000000003, + "auprc": 0.5350503396986901 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.28069197, + "auprc": 0.5415676526083809 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.27268154, + "auprc": 0.5389767456813475 + }, + "kinetic_energy": { + "auroc": 0.9273341399999999, + "auprc": 0.9619821779619568 + }, + "kinetic_flow": { + "auroc": 0.7959456899999999, + "auprc": 0.8223663973747342 + }, + "kinetic_packet": { + "auroc": 0.94418355, + "auprc": 0.9717161759106577 + }, + "packet_consistency": { + "auroc": 0.79458326, + "auprc": 0.8628522864228477 + }, + "pna_flow": { + "auroc": 0.07204986, + "auprc": 0.4623665788214273 + }, + "pna_packet_max": { + "auroc": 0.31240057, + "auprc": 0.5460219723814603 + }, + "pna_packet_mean": { + "auroc": 0.27410471000000003, + "auprc": 0.5350503396986901 + }, + "pna_packet_median": { + "auroc": 0.28069197, + "auprc": 0.5415676526083809 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.27268154, + "auprc": 0.5389767456813475 + }, + "terminal_flow": { + "auroc": 0.9205325999999999, + "auprc": 0.9386992247277228 + }, + "terminal_norm": { + "auroc": 0.96342648, + "auprc": 0.9811941058157764 + }, + "terminal_packet": { + "auroc": 0.9471672099999999, + "auprc": 0.97257754157216 + }, + "velocity_flow": { + "auroc": 0.7839274700000001, + "auprc": 0.8121036823314023 + }, + "velocity_flow_t01": { + "auroc": 0.75423805, + "auprc": 0.8121001935604317 + }, + "velocity_flow_t03": { + "auroc": 0.7546747899999999, + "auprc": 0.808174268045132 + }, + "velocity_flow_t05": { + "auroc": 0.75500855, + "auprc": 0.804080880286084 + }, + "velocity_flow_t07": { + "auroc": 0.77609942, + "auprc": 0.8095648830199088 + }, + "velocity_flow_t09": { + "auroc": 0.8332455000000001, + "auprc": 0.8311135943878025 + }, + "velocity_flow_t10": { + "auroc": 0.83071596, + "auprc": 0.8296163912067095 + }, + "velocity_packet": { + "auroc": 0.8177187699999999, + "auprc": 0.8966523457359481 + }, + "velocity_packet_t01": { + "auroc": 0.4760021, + "auprc": 0.6473530542845809 + }, + "velocity_packet_t03": { + "auroc": 0.578823, + "auprc": 0.7274212559109866 + }, + "velocity_packet_t05": { + "auroc": 0.72867382, + "auprc": 0.8279749715168415 + }, + "velocity_packet_t07": { + "auroc": 0.8185886800000001, + "auprc": 0.8897101836181087 + }, + "velocity_packet_t09": { + "auroc": 0.84849526, + "auprc": 0.9114138464946471 + }, + "velocity_packet_t10": { + "auroc": 0.89280825, + "auprc": 0.9517672116425634 + }, + "velocity_total": { + "auroc": 0.8842052499999999, + "auprc": 0.9220313017047945 + }, + "velocity_total_t01": { + "auroc": 0.71391059, + "auprc": 0.804481274991206 + }, + "velocity_total_t03": { + "auroc": 0.7708109299999999, + "auprc": 0.8428007656398308 + }, + "velocity_total_t05": { + "auroc": 0.8082820500000001, + "auprc": 0.8741502170607458 + }, + "velocity_total_t07": { + "auroc": 0.87767065, + "auprc": 0.9151616433518671 + }, + "velocity_total_t09": { + "auroc": 0.89979297, + "auprc": 0.9308604125191529 + }, + "velocity_total_t10": { + "auroc": 0.91391249, + "auprc": 0.9469752470488518 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 9.0, + "arc_length": 0.7568222222222222, + "causal_surprisal_flow": 0.23917777777777777, + "causal_surprisal_packet_max": 0.6524888888888888, + "causal_surprisal_packet_mean": 0.5833111111111111, + "causal_surprisal_packet_median": 0.6286444444444445, + "causal_surprisal_packet_trimmed10_mean": 0.583488888888889, + "causal_surprisal_total": 0.21433333333333332, + "consistency_total": 0.7807555555555555, + "curvature_flow": 0.1494222222222222, + "curvature_packet": 0.7911111111111111, + "curvature_total": 0.29400000000000004, + "direction_drift_flow": 0.1667111111111111, + "direction_drift_packet_max": 0.7790222222222223, + "direction_drift_packet_mean": 0.6174444444444445, + "direction_drift_packet_median": 0.5209777777777778, + "direction_drift_packet_trimmed10_mean": 0.6151555555555555, + "direction_drift_total": 0.5666666666666667, + "flow_consistency": 0.6585555555555556, + "jacobian_flow": 0.18537777777777772, + "jacobian_packet": 0.38815555555555564, + "jacobian_total": 0.28088888888888885, + "kappa2_speed2norm_packet_mean": 0.4745111111111111, + "kappa2_speed2norm_packet_median": 0.4759555555555555, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4772, + "kinetic_energy": 0.7494222222222222, + "kinetic_flow": 0.7917777777777777, + "kinetic_packet": 0.8656222222222221, + "packet_consistency": 0.7405333333333334, + "pna_flow": 0.13899999999999998, + "pna_packet_max": 0.6198, + "pna_packet_mean": 0.4745111111111111, + "pna_packet_median": 0.4759555555555555, + "pna_packet_trimmed10_mean": 0.4772, + "terminal_flow": 0.8466, + "terminal_norm": 0.8852444444444445, + "terminal_packet": 0.8754222222222222, + "velocity_flow": 0.8381555555555555, + "velocity_flow_t01": 0.7856, + "velocity_flow_t03": 0.8260666666666666, + "velocity_flow_t05": 0.8356444444444445, + "velocity_flow_t07": 0.8384666666666667, + "velocity_flow_t09": 0.8390888888888889, + "velocity_flow_t10": 0.8046666666666665, + "velocity_packet": 0.7187555555555555, + "velocity_packet_t01": 0.5971555555555556, + "velocity_packet_t03": 0.6337111111111111, + "velocity_packet_t05": 0.6858888888888889, + "velocity_packet_t07": 0.6962666666666667, + "velocity_packet_t09": 0.6809555555555555, + "velocity_packet_t10": 0.7967333333333333, + "velocity_total": 0.7823777777777778, + "velocity_total_t01": 0.7017333333333333, + "velocity_total_t03": 0.7196444444444443, + "velocity_total_t05": 0.7249555555555556, + "velocity_total_t07": 0.7530444444444444, + "velocity_total_t09": 0.8327777777777778, + "velocity_total_t10": 0.8203333333333334 + }, + "commandinjection": { + "_n": 11.0, + "arc_length": 0.7592363636363637, + "causal_surprisal_flow": 0.3372909090909091, + "causal_surprisal_packet_max": 0.4942545454545455, + "causal_surprisal_packet_mean": 0.5197818181818181, + "causal_surprisal_packet_median": 0.5579272727272727, + "causal_surprisal_packet_trimmed10_mean": 0.5208545454545455, + "causal_surprisal_total": 0.3482363636363636, + "consistency_total": 0.666309090909091, + "curvature_flow": 0.2006363636363636, + "curvature_packet": 0.5543454545454545, + "curvature_total": 0.24636363636363634, + "direction_drift_flow": 0.39589090909090907, + "direction_drift_packet_max": 0.5268909090909091, + "direction_drift_packet_mean": 0.48139999999999994, + "direction_drift_packet_median": 0.49523636363636364, + "direction_drift_packet_trimmed10_mean": 0.4924545454545454, + "direction_drift_total": 0.41330909090909096, + "flow_consistency": 0.7328, + "jacobian_flow": 0.4958, + "jacobian_packet": 0.5540909090909091, + "jacobian_total": 0.550309090909091, + "kappa2_speed2norm_packet_mean": 0.3466181818181818, + "kappa2_speed2norm_packet_median": 0.3912, + "kappa2_speed2norm_packet_trimmed10_mean": 0.35416363636363635, + "kinetic_energy": 0.7523454545454545, + "kinetic_flow": 0.688309090909091, + "kinetic_packet": 0.7435636363636363, + "packet_consistency": 0.5019636363636364, + "pna_flow": 0.22441818181818185, + "pna_packet_max": 0.35318181818181815, + "pna_packet_mean": 0.3466181818181818, + "pna_packet_median": 0.3912, + "pna_packet_trimmed10_mean": 0.35416363636363635, + "terminal_flow": 0.8859272727272729, + "terminal_norm": 0.859909090909091, + "terminal_packet": 0.7549818181818181, + "velocity_flow": 0.6632909090909092, + "velocity_flow_t01": 0.6487272727272727, + "velocity_flow_t03": 0.6468909090909091, + "velocity_flow_t05": 0.6367090909090909, + "velocity_flow_t07": 0.6506727272727273, + "velocity_flow_t09": 0.7027272727272728, + "velocity_flow_t10": 0.7081090909090909, + "velocity_packet": 0.4773272727272727, + "velocity_packet_t01": 0.40947272727272727, + "velocity_packet_t03": 0.4312727272727273, + "velocity_packet_t05": 0.4541818181818182, + "velocity_packet_t07": 0.45372727272727276, + "velocity_packet_t09": 0.45152727272727267, + "velocity_packet_t10": 0.5713272727272727, + "velocity_total": 0.6755636363636364, + "velocity_total_t01": 0.5507090909090909, + "velocity_total_t03": 0.5486, + "velocity_total_t05": 0.5669090909090909, + "velocity_total_t07": 0.6557272727272727, + "velocity_total_t09": 0.7439636363636364, + "velocity_total_t10": 0.7570363636363636 + }, + "ddos-ack_fragmentation": { + "_n": 310.0, + "arc_length": 0.9788129032258065, + "causal_surprisal_flow": 0.07562387096774194, + "causal_surprisal_packet_max": 0.6187503225806452, + "causal_surprisal_packet_mean": 0.7636070967741936, + "causal_surprisal_packet_median": 0.9432393548387097, + "causal_surprisal_packet_trimmed10_mean": 0.8270922580645161, + "causal_surprisal_total": 0.1334974193548387, + "consistency_total": 0.8802535483870968, + "curvature_flow": 0.02662129032258065, + "curvature_packet": 0.8862877419354839, + "curvature_total": 0.08562516129032258, + "direction_drift_flow": 0.17003870967741935, + "direction_drift_packet_max": 0.2237103225806452, + "direction_drift_packet_mean": 0.1353458064516129, + "direction_drift_packet_median": 0.16343741935483871, + "direction_drift_packet_trimmed10_mean": 0.143938064516129, + "direction_drift_total": 0.035270967741935486, + "flow_consistency": 0.7227148387096773, + "jacobian_flow": 0.1266141935483871, + "jacobian_packet": 0.6405535483870967, + "jacobian_total": 0.20313612903225803, + "kappa2_speed2norm_packet_mean": 0.08943032258064515, + "kappa2_speed2norm_packet_median": 0.09211548387096774, + "kappa2_speed2norm_packet_trimmed10_mean": 0.09310387096774195, + "kinetic_energy": 0.9780193548387097, + "kinetic_flow": 0.803352258064516, + "kinetic_packet": 0.9695400000000002, + "packet_consistency": 0.9504754838709677, + "pna_flow": 0.05367612903225807, + "pna_packet_max": 0.1500916129032258, + "pna_packet_mean": 0.08943032258064515, + "pna_packet_median": 0.09211548387096774, + "pna_packet_trimmed10_mean": 0.09310387096774195, + "terminal_flow": 0.9662774193548386, + "terminal_norm": 0.9872993548387096, + "terminal_packet": 0.974298064516129, + "velocity_flow": 0.8521483870967742, + "velocity_flow_t01": 0.8672522580645162, + "velocity_flow_t03": 0.8601051612903226, + "velocity_flow_t05": 0.8550387096774194, + "velocity_flow_t07": 0.8531045161290323, + "velocity_flow_t09": 0.8392612903225806, + "velocity_flow_t10": 0.8382825806451613, + "velocity_packet": 0.9685335483870968, + "velocity_packet_t01": 0.5781187096774193, + "velocity_packet_t03": 0.7049632258064517, + "velocity_packet_t05": 0.918934193548387, + "velocity_packet_t07": 0.9683774193548388, + "velocity_packet_t09": 0.9685812903225807, + "velocity_packet_t10": 0.9770141935483871, + "velocity_total": 0.9793219354838709, + "velocity_total_t01": 0.9579812903225806, + "velocity_total_t03": 0.9709832258064516, + "velocity_total_t05": 0.9768496774193548, + "velocity_total_t07": 0.977930322580645, + "velocity_total_t09": 0.9770767741935484, + "velocity_total_t10": 0.9848529032258065 + }, + "ddos-http_flood": { + "_n": 918.0, + "arc_length": 0.9380843137254902, + "causal_surprisal_flow": 0.4420838779956427, + "causal_surprisal_packet_max": 0.8022444444444444, + "causal_surprisal_packet_mean": 0.9278520697167755, + "causal_surprisal_packet_median": 0.9321226579520698, + "causal_surprisal_packet_trimmed10_mean": 0.9342084967320262, + "causal_surprisal_total": 0.5122169934640523, + "consistency_total": 0.904717211328976, + "curvature_flow": 0.03235729847494555, + "curvature_packet": 0.9202727668845315, + "curvature_total": 0.19075762527233114, + "direction_drift_flow": 0.28485893246187366, + "direction_drift_packet_max": 0.4801283224400872, + "direction_drift_packet_mean": 0.4311745098039216, + "direction_drift_packet_median": 0.4224174291938998, + "direction_drift_packet_trimmed10_mean": 0.430278431372549, + "direction_drift_total": 0.25551753812636163, + "flow_consistency": 0.8684568627450981, + "jacobian_flow": 0.3427727668845316, + "jacobian_packet": 0.8260139433551198, + "jacobian_total": 0.6448509803921568, + "kappa2_speed2norm_packet_mean": 0.3292107843137255, + "kappa2_speed2norm_packet_median": 0.3475958605664488, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3374156862745098, + "kinetic_energy": 0.9349825708061001, + "kinetic_flow": 0.7866381263616558, + "kinetic_packet": 0.9657858387799565, + "packet_consistency": 0.8301360566448802, + "pna_flow": 0.04376579520697167, + "pna_packet_max": 0.3601592592592593, + "pna_packet_mean": 0.3292107843137255, + "pna_packet_median": 0.3475958605664488, + "pna_packet_trimmed10_mean": 0.3374156862745098, + "terminal_flow": 0.9324901960784315, + "terminal_norm": 0.9868642701525054, + "terminal_packet": 0.9738069716775598, + "velocity_flow": 0.7319444444444445, + "velocity_flow_t01": 0.6769531590413943, + "velocity_flow_t03": 0.6761919389978213, + "velocity_flow_t05": 0.6890246187363833, + "velocity_flow_t07": 0.714921568627451, + "velocity_flow_t09": 0.855999128540305, + "velocity_flow_t10": 0.8568692810457517, + "velocity_packet": 0.772045533769063, + "velocity_packet_t01": 0.32007450980392155, + "velocity_packet_t03": 0.4206095860566449, + "velocity_packet_t05": 0.6373962962962963, + "velocity_packet_t07": 0.8049777777777778, + "velocity_packet_t09": 0.862255991285403, + "velocity_packet_t10": 0.9041859477124183, + "velocity_total": 0.8859037037037036, + "velocity_total_t01": 0.6012010893246188, + "velocity_total_t03": 0.6528498910675381, + "velocity_total_t05": 0.7214047930283225, + "velocity_total_t07": 0.880089651416122, + "velocity_total_t09": 0.9188932461873638, + "velocity_total_t10": 0.9425943355119825 + }, + "ddos-icmp_flood": { + "_n": 24.0, + "arc_length": 0.6879583333333333, + "causal_surprisal_flow": 0.3690583333333333, + "causal_surprisal_packet_max": 0.4948083333333333, + "causal_surprisal_packet_mean": 0.5214416666666667, + "causal_surprisal_packet_median": 0.5346916666666667, + "causal_surprisal_packet_trimmed10_mean": 0.535325, + "causal_surprisal_total": 0.36474166666666663, + "consistency_total": 0.5518166666666666, + "curvature_flow": 0.42914166666666664, + "curvature_packet": 0.5625416666666667, + "curvature_total": 0.4925583333333333, + "direction_drift_flow": 0.38959166666666667, + "direction_drift_packet_max": 0.49592499999999995, + "direction_drift_packet_mean": 0.4314666666666668, + "direction_drift_packet_median": 0.4249, + "direction_drift_packet_trimmed10_mean": 0.4325583333333333, + "direction_drift_total": 0.41089166666666666, + "flow_consistency": 0.5657, + "jacobian_flow": 0.4468666666666667, + "jacobian_packet": 0.6267166666666667, + "jacobian_total": 0.5594750000000001, + "kappa2_speed2norm_packet_mean": 0.448175, + "kappa2_speed2norm_packet_median": 0.43995000000000006, + "kappa2_speed2norm_packet_trimmed10_mean": 0.45467500000000005, + "kinetic_energy": 0.6856666666666666, + "kinetic_flow": 0.6160166666666667, + "kinetic_packet": 0.6754416666666667, + "packet_consistency": 0.539525, + "pna_flow": 0.4265583333333334, + "pna_packet_max": 0.48677499999999996, + "pna_packet_mean": 0.448175, + "pna_packet_median": 0.43995000000000006, + "pna_packet_trimmed10_mean": 0.45467500000000005, + "terminal_flow": 0.6419166666666667, + "terminal_norm": 0.6716, + "terminal_packet": 0.6521, + "velocity_flow": 0.6172916666666667, + "velocity_flow_t01": 0.6095333333333333, + "velocity_flow_t03": 0.6118666666666667, + "velocity_flow_t05": 0.6114, + "velocity_flow_t07": 0.6130083333333334, + "velocity_flow_t09": 0.6470666666666667, + "velocity_flow_t10": 0.5749, + "velocity_packet": 0.49111666666666665, + "velocity_packet_t01": 0.48220833333333335, + "velocity_packet_t03": 0.4912833333333333, + "velocity_packet_t05": 0.5130166666666667, + "velocity_packet_t07": 0.5188999999999999, + "velocity_packet_t09": 0.5269333333333334, + "velocity_packet_t10": 0.5117666666666667, + "velocity_total": 0.5810583333333332, + "velocity_total_t01": 0.5455083333333333, + "velocity_total_t03": 0.5775916666666666, + "velocity_total_t05": 0.5800000000000001, + "velocity_total_t07": 0.5942999999999999, + "velocity_total_t09": 0.6301166666666665, + "velocity_total_t10": 0.56395 + }, + "ddos-icmp_fragmentation": { + "_n": 37.0, + "arc_length": 0.7726486486486486, + "causal_surprisal_flow": 0.34263243243243247, + "causal_surprisal_packet_max": 0.5462756756756757, + "causal_surprisal_packet_mean": 0.5557621621621621, + "causal_surprisal_packet_median": 0.6210756756756757, + "causal_surprisal_packet_trimmed10_mean": 0.5685675675675675, + "causal_surprisal_total": 0.30502702702702705, + "consistency_total": 0.6742270270270271, + "curvature_flow": 0.21632972972972975, + "curvature_packet": 0.655091891891892, + "curvature_total": 0.3674972972972973, + "direction_drift_flow": 0.32491351351351355, + "direction_drift_packet_max": 0.5894756756756756, + "direction_drift_packet_mean": 0.5311567567567568, + "direction_drift_packet_median": 0.4838216216216217, + "direction_drift_packet_trimmed10_mean": 0.5314486486486486, + "direction_drift_total": 0.45644324324324326, + "flow_consistency": 0.6717081081081081, + "jacobian_flow": 0.33432432432432435, + "jacobian_packet": 0.559135135135135, + "jacobian_total": 0.45622162162162166, + "kappa2_speed2norm_packet_mean": 0.47291351351351346, + "kappa2_speed2norm_packet_median": 0.4694594594594595, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4902324324324324, + "kinetic_energy": 0.7693513513513515, + "kinetic_flow": 0.6376702702702703, + "kinetic_packet": 0.8176918918918918, + "packet_consistency": 0.5653135135135134, + "pna_flow": 0.23712972972972976, + "pna_packet_max": 0.5258, + "pna_packet_mean": 0.47291351351351346, + "pna_packet_median": 0.4694594594594595, + "pna_packet_trimmed10_mean": 0.4902324324324324, + "terminal_flow": 0.8085405405405405, + "terminal_norm": 0.847854054054054, + "terminal_packet": 0.8258378378378378, + "velocity_flow": 0.680572972972973, + "velocity_flow_t01": 0.6890594594594596, + "velocity_flow_t03": 0.676454054054054, + "velocity_flow_t05": 0.6638540540540541, + "velocity_flow_t07": 0.6667567567567567, + "velocity_flow_t09": 0.7122918918918918, + "velocity_flow_t10": 0.6984216216216216, + "velocity_packet": 0.5496432432432432, + "velocity_packet_t01": 0.439427027027027, + "velocity_packet_t03": 0.48986486486486486, + "velocity_packet_t05": 0.5324486486486486, + "velocity_packet_t07": 0.581772972972973, + "velocity_packet_t09": 0.5647243243243243, + "velocity_packet_t10": 0.5796, + "velocity_total": 0.6899459459459459, + "velocity_total_t01": 0.5794216216216217, + "velocity_total_t03": 0.605772972972973, + "velocity_total_t05": 0.6398702702702703, + "velocity_total_t07": 0.6894594594594595, + "velocity_total_t09": 0.7194540540540539, + "velocity_total_t10": 0.714437837837838 + }, + "ddos-pshack_flood": { + "_n": 1030.0, + "arc_length": 0.9930658252427184, + "causal_surprisal_flow": 0.06285533980582524, + "causal_surprisal_packet_max": 0.6359753398058252, + "causal_surprisal_packet_mean": 0.7294143689320388, + "causal_surprisal_packet_median": 0.9112619417475728, + "causal_surprisal_packet_trimmed10_mean": 0.7607897087378642, + "causal_surprisal_total": 0.1038221359223301, + "consistency_total": 0.8576409708737865, + "curvature_flow": 0.00947922330097088, + "curvature_packet": 0.9492753398058253, + "curvature_total": 0.30742087378640776, + "direction_drift_flow": 0.12763999999999998, + "direction_drift_packet_max": 0.327511359223301, + "direction_drift_packet_mean": 0.3463566990291262, + "direction_drift_packet_median": 0.35292067961165047, + "direction_drift_packet_trimmed10_mean": 0.3347761165048544, + "direction_drift_total": 0.19424611650485438, + "flow_consistency": 0.8245120388349516, + "jacobian_flow": 0.07279631067961166, + "jacobian_packet": 0.8543062135922331, + "jacobian_total": 0.4710106796116505, + "kappa2_speed2norm_packet_mean": 0.12069815533980582, + "kappa2_speed2norm_packet_median": 0.1348383495145631, + "kappa2_speed2norm_packet_trimmed10_mean": 0.10565446601941748, + "kinetic_energy": 0.9929617475728155, + "kinetic_flow": 0.8609965048543691, + "kinetic_packet": 0.9947811650485437, + "packet_consistency": 0.868611067961165, + "pna_flow": 0.022211262135922335, + "pna_packet_max": 0.13662233009708738, + "pna_packet_mean": 0.12069815533980582, + "pna_packet_median": 0.1348383495145631, + "pna_packet_trimmed10_mean": 0.10565446601941748, + "terminal_flow": 0.9461324271844659, + "terminal_norm": 0.9952332038834951, + "terminal_packet": 0.9917362135922331, + "velocity_flow": 0.8783537864077671, + "velocity_flow_t01": 0.8560817475728156, + "velocity_flow_t03": 0.8524209708737864, + "velocity_flow_t05": 0.8506180582524272, + "velocity_flow_t07": 0.8774497087378641, + "velocity_flow_t09": 0.8759747572815534, + "velocity_flow_t10": 0.874826213592233, + "velocity_packet": 0.9314632038834952, + "velocity_packet_t01": 0.5773349514563105, + "velocity_packet_t03": 0.6335400000000001, + "velocity_packet_t05": 0.8396776699029127, + "velocity_packet_t07": 0.9164988349514562, + "velocity_packet_t09": 0.9509532038834951, + "velocity_packet_t10": 0.9941642718446602, + "velocity_total": 0.9396061165048544, + "velocity_total_t01": 0.8939544660194175, + "velocity_total_t03": 0.9130706796116504, + "velocity_total_t05": 0.9192295145631068, + "velocity_total_t07": 0.9262387378640777, + "velocity_total_t09": 0.9475625242718446, + "velocity_total_t10": 0.9707618446601942 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "arc_length": 0.48500000000000004, + "causal_surprisal_flow": 0.1508, + "causal_surprisal_packet_max": 0.9844999999999999, + "causal_surprisal_packet_mean": 0.8673, + "causal_surprisal_packet_median": 0.9702999999999999, + "causal_surprisal_packet_trimmed10_mean": 0.8518, + "causal_surprisal_total": 0.08829999999999999, + "consistency_total": 0.9758, + "curvature_flow": 0.09000000000000002, + "curvature_packet": 0.8774, + "curvature_total": 0.301, + "direction_drift_flow": 0.03300000000000003, + "direction_drift_packet_max": 0.9256, + "direction_drift_packet_mean": 0.7478, + "direction_drift_packet_median": 0.77, + "direction_drift_packet_trimmed10_mean": 0.7506, + "direction_drift_total": 0.8494999999999999, + "flow_consistency": 0.9775, + "jacobian_flow": 0.013300000000000034, + "jacobian_packet": 0.4194, + "jacobian_total": 0.3679, + "kappa2_speed2norm_packet_mean": 0.3674, + "kappa2_speed2norm_packet_median": 0.3875, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3641, + "kinetic_energy": 0.4643, + "kinetic_flow": 0.9814999999999999, + "kinetic_packet": 0.8283, + "packet_consistency": 0.6459, + "pna_flow": 0.03370000000000001, + "pna_packet_max": 0.6232000000000001, + "pna_packet_mean": 0.3674, + "pna_packet_median": 0.3875, + "pna_packet_trimmed10_mean": 0.3641, + "terminal_flow": 0.9906, + "terminal_norm": 0.9492999999999999, + "terminal_packet": 0.9052, + "velocity_flow": 0.9899, + "velocity_flow_t01": 0.9906, + "velocity_flow_t03": 0.9904, + "velocity_flow_t05": 0.9904000000000001, + "velocity_flow_t07": 0.9899, + "velocity_flow_t09": 0.9899, + "velocity_flow_t10": 0.9896999999999999, + "velocity_packet": 0.6006, + "velocity_packet_t01": 0.30989999999999995, + "velocity_packet_t03": 0.30210000000000004, + "velocity_packet_t05": 0.2979, + "velocity_packet_t07": 0.4027, + "velocity_packet_t09": 0.7519, + "velocity_packet_t10": 0.9703, + "velocity_total": 0.6797, + "velocity_total_t01": 0.5367999999999999, + "velocity_total_t03": 0.5367999999999999, + "velocity_total_t05": 0.5271, + "velocity_total_t07": 0.6102000000000001, + "velocity_total_t09": 0.7705, + "velocity_total_t10": 0.8727 + }, + "ddos-slowloris": { + "_n": 304.0, + "arc_length": 0.7048657894736843, + "causal_surprisal_flow": 0.46871447368421054, + "causal_surprisal_packet_max": 0.6946092105263157, + "causal_surprisal_packet_mean": 0.7327967105263157, + "causal_surprisal_packet_median": 0.7849138157894737, + "causal_surprisal_packet_trimmed10_mean": 0.7360585526315789, + "causal_surprisal_total": 0.3949677631578948, + "consistency_total": 0.8901625000000001, + "curvature_flow": 0.09669802631578947, + "curvature_packet": 0.7660493421052631, + "curvature_total": 0.1747967105263158, + "direction_drift_flow": 0.2312092105263158, + "direction_drift_packet_max": 0.8456638157894735, + "direction_drift_packet_mean": 0.7980282894736842, + "direction_drift_packet_median": 0.743113157894737, + "direction_drift_packet_trimmed10_mean": 0.7683789473684209, + "direction_drift_total": 0.7915680921052632, + "flow_consistency": 0.8951809210526315, + "jacobian_flow": 0.18191447368421051, + "jacobian_packet": 0.4325973684210526, + "jacobian_total": 0.3276769736842105, + "kappa2_speed2norm_packet_mean": 0.5103687499999999, + "kappa2_speed2norm_packet_median": 0.4847526315789473, + "kappa2_speed2norm_packet_trimmed10_mean": 0.45142499999999997, + "kinetic_energy": 0.6954776315789473, + "kinetic_flow": 0.7761776315789474, + "kinetic_packet": 0.8624292763157896, + "packet_consistency": 0.7699203947368423, + "pna_flow": 0.10483421052631578, + "pna_packet_max": 0.6825651315789473, + "pna_packet_mean": 0.5103687499999999, + "pna_packet_median": 0.4847526315789473, + "pna_packet_trimmed10_mean": 0.45142499999999997, + "terminal_flow": 0.9503138157894737, + "terminal_norm": 0.9581052631578948, + "terminal_packet": 0.9209506578947367, + "velocity_flow": 0.8016796052631578, + "velocity_flow_t01": 0.7811194078947369, + "velocity_flow_t03": 0.7752407894736841, + "velocity_flow_t05": 0.7737565789473684, + "velocity_flow_t07": 0.7924374999999999, + "velocity_flow_t09": 0.8282315789473684, + "velocity_flow_t10": 0.8323190789473683, + "velocity_packet": 0.6289052631578947, + "velocity_packet_t01": 0.5377177631578948, + "velocity_packet_t03": 0.5796743421052633, + "velocity_packet_t05": 0.6194907894736843, + "velocity_packet_t07": 0.6258059210526317, + "velocity_packet_t09": 0.5451730263157895, + "velocity_packet_t10": 0.7212078947368422, + "velocity_total": 0.7612822368421053, + "velocity_total_t01": 0.6105322368421052, + "velocity_total_t03": 0.6318848684210526, + "velocity_total_t05": 0.6644177631578949, + "velocity_total_t07": 0.7357986842105264, + "velocity_total_t09": 0.710158552631579, + "velocity_total_t10": 0.8215789473684211 + }, + "ddos-syn_flood": { + "_n": 1195.0, + "arc_length": 0.9874691213389121, + "causal_surprisal_flow": 0.05991414225941423, + "causal_surprisal_packet_max": 0.8730289539748953, + "causal_surprisal_packet_mean": 0.928061589958159, + "causal_surprisal_packet_median": 0.9471600000000001, + "causal_surprisal_packet_trimmed10_mean": 0.8215136401673641, + "causal_surprisal_total": 0.1290882008368201, + "consistency_total": 0.8841862761506276, + "curvature_flow": 0.010933054393305452, + "curvature_packet": 0.9574528870292888, + "curvature_total": 0.35124251046025107, + "direction_drift_flow": 0.1318797489539749, + "direction_drift_packet_max": 0.8581557322175732, + "direction_drift_packet_mean": 0.6170056903765689, + "direction_drift_packet_median": 0.27126619246861927, + "direction_drift_packet_trimmed10_mean": 0.4242468619246862, + "direction_drift_total": 0.43972878661087866, + "flow_consistency": 0.8422614225941423, + "jacobian_flow": 0.06634359832635983, + "jacobian_packet": 0.741062928870293, + "jacobian_total": 0.41410376569037655, + "kappa2_speed2norm_packet_mean": 0.22240016736401672, + "kappa2_speed2norm_packet_median": 0.19264276150627616, + "kappa2_speed2norm_packet_trimmed10_mean": 0.19398276150627614, + "kinetic_energy": 0.9872774895397489, + "kinetic_flow": 0.8611887866108786, + "kinetic_packet": 0.9891651882845188, + "packet_consistency": 0.9051218410041841, + "pna_flow": 0.020829121338912134, + "pna_packet_max": 0.29431665271966523, + "pna_packet_mean": 0.22240016736401672, + "pna_packet_median": 0.19264276150627616, + "pna_packet_trimmed10_mean": 0.19398276150627614, + "terminal_flow": 0.9554743096234309, + "terminal_norm": 0.9935059414225942, + "terminal_packet": 0.9809114644351465, + "velocity_flow": 0.8692055230125523, + "velocity_flow_t01": 0.8638996652719666, + "velocity_flow_t03": 0.8590733891213389, + "velocity_flow_t05": 0.8558115481171549, + "velocity_flow_t07": 0.8691280334728033, + "velocity_flow_t09": 0.8695112970711297, + "velocity_flow_t10": 0.8672323012552301, + "velocity_packet": 0.9497248535564854, + "velocity_packet_t01": 0.6041339748953976, + "velocity_packet_t03": 0.7778960669456066, + "velocity_packet_t05": 0.8891275313807532, + "velocity_packet_t07": 0.9380775732217573, + "velocity_packet_t09": 0.948418410041841, + "velocity_packet_t10": 0.9867395815899582, + "velocity_total": 0.9559260251046023, + "velocity_total_t01": 0.899989958158996, + "velocity_total_t03": 0.9201586610878659, + "velocity_total_t05": 0.9332214225941422, + "velocity_total_t07": 0.9445000836820083, + "velocity_total_t09": 0.941202510460251, + "velocity_total_t10": 0.9680758158995816 + }, + "ddos-synonymousip_flood": { + "_n": 164.0, + "arc_length": 0.9341548780487805, + "causal_surprisal_flow": 0.039201219512195115, + "causal_surprisal_packet_max": 0.8463536585365853, + "causal_surprisal_packet_mean": 0.6280109756097562, + "causal_surprisal_packet_median": 0.5180182926829269, + "causal_surprisal_packet_trimmed10_mean": 0.5559914634146341, + "causal_surprisal_total": 0.009869512195121954, + "consistency_total": 0.9996951219512195, + "curvature_flow": 9.756097560975889e-06, + "curvature_packet": 0.9606219512195122, + "curvature_total": 0.466244512195122, + "direction_drift_flow": 0.01512134146341464, + "direction_drift_packet_max": 0.8932536585365853, + "direction_drift_packet_mean": 0.47656463414634154, + "direction_drift_packet_median": 0.39611585365853663, + "direction_drift_packet_trimmed10_mean": 0.4251243902439025, + "direction_drift_total": 0.641495731707317, + "flow_consistency": 0.9995170731707317, + "jacobian_flow": 0.0034792682926829276, + "jacobian_packet": 0.4972841463414634, + "jacobian_total": 0.43116463414634143, + "kappa2_speed2norm_packet_mean": 0.5612682926829269, + "kappa2_speed2norm_packet_median": 0.6018213414634146, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6079536585365853, + "kinetic_energy": 0.9356024390243902, + "kinetic_flow": 0.9130024390243903, + "kinetic_packet": 0.9855, + "packet_consistency": 0.9861621951219511, + "pna_flow": 1.4634146341463157e-05, + "pna_packet_max": 0.6879719512195122, + "pna_packet_mean": 0.5612682926829269, + "pna_packet_median": 0.6018213414634146, + "pna_packet_trimmed10_mean": 0.6079536585365853, + "terminal_flow": 0.9999634146341463, + "terminal_norm": 0.9998012195121951, + "terminal_packet": 0.9835585365853657, + "velocity_flow": 0.9168756097560976, + "velocity_flow_t01": 0.9254951219512195, + "velocity_flow_t03": 0.9229073170731708, + "velocity_flow_t05": 0.9197524390243903, + "velocity_flow_t07": 0.9171621951219513, + "velocity_flow_t09": 0.914729268292683, + "velocity_flow_t10": 0.913959756097561, + "velocity_packet": 0.9469573170731707, + "velocity_packet_t01": 0.6306536585365854, + "velocity_packet_t03": 0.8003560975609756, + "velocity_packet_t05": 0.9358304878048781, + "velocity_packet_t07": 0.9557170731707317, + "velocity_packet_t09": 0.9288475609756096, + "velocity_packet_t10": 0.8850439024390244, + "velocity_total": 0.8631353658536586, + "velocity_total_t01": 0.5728829268292683, + "velocity_total_t03": 0.6305914634146341, + "velocity_total_t05": 0.8688817073170731, + "velocity_total_t07": 0.8727609756097561, + "velocity_total_t09": 0.8226018292682926, + "velocity_total_t10": 0.7724341463414635 + }, + "ddos-tcp_flood": { + "_n": 1255.0, + "arc_length": 0.9835518725099602, + "causal_surprisal_flow": 0.058498326693227104, + "causal_surprisal_packet_max": 0.6614425498007969, + "causal_surprisal_packet_mean": 0.7526132270916335, + "causal_surprisal_packet_median": 0.9236157768924302, + "causal_surprisal_packet_trimmed10_mean": 0.8437435856573705, + "causal_surprisal_total": 0.10689561752988047, + "consistency_total": 0.7942889243027889, + "curvature_flow": 0.007548047808764953, + "curvature_packet": 0.8356686055776892, + "curvature_total": 0.08101713147410358, + "direction_drift_flow": 0.12453418326693225, + "direction_drift_packet_max": 0.3257990438247012, + "direction_drift_packet_mean": 0.10324446215139443, + "direction_drift_packet_median": 0.060401274900398406, + "direction_drift_packet_trimmed10_mean": 0.10609609561752989, + "direction_drift_total": 0.014512191235059757, + "flow_consistency": 0.7202476494023904, + "jacobian_flow": 0.07854701195219124, + "jacobian_packet": 0.7344066932270916, + "jacobian_total": 0.3886676494023904, + "kappa2_speed2norm_packet_mean": 0.03365067729083665, + "kappa2_speed2norm_packet_median": 0.03562996015936255, + "kappa2_speed2norm_packet_trimmed10_mean": 0.03215474103585657, + "kinetic_energy": 0.9826962549800797, + "kinetic_flow": 0.835905498007968, + "kinetic_packet": 0.978012749003984, + "packet_consistency": 0.8415670119521912, + "pna_flow": 0.02412637450199203, + "pna_packet_max": 0.05658621513944223, + "pna_packet_mean": 0.03365067729083665, + "pna_packet_median": 0.03562996015936255, + "pna_packet_trimmed10_mean": 0.03215474103585657, + "terminal_flow": 0.9322350597609562, + "terminal_norm": 0.9836849402390437, + "terminal_packet": 0.9659716334661356, + "velocity_flow": 0.8730353784860557, + "velocity_flow_t01": 0.8299947410358565, + "velocity_flow_t03": 0.8284766533864542, + "velocity_flow_t05": 0.8279226294820716, + "velocity_flow_t07": 0.8728180079681275, + "velocity_flow_t09": 0.8691713147410359, + "velocity_flow_t10": 0.8675447011952191, + "velocity_packet": 0.9753509163346614, + "velocity_packet_t01": 0.6229732270916334, + "velocity_packet_t03": 0.7831412749003985, + "velocity_packet_t05": 0.8869928286852591, + "velocity_packet_t07": 0.9573295617529881, + "velocity_packet_t09": 0.9777403984063744, + "velocity_packet_t10": 0.999382470119522, + "velocity_total": 0.9851421513944222, + "velocity_total_t01": 0.9090776095617531, + "velocity_total_t03": 0.9422449402390438, + "velocity_total_t05": 0.9597300398406374, + "velocity_total_t07": 0.9773040637450199, + "velocity_total_t09": 0.9842268525896415, + "velocity_total_t10": 0.9897799203187251 + }, + "ddos-udp_flood": { + "_n": 15.0, + "arc_length": 0.8562533333333333, + "causal_surprisal_flow": 0.5877466666666666, + "causal_surprisal_packet_max": 0.8678666666666668, + "causal_surprisal_packet_mean": 0.57724, + "causal_surprisal_packet_median": 0.36429333333333336, + "causal_surprisal_packet_trimmed10_mean": 0.3721066666666667, + "causal_surprisal_total": 0.15644, + "consistency_total": 0.92416, + "curvature_flow": 0.1492266666666667, + "curvature_packet": 0.8532533333333333, + "curvature_total": 0.34653333333333336, + "direction_drift_flow": 0.09106666666666667, + "direction_drift_packet_max": 0.56004, + "direction_drift_packet_mean": 0.3046266666666667, + "direction_drift_packet_median": 0.29364, + "direction_drift_packet_trimmed10_mean": 0.2922533333333333, + "direction_drift_total": 0.40212000000000003, + "flow_consistency": 0.9451733333333333, + "jacobian_flow": 0.10944000000000001, + "jacobian_packet": 0.5061599999999999, + "jacobian_total": 0.41805333333333333, + "kappa2_speed2norm_packet_mean": 0.7061333333333334, + "kappa2_speed2norm_packet_median": 0.70908, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7058666666666666, + "kinetic_energy": 0.8574133333333332, + "kinetic_flow": 0.82016, + "kinetic_packet": 0.9345466666666666, + "packet_consistency": 0.6279733333333334, + "pna_flow": 0.14342666666666665, + "pna_packet_max": 0.73756, + "pna_packet_mean": 0.7061333333333334, + "pna_packet_median": 0.70908, + "pna_packet_trimmed10_mean": 0.7058666666666666, + "terminal_flow": 0.97856, + "terminal_norm": 0.9798133333333333, + "terminal_packet": 0.95808, + "velocity_flow": 0.9066266666666667, + "velocity_flow_t01": 0.9100133333333332, + "velocity_flow_t03": 0.9061466666666667, + "velocity_flow_t05": 0.90176, + "velocity_flow_t07": 0.8979866666666667, + "velocity_flow_t09": 0.8840266666666667, + "velocity_flow_t10": 0.8974133333333333, + "velocity_packet": 0.5849066666666667, + "velocity_packet_t01": 0.29413333333333336, + "velocity_packet_t03": 0.42224, + "velocity_packet_t05": 0.5583466666666667, + "velocity_packet_t07": 0.6243866666666666, + "velocity_packet_t09": 0.6592266666666666, + "velocity_packet_t10": 0.33369333333333334, + "velocity_total": 0.56172, + "velocity_total_t01": 0.5465066666666667, + "velocity_total_t03": 0.5459066666666667, + "velocity_total_t05": 0.5575733333333334, + "velocity_total_t07": 0.5569466666666667, + "velocity_total_t09": 0.5948266666666666, + "velocity_total_t10": 0.3238533333333333 + }, + "ddos-udp_fragmentation": { + "_n": 21.0, + "arc_length": 0.6822190476190476, + "causal_surprisal_flow": 0.29405714285714285, + "causal_surprisal_packet_max": 0.5550952380952381, + "causal_surprisal_packet_mean": 0.5121428571428571, + "causal_surprisal_packet_median": 0.48055238095238095, + "causal_surprisal_packet_trimmed10_mean": 0.4528952380952381, + "causal_surprisal_total": 0.23889523809523808, + "consistency_total": 0.7261809523809524, + "curvature_flow": 0.25388571428571427, + "curvature_packet": 0.6630095238095238, + "curvature_total": 0.38507619047619046, + "direction_drift_flow": 0.44558095238095236, + "direction_drift_packet_max": 0.5028857142857143, + "direction_drift_packet_mean": 0.4272666666666667, + "direction_drift_packet_median": 0.41014285714285714, + "direction_drift_packet_trimmed10_mean": 0.4190285714285714, + "direction_drift_total": 0.468847619047619, + "flow_consistency": 0.7333999999999999, + "jacobian_flow": 0.3423809523809523, + "jacobian_packet": 0.45570476190476195, + "jacobian_total": 0.4137047619047619, + "kappa2_speed2norm_packet_mean": 0.4865142857142857, + "kappa2_speed2norm_packet_median": 0.4821047619047618, + "kappa2_speed2norm_packet_trimmed10_mean": 0.476647619047619, + "kinetic_energy": 0.6771619047619049, + "kinetic_flow": 0.6495523809523809, + "kinetic_packet": 0.6876, + "packet_consistency": 0.5767809523809524, + "pna_flow": 0.2679333333333333, + "pna_packet_max": 0.4827238095238095, + "pna_packet_mean": 0.4865142857142857, + "pna_packet_median": 0.4821047619047618, + "pna_packet_trimmed10_mean": 0.476647619047619, + "terminal_flow": 0.8459142857142857, + "terminal_norm": 0.8306476190476191, + "terminal_packet": 0.6629047619047621, + "velocity_flow": 0.5986571428571429, + "velocity_flow_t01": 0.6850476190476191, + "velocity_flow_t03": 0.6490190476190476, + "velocity_flow_t05": 0.6104285714285713, + "velocity_flow_t07": 0.5905238095238095, + "velocity_flow_t09": 0.5904095238095237, + "velocity_flow_t10": 0.6233238095238096, + "velocity_packet": 0.5793714285714285, + "velocity_packet_t01": 0.3575333333333333, + "velocity_packet_t03": 0.434352380952381, + "velocity_packet_t05": 0.4916666666666666, + "velocity_packet_t07": 0.5182, + "velocity_packet_t09": 0.5829142857142857, + "velocity_packet_t10": 0.585952380952381, + "velocity_total": 0.6055142857142857, + "velocity_total_t01": 0.4934952380952381, + "velocity_total_t03": 0.5447904761904762, + "velocity_total_t05": 0.5467428571428572, + "velocity_total_t07": 0.5825142857142857, + "velocity_total_t09": 0.6045619047619047, + "velocity_total_t10": 0.6310666666666667 + }, + "dictionarybruteforce": { + "_n": 21.0, + "arc_length": 0.6987904761904762, + "causal_surprisal_flow": 0.39599047619047617, + "causal_surprisal_packet_max": 0.6302000000000001, + "causal_surprisal_packet_mean": 0.5855523809523809, + "causal_surprisal_packet_median": 0.6188571428571428, + "causal_surprisal_packet_trimmed10_mean": 0.6120380952380953, + "causal_surprisal_total": 0.3004952380952381, + "consistency_total": 0.8139714285714286, + "curvature_flow": 0.1852285714285714, + "curvature_packet": 0.7673333333333334, + "curvature_total": 0.26496190476190473, + "direction_drift_flow": 0.2659904761904762, + "direction_drift_packet_max": 0.7267142857142856, + "direction_drift_packet_mean": 0.7654190476190477, + "direction_drift_packet_median": 0.7717333333333334, + "direction_drift_packet_trimmed10_mean": 0.7846, + "direction_drift_total": 0.6975047619047618, + "flow_consistency": 0.7905142857142856, + "jacobian_flow": 0.3027714285714286, + "jacobian_packet": 0.5022380952380952, + "jacobian_total": 0.3988571428571428, + "kappa2_speed2norm_packet_mean": 0.5367238095238095, + "kappa2_speed2norm_packet_median": 0.6073904761904761, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5855999999999999, + "kinetic_energy": 0.6972285714285713, + "kinetic_flow": 0.6396952380952381, + "kinetic_packet": 0.8540190476190477, + "packet_consistency": 0.6868761904761904, + "pna_flow": 0.19066666666666665, + "pna_packet_max": 0.5440095238095237, + "pna_packet_mean": 0.5367238095238095, + "pna_packet_median": 0.6073904761904761, + "pna_packet_trimmed10_mean": 0.5855999999999999, + "terminal_flow": 0.8820095238095239, + "terminal_norm": 0.9215047619047619, + "terminal_packet": 0.8944380952380953, + "velocity_flow": 0.7539904761904761, + "velocity_flow_t01": 0.682952380952381, + "velocity_flow_t03": 0.7074190476190475, + "velocity_flow_t05": 0.7058476190476191, + "velocity_flow_t07": 0.7494952380952381, + "velocity_flow_t09": 0.7716952380952381, + "velocity_flow_t10": 0.7444857142857143, + "velocity_packet": 0.5825142857142858, + "velocity_packet_t01": 0.5335619047619047, + "velocity_packet_t03": 0.5470190476190476, + "velocity_packet_t05": 0.5620380952380952, + "velocity_packet_t07": 0.5688285714285715, + "velocity_packet_t09": 0.5238380952380952, + "velocity_packet_t10": 0.6827809523809523, + "velocity_total": 0.6897142857142857, + "velocity_total_t01": 0.5831238095238096, + "velocity_total_t03": 0.6158190476190477, + "velocity_total_t05": 0.666295238095238, + "velocity_total_t07": 0.6669904761904761, + "velocity_total_t09": 0.6991904761904761, + "velocity_total_t10": 0.7393714285714286 + }, + "dns_spoofing": { + "_n": 165.0, + "arc_length": 0.7693939393939394, + "causal_surprisal_flow": 0.25130060606060606, + "causal_surprisal_packet_max": 0.5543296969696969, + "causal_surprisal_packet_mean": 0.5425224242424243, + "causal_surprisal_packet_median": 0.5533381818181818, + "causal_surprisal_packet_trimmed10_mean": 0.5289563636363637, + "causal_surprisal_total": 0.2523115151515151, + "consistency_total": 0.6953951515151515, + "curvature_flow": 0.26828242424242427, + "curvature_packet": 0.7299072727272727, + "curvature_total": 0.4171357575757576, + "direction_drift_flow": 0.3415066666666666, + "direction_drift_packet_max": 0.5252121212121212, + "direction_drift_packet_mean": 0.3989393939393939, + "direction_drift_packet_median": 0.37930606060606065, + "direction_drift_packet_trimmed10_mean": 0.4078836363636364, + "direction_drift_total": 0.34627454545454545, + "flow_consistency": 0.6629272727272728, + "jacobian_flow": 0.32186666666666663, + "jacobian_packet": 0.49260363636363635, + "jacobian_total": 0.4049321212121212, + "kappa2_speed2norm_packet_mean": 0.37463636363636366, + "kappa2_speed2norm_packet_median": 0.38305818181818185, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3810545454545454, + "kinetic_energy": 0.7660957575757575, + "kinetic_flow": 0.6674557575757576, + "kinetic_packet": 0.7893151515151515, + "packet_consistency": 0.662140606060606, + "pna_flow": 0.2669345454545454, + "pna_packet_max": 0.4133078787878788, + "pna_packet_mean": 0.37463636363636366, + "pna_packet_median": 0.38305818181818185, + "pna_packet_trimmed10_mean": 0.3810545454545454, + "terminal_flow": 0.7730218181818183, + "terminal_norm": 0.825898181818182, + "terminal_packet": 0.7669018181818181, + "velocity_flow": 0.6785769696969697, + "velocity_flow_t01": 0.6693539393939394, + "velocity_flow_t03": 0.6735321212121211, + "velocity_flow_t05": 0.6560812121212121, + "velocity_flow_t07": 0.6634581818181818, + "velocity_flow_t09": 0.6737545454545454, + "velocity_flow_t10": 0.6847660606060606, + "velocity_packet": 0.6656133333333334, + "velocity_packet_t01": 0.5471163636363636, + "velocity_packet_t03": 0.5746666666666667, + "velocity_packet_t05": 0.6215042424242424, + "velocity_packet_t07": 0.6586872727272728, + "velocity_packet_t09": 0.6849866666666667, + "velocity_packet_t10": 0.7303521212121212, + "velocity_total": 0.7004521212121213, + "velocity_total_t01": 0.6314509090909091, + "velocity_total_t03": 0.6408442424242424, + "velocity_total_t05": 0.6517563636363636, + "velocity_total_t07": 0.6878745454545455, + "velocity_total_t09": 0.7193775757575758, + "velocity_total_t10": 0.7311575757575758 + }, + "dos-http_flood": { + "_n": 716.0, + "arc_length": 0.9122297486033519, + "causal_surprisal_flow": 0.5209416201117318, + "causal_surprisal_packet_max": 0.7716268156424582, + "causal_surprisal_packet_mean": 0.909959217877095, + "causal_surprisal_packet_median": 0.9222351955307262, + "causal_surprisal_packet_trimmed10_mean": 0.9198312849162011, + "causal_surprisal_total": 0.6136983240223464, + "consistency_total": 0.9054941340782122, + "curvature_flow": 0.024977374301676, + "curvature_packet": 0.9118865921787708, + "curvature_total": 0.14549553072625698, + "direction_drift_flow": 0.34234259776536313, + "direction_drift_packet_max": 0.482291061452514, + "direction_drift_packet_mean": 0.46905, + "direction_drift_packet_median": 0.47832053072625696, + "direction_drift_packet_trimmed10_mean": 0.48540684357541897, + "direction_drift_total": 0.2419378491620112, + "flow_consistency": 0.8960960893854749, + "jacobian_flow": 0.3776198324022346, + "jacobian_packet": 0.7723698324022346, + "jacobian_total": 0.6371983240223464, + "kappa2_speed2norm_packet_mean": 0.35118477653631286, + "kappa2_speed2norm_packet_median": 0.375972625698324, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3696502793296089, + "kinetic_energy": 0.9086938547486034, + "kinetic_flow": 0.8039648044692739, + "kinetic_packet": 0.9561916201117319, + "packet_consistency": 0.7637632681564246, + "pna_flow": 0.032937988826815645, + "pna_packet_max": 0.3739466480446927, + "pna_packet_mean": 0.35118477653631286, + "pna_packet_median": 0.375972625698324, + "pna_packet_trimmed10_mean": 0.3696502793296089, + "terminal_flow": 0.9370351955307262, + "terminal_norm": 0.9832583798882681, + "terminal_packet": 0.9656801675977652, + "velocity_flow": 0.6711719273743016, + "velocity_flow_t01": 0.6215745810055866, + "velocity_flow_t03": 0.6217391061452513, + "velocity_flow_t05": 0.6288265363128491, + "velocity_flow_t07": 0.6473553072625698, + "velocity_flow_t09": 0.844495251396648, + "velocity_flow_t10": 0.8435896648044693, + "velocity_packet": 0.710823184357542, + "velocity_packet_t01": 0.2074268156424581, + "velocity_packet_t03": 0.3337812849162012, + "velocity_packet_t05": 0.5747675977653631, + "velocity_packet_t07": 0.7525268156424582, + "velocity_packet_t09": 0.8462290502793296, + "velocity_packet_t10": 0.8621513966480445, + "velocity_total": 0.8714527932960894, + "velocity_total_t01": 0.5315213687150838, + "velocity_total_t03": 0.5749474860335195, + "velocity_total_t05": 0.6434237430167598, + "velocity_total_t07": 0.8643187150837989, + "velocity_total_t09": 0.9303645251396647, + "velocity_total_t10": 0.9434698324022347 + }, + "dos-syn_flood": { + "_n": 844.0, + "arc_length": 0.9779258293838862, + "causal_surprisal_flow": 0.0917722748815166, + "causal_surprisal_packet_max": 0.7071443127962085, + "causal_surprisal_packet_mean": 0.8495656398104265, + "causal_surprisal_packet_median": 0.9560575829383886, + "causal_surprisal_packet_trimmed10_mean": 0.8681075829383885, + "causal_surprisal_total": 0.1339542654028436, + "consistency_total": 0.877960663507109, + "curvature_flow": 0.04808578199052133, + "curvature_packet": 0.9614182464454977, + "curvature_total": 0.4072151658767772, + "direction_drift_flow": 0.14875177725118482, + "direction_drift_packet_max": 0.8865759478672987, + "direction_drift_packet_mean": 0.7802805687203792, + "direction_drift_packet_median": 0.5759046208530806, + "direction_drift_packet_trimmed10_mean": 0.6840832938388626, + "direction_drift_total": 0.681102251184834, + "flow_consistency": 0.8421180094786731, + "jacobian_flow": 0.13330995260663508, + "jacobian_packet": 0.7278184834123222, + "jacobian_total": 0.437139336492891, + "kappa2_speed2norm_packet_mean": 0.5759208530805687, + "kappa2_speed2norm_packet_median": 0.5918986966824644, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5777584123222748, + "kinetic_energy": 0.9777170616113745, + "kinetic_flow": 0.7920109004739336, + "kinetic_packet": 0.9875819905213269, + "packet_consistency": 0.8318542654028436, + "pna_flow": 0.0702777251184834, + "pna_packet_max": 0.5263575829383886, + "pna_packet_mean": 0.5759208530805687, + "pna_packet_median": 0.5918986966824644, + "pna_packet_trimmed10_mean": 0.5777584123222748, + "terminal_flow": 0.9425436018957346, + "terminal_norm": 0.9915805687203791, + "terminal_packet": 0.9879957345971563, + "velocity_flow": 0.8470646919431281, + "velocity_flow_t01": 0.8112995260663508, + "velocity_flow_t03": 0.8134748815165876, + "velocity_flow_t05": 0.8117428909952606, + "velocity_flow_t07": 0.8411267772511848, + "velocity_flow_t09": 0.8718680094786729, + "velocity_flow_t10": 0.8728829383886256, + "velocity_packet": 0.8381255924170615, + "velocity_packet_t01": 0.4483563981042654, + "velocity_packet_t03": 0.5836867298578199, + "velocity_packet_t05": 0.7600744075829384, + "velocity_packet_t07": 0.8707632701421801, + "velocity_packet_t09": 0.8390061611374408, + "velocity_packet_t10": 0.852005924170616, + "velocity_total": 0.8965450236966824, + "velocity_total_t01": 0.690170142180095, + "velocity_total_t03": 0.8166382701421802, + "velocity_total_t05": 0.8709684834123225, + "velocity_total_t07": 0.8954222748815164, + "velocity_total_t09": 0.8947137440758294, + "velocity_total_t10": 0.9202376777251186 + }, + "dos-tcp_flood": { + "_n": 1098.0, + "arc_length": 0.9807759562841529, + "causal_surprisal_flow": 0.09602112932604737, + "causal_surprisal_packet_max": 0.7011806921675775, + "causal_surprisal_packet_mean": 0.7929570127504555, + "causal_surprisal_packet_median": 0.9163306010928962, + "causal_surprisal_packet_trimmed10_mean": 0.8052568306010929, + "causal_surprisal_total": 0.14297887067395265, + "consistency_total": 0.8493608378870674, + "curvature_flow": 0.043404189435336984, + "curvature_packet": 0.8452142076502731, + "curvature_total": 0.17532440801457197, + "direction_drift_flow": 0.1905050091074681, + "direction_drift_packet_max": 0.3147308743169399, + "direction_drift_packet_mean": 0.09364080145719492, + "direction_drift_packet_median": 0.07391584699453552, + "direction_drift_packet_trimmed10_mean": 0.0730648451730419, + "direction_drift_total": 0.028869945355191252, + "flow_consistency": 0.8099553734061931, + "jacobian_flow": 0.15759981785063754, + "jacobian_packet": 0.6568123861566484, + "jacobian_total": 0.3772959016393443, + "kappa2_speed2norm_packet_mean": 0.06482276867030964, + "kappa2_speed2norm_packet_median": 0.06420163934426229, + "kappa2_speed2norm_packet_trimmed10_mean": 0.05542276867030965, + "kinetic_energy": 0.9799879781420765, + "kinetic_flow": 0.8016489981785063, + "kinetic_packet": 0.9855557377049179, + "packet_consistency": 0.8230890710382514, + "pna_flow": 0.06335428051001822, + "pna_packet_max": 0.13941985428051, + "pna_packet_mean": 0.06482276867030964, + "pna_packet_median": 0.06420163934426229, + "pna_packet_trimmed10_mean": 0.05542276867030965, + "terminal_flow": 0.9456803278688525, + "terminal_norm": 0.9911624772313298, + "terminal_packet": 0.9824994535519125, + "velocity_flow": 0.8215145719489981, + "velocity_flow_t01": 0.8036364298724955, + "velocity_flow_t03": 0.8146766848816029, + "velocity_flow_t05": 0.8153021857923496, + "velocity_flow_t07": 0.8150047358834241, + "velocity_flow_t09": 0.8472932604735883, + "velocity_flow_t10": 0.8540783242258652, + "velocity_packet": 0.9099542805100183, + "velocity_packet_t01": 0.5285233151183971, + "velocity_packet_t03": 0.6377040983606558, + "velocity_packet_t05": 0.7818176684881603, + "velocity_packet_t07": 0.8941377049180328, + "velocity_packet_t09": 0.9640180327868852, + "velocity_packet_t10": 0.9970519125683059, + "velocity_total": 0.9427998178506376, + "velocity_total_t01": 0.7754792349726776, + "velocity_total_t03": 0.8402329690346083, + "velocity_total_t05": 0.8967104735883423, + "velocity_total_t07": 0.9401708561020037, + "velocity_total_t09": 0.9583063752276867, + "velocity_total_t10": 0.9630300546448088 + }, + "dos-udp_flood": { + "_n": 177.0, + "arc_length": 0.9894158192090396, + "causal_surprisal_flow": 0.07405197740112994, + "causal_surprisal_packet_max": 0.9090937853107344, + "causal_surprisal_packet_mean": 0.5689570621468926, + "causal_surprisal_packet_median": 0.08905197740112994, + "causal_surprisal_packet_trimmed10_mean": 0.39325988700564973, + "causal_surprisal_total": 0.006364971751412425, + "consistency_total": 0.9963423728813559, + "curvature_flow": 0.0016689265536723452, + "curvature_packet": 0.970741242937853, + "curvature_total": 0.47797966101694916, + "direction_drift_flow": 0.060985310734463276, + "direction_drift_packet_max": 0.9171830508474577, + "direction_drift_packet_mean": 0.31402146892655364, + "direction_drift_packet_median": 0.23510677966101695, + "direction_drift_packet_trimmed10_mean": 0.24560338983050847, + "direction_drift_total": 0.459032768361582, + "flow_consistency": 0.9955661016949152, + "jacobian_flow": 0.011370621468926572, + "jacobian_packet": 0.13907966101694916, + "jacobian_total": 0.15082429378531073, + "kappa2_speed2norm_packet_mean": 0.32280338983050844, + "kappa2_speed2norm_packet_median": 0.3518954802259887, + "kappa2_speed2norm_packet_trimmed10_mean": 0.333490395480226, + "kinetic_energy": 0.9901378531073446, + "kinetic_flow": 0.9364101694915254, + "kinetic_packet": 0.9990225988700564, + "packet_consistency": 0.9981920903954802, + "pna_flow": 0.001657627118644064, + "pna_packet_max": 0.4098485875706215, + "pna_packet_mean": 0.32280338983050844, + "pna_packet_median": 0.3518954802259887, + "pna_packet_trimmed10_mean": 0.333490395480226, + "terminal_flow": 0.9982169491525423, + "terminal_norm": 0.9979265536723164, + "terminal_packet": 0.9966474576271187, + "velocity_flow": 0.9448632768361582, + "velocity_flow_t01": 0.9803254237288136, + "velocity_flow_t03": 0.9733559322033899, + "velocity_flow_t05": 0.9655615819209039, + "velocity_flow_t07": 0.9446327683615818, + "velocity_flow_t09": 0.9395898305084746, + "velocity_flow_t10": 0.9370045197740113, + "velocity_packet": 0.9975966101694915, + "velocity_packet_t01": 0.9936836158192092, + "velocity_packet_t03": 0.9944305084745764, + "velocity_packet_t05": 0.9967830508474577, + "velocity_packet_t07": 0.9985016949152543, + "velocity_packet_t09": 0.9915593220338983, + "velocity_packet_t10": 0.9514531073446328, + "velocity_total": 0.9225305084745763, + "velocity_total_t01": 0.9701898305084746, + "velocity_total_t03": 0.9799717514124293, + "velocity_total_t05": 0.9865186440677967, + "velocity_total_t07": 0.9836248587570621, + "velocity_total_t09": 0.890625988700565, + "velocity_total_t10": 0.8401853107344632 + }, + "mirai-greeth_flood": { + "_n": 8.0, + "arc_length": 0.6778, + "causal_surprisal_flow": 0.25379999999999997, + "causal_surprisal_packet_max": 0.5124249999999999, + "causal_surprisal_packet_mean": 0.515725, + "causal_surprisal_packet_median": 0.5872999999999999, + "causal_surprisal_packet_trimmed10_mean": 0.53355, + "causal_surprisal_total": 0.34154999999999996, + "consistency_total": 0.5948, + "curvature_flow": 0.36047500000000005, + "curvature_packet": 0.489625, + "curvature_total": 0.4230499999999999, + "direction_drift_flow": 0.4948, + "direction_drift_packet_max": 0.44355, + "direction_drift_packet_mean": 0.445175, + "direction_drift_packet_median": 0.4615, + "direction_drift_packet_trimmed10_mean": 0.464475, + "direction_drift_total": 0.43045, + "flow_consistency": 0.648825, + "jacobian_flow": 0.39580000000000004, + "jacobian_packet": 0.528, + "jacobian_total": 0.44882500000000003, + "kappa2_speed2norm_packet_mean": 0.27292500000000003, + "kappa2_speed2norm_packet_median": 0.29167499999999996, + "kappa2_speed2norm_packet_trimmed10_mean": 0.281625, + "kinetic_energy": 0.67425, + "kinetic_flow": 0.5330250000000001, + "kinetic_packet": 0.66515, + "packet_consistency": 0.4377250000000001, + "pna_flow": 0.365375, + "pna_packet_max": 0.300525, + "pna_packet_mean": 0.27292500000000003, + "pna_packet_median": 0.29167499999999996, + "pna_packet_trimmed10_mean": 0.281625, + "terminal_flow": 0.723225, + "terminal_norm": 0.743325, + "terminal_packet": 0.64395, + "velocity_flow": 0.5261499999999999, + "velocity_flow_t01": 0.57545, + "velocity_flow_t03": 0.5327, + "velocity_flow_t05": 0.512725, + "velocity_flow_t07": 0.5102500000000001, + "velocity_flow_t09": 0.516, + "velocity_flow_t10": 0.5852999999999999, + "velocity_packet": 0.48035, + "velocity_packet_t01": 0.30789999999999995, + "velocity_packet_t03": 0.32542499999999996, + "velocity_packet_t05": 0.39285, + "velocity_packet_t07": 0.4363, + "velocity_packet_t09": 0.45257499999999995, + "velocity_packet_t10": 0.5849500000000001, + "velocity_total": 0.518175, + "velocity_total_t01": 0.41867499999999996, + "velocity_total_t03": 0.449475, + "velocity_total_t05": 0.45715, + "velocity_total_t07": 0.4531, + "velocity_total_t09": 0.5212249999999999, + "velocity_total_t10": 0.638325 + }, + "mirai-greip_flood": { + "_n": 29.0, + "arc_length": 0.8659172413793104, + "causal_surprisal_flow": 0.34962068965517246, + "causal_surprisal_packet_max": 0.5597655172413794, + "causal_surprisal_packet_mean": 0.5983793103448276, + "causal_surprisal_packet_median": 0.670096551724138, + "causal_surprisal_packet_trimmed10_mean": 0.6095724137931035, + "causal_surprisal_total": 0.3241103448275862, + "consistency_total": 0.785448275862069, + "curvature_flow": 0.1020551724137931, + "curvature_packet": 0.7635517241379309, + "curvature_total": 0.2732551724137931, + "direction_drift_flow": 0.2943724137931035, + "direction_drift_packet_max": 0.553951724137931, + "direction_drift_packet_mean": 0.5109724137931033, + "direction_drift_packet_median": 0.4841103448275862, + "direction_drift_packet_trimmed10_mean": 0.5252206896551723, + "direction_drift_total": 0.3788344827586207, + "flow_consistency": 0.7676344827586207, + "jacobian_flow": 0.319151724137931, + "jacobian_packet": 0.6003448275862069, + "jacobian_total": 0.46565517241379306, + "kappa2_speed2norm_packet_mean": 0.4365379310344828, + "kappa2_speed2norm_packet_median": 0.4322551724137931, + "kappa2_speed2norm_packet_trimmed10_mean": 0.44831724137931034, + "kinetic_energy": 0.8599103448275862, + "kinetic_flow": 0.7376689655172414, + "kinetic_packet": 0.8634137931034482, + "packet_consistency": 0.584503448275862, + "pna_flow": 0.12979310344827588, + "pna_packet_max": 0.4915793103448276, + "pna_packet_mean": 0.4365379310344828, + "pna_packet_median": 0.4322551724137931, + "pna_packet_trimmed10_mean": 0.44831724137931034, + "terminal_flow": 0.9256137931034483, + "terminal_norm": 0.952848275862069, + "terminal_packet": 0.877103448275862, + "velocity_flow": 0.736, + "velocity_flow_t01": 0.6966034482758621, + "velocity_flow_t03": 0.6941862068965517, + "velocity_flow_t05": 0.688448275862069, + "velocity_flow_t07": 0.7299310344827586, + "velocity_flow_t09": 0.7866103448275862, + "velocity_flow_t10": 0.7853793103448277, + "velocity_packet": 0.5877724137931034, + "velocity_packet_t01": 0.4350137931034483, + "velocity_packet_t03": 0.45920000000000005, + "velocity_packet_t05": 0.5173793103448276, + "velocity_packet_t07": 0.575903448275862, + "velocity_packet_t09": 0.6307586206896552, + "velocity_packet_t10": 0.7051586206896552, + "velocity_total": 0.7693310344827586, + "velocity_total_t01": 0.5939379310344828, + "velocity_total_t03": 0.6146344827586206, + "velocity_total_t05": 0.6647586206896552, + "velocity_total_t07": 0.7384620689655172, + "velocity_total_t09": 0.8342620689655172, + "velocity_total_t10": 0.8662551724137931 + }, + "mirai-udpplain": { + "_n": 9.0, + "arc_length": 0.7364444444444445, + "causal_surprisal_flow": 0.27593333333333325, + "causal_surprisal_packet_max": 0.6341111111111112, + "causal_surprisal_packet_mean": 0.6524666666666666, + "causal_surprisal_packet_median": 0.805711111111111, + "causal_surprisal_packet_trimmed10_mean": 0.6997777777777777, + "causal_surprisal_total": 0.2578, + "consistency_total": 0.6909555555555555, + "curvature_flow": 0.1829111111111111, + "curvature_packet": 0.7654666666666666, + "curvature_total": 0.2421777777777778, + "direction_drift_flow": 0.2689333333333333, + "direction_drift_packet_max": 0.513, + "direction_drift_packet_mean": 0.47644444444444445, + "direction_drift_packet_median": 0.5061111111111112, + "direction_drift_packet_trimmed10_mean": 0.5140222222222223, + "direction_drift_total": 0.3461777777777778, + "flow_consistency": 0.6161111111111112, + "jacobian_flow": 0.21473333333333333, + "jacobian_packet": 0.6259555555555555, + "jacobian_total": 0.4837111111111111, + "kappa2_speed2norm_packet_mean": 0.4361777777777778, + "kappa2_speed2norm_packet_median": 0.45015555555555553, + "kappa2_speed2norm_packet_trimmed10_mean": 0.45526666666666665, + "kinetic_energy": 0.732488888888889, + "kinetic_flow": 0.6337777777777778, + "kinetic_packet": 0.8232888888888888, + "packet_consistency": 0.6720444444444444, + "pna_flow": 0.19797777777777778, + "pna_packet_max": 0.5297111111111111, + "pna_packet_mean": 0.4361777777777778, + "pna_packet_median": 0.45015555555555553, + "pna_packet_trimmed10_mean": 0.45526666666666665, + "terminal_flow": 0.8069333333333333, + "terminal_norm": 0.8955333333333334, + "terminal_packet": 0.8650666666666667, + "velocity_flow": 0.7347777777777776, + "velocity_flow_t01": 0.7129555555555556, + "velocity_flow_t03": 0.6993555555555555, + "velocity_flow_t05": 0.6989333333333334, + "velocity_flow_t07": 0.7242, + "velocity_flow_t09": 0.7249333333333334, + "velocity_flow_t10": 0.752, + "velocity_packet": 0.6472888888888889, + "velocity_packet_t01": 0.3918, + "velocity_packet_t03": 0.46482222222222225, + "velocity_packet_t05": 0.5862444444444445, + "velocity_packet_t07": 0.6771777777777778, + "velocity_packet_t09": 0.6814888888888888, + "velocity_packet_t10": 0.6498222222222222, + "velocity_total": 0.7409555555555556, + "velocity_total_t01": 0.6632888888888889, + "velocity_total_t03": 0.6945333333333332, + "velocity_total_t05": 0.7002222222222223, + "velocity_total_t07": 0.7510444444444444, + "velocity_total_t09": 0.7701777777777778, + "velocity_total_t10": 0.7810444444444444 + }, + "mitm-arpspoofing": { + "_n": 135.0, + "arc_length": 0.7979437037037036, + "causal_surprisal_flow": 0.34758222222222224, + "causal_surprisal_packet_max": 0.4438503703703704, + "causal_surprisal_packet_mean": 0.43993777777777776, + "causal_surprisal_packet_median": 0.4587940740740741, + "causal_surprisal_packet_trimmed10_mean": 0.4354577777777778, + "causal_surprisal_total": 0.3489288888888889, + "consistency_total": 0.6476577777777777, + "curvature_flow": 0.2692296296296296, + "curvature_packet": 0.6089570370370371, + "curvature_total": 0.34609629629629624, + "direction_drift_flow": 0.40758666666666665, + "direction_drift_packet_max": 0.5129377777777777, + "direction_drift_packet_mean": 0.5148577777777779, + "direction_drift_packet_median": 0.5068414814814814, + "direction_drift_packet_trimmed10_mean": 0.5326118518518518, + "direction_drift_total": 0.4059896296296296, + "flow_consistency": 0.6827718518518517, + "jacobian_flow": 0.4739362962962963, + "jacobian_packet": 0.5958162962962963, + "jacobian_total": 0.5373792592592592, + "kappa2_speed2norm_packet_mean": 0.46262000000000003, + "kappa2_speed2norm_packet_median": 0.4750148148148149, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4836407407407407, + "kinetic_energy": 0.795082962962963, + "kinetic_flow": 0.6762918518518517, + "kinetic_packet": 0.7917348148148148, + "packet_consistency": 0.4972355555555556, + "pna_flow": 0.2872637037037037, + "pna_packet_max": 0.4628103703703703, + "pna_packet_mean": 0.46262000000000003, + "pna_packet_median": 0.4750148148148149, + "pna_packet_trimmed10_mean": 0.4836407407407407, + "terminal_flow": 0.8102118518518518, + "terminal_norm": 0.868285925925926, + "terminal_packet": 0.8149955555555556, + "velocity_flow": 0.6320103703703703, + "velocity_flow_t01": 0.599568888888889, + "velocity_flow_t03": 0.6107370370370371, + "velocity_flow_t05": 0.60792, + "velocity_flow_t07": 0.6414814814814814, + "velocity_flow_t09": 0.6739140740740741, + "velocity_flow_t10": 0.6149614814814814, + "velocity_packet": 0.4771674074074074, + "velocity_packet_t01": 0.42252592592592586, + "velocity_packet_t03": 0.4536296296296296, + "velocity_packet_t05": 0.47480740740740746, + "velocity_packet_t07": 0.4813540740740741, + "velocity_packet_t09": 0.4688444444444445, + "velocity_packet_t10": 0.5084637037037036, + "velocity_total": 0.6541066666666666, + "velocity_total_t01": 0.5437733333333334, + "velocity_total_t03": 0.5627125925925925, + "velocity_total_t05": 0.6054844444444445, + "velocity_total_t07": 0.6665437037037036, + "velocity_total_t09": 0.7296014814814816, + "velocity_total_t10": 0.6884088888888888 + }, + "recon-hostdiscovery": { + "_n": 165.0, + "arc_length": 0.8450799999999998, + "causal_surprisal_flow": 0.4940242424242425, + "causal_surprisal_packet_max": 0.5211042424242424, + "causal_surprisal_packet_mean": 0.6024024242424243, + "causal_surprisal_packet_median": 0.7101236363636363, + "causal_surprisal_packet_trimmed10_mean": 0.6561199999999999, + "causal_surprisal_total": 0.5577369696969696, + "consistency_total": 0.7178569696969698, + "curvature_flow": 0.2067260606060606, + "curvature_packet": 0.7202533333333333, + "curvature_total": 0.2653975757575757, + "direction_drift_flow": 0.4621648484848484, + "direction_drift_packet_max": 0.5532933333333332, + "direction_drift_packet_mean": 0.5773745454545455, + "direction_drift_packet_median": 0.5863418181818182, + "direction_drift_packet_trimmed10_mean": 0.6001321212121212, + "direction_drift_total": 0.4405248484848485, + "flow_consistency": 0.7016121212121211, + "jacobian_flow": 0.5266618181818181, + "jacobian_packet": 0.7619963636363636, + "jacobian_total": 0.6553406060606061, + "kappa2_speed2norm_packet_mean": 0.45237212121212117, + "kappa2_speed2norm_packet_median": 0.47775151515151515, + "kappa2_speed2norm_packet_trimmed10_mean": 0.48336363636363633, + "kinetic_energy": 0.8443684848484848, + "kinetic_flow": 0.6478581818181818, + "kinetic_packet": 0.8554254545454545, + "packet_consistency": 0.57296, + "pna_flow": 0.22820242424242426, + "pna_packet_max": 0.44151393939393935, + "pna_packet_mean": 0.45237212121212117, + "pna_packet_median": 0.47775151515151515, + "pna_packet_trimmed10_mean": 0.48336363636363633, + "terminal_flow": 0.7728436363636364, + "terminal_norm": 0.8690957575757576, + "terminal_packet": 0.8632254545454545, + "velocity_flow": 0.5696957575757575, + "velocity_flow_t01": 0.5070533333333334, + "velocity_flow_t03": 0.5358230303030304, + "velocity_flow_t05": 0.538510303030303, + "velocity_flow_t07": 0.5600763636363637, + "velocity_flow_t09": 0.6780412121212122, + "velocity_flow_t10": 0.653869090909091, + "velocity_packet": 0.54, + "velocity_packet_t01": 0.2663339393939394, + "velocity_packet_t03": 0.3075927272727273, + "velocity_packet_t05": 0.4526521212121212, + "velocity_packet_t07": 0.5359078787878787, + "velocity_packet_t09": 0.5671963636363637, + "velocity_packet_t10": 0.6754109090909091, + "velocity_total": 0.7102412121212122, + "velocity_total_t01": 0.4091321212121212, + "velocity_total_t03": 0.5196569696969697, + "velocity_total_t05": 0.5559696969696969, + "velocity_total_t07": 0.7044981818181818, + "velocity_total_t09": 0.7623115151515151, + "velocity_total_t10": 0.7445539393939394 + }, + "recon-osscan": { + "_n": 368.0, + "arc_length": 0.8591551630434784, + "causal_surprisal_flow": 0.6026744565217391, + "causal_surprisal_packet_max": 0.5816076086956522, + "causal_surprisal_packet_mean": 0.6682483695652174, + "causal_surprisal_packet_median": 0.8082260869565216, + "causal_surprisal_packet_trimmed10_mean": 0.7384027173913044, + "causal_surprisal_total": 0.6543793478260869, + "consistency_total": 0.8130951086956523, + "curvature_flow": 0.0961179347826087, + "curvature_packet": 0.7607730978260868, + "curvature_total": 0.1374877717391304, + "direction_drift_flow": 0.43387663043478253, + "direction_drift_packet_max": 0.5159374999999999, + "direction_drift_packet_mean": 0.498183152173913, + "direction_drift_packet_median": 0.5001277173913043, + "direction_drift_packet_trimmed10_mean": 0.5113790760869565, + "direction_drift_total": 0.3450570652173913, + "flow_consistency": 0.8354239130434783, + "jacobian_flow": 0.5599288043478261, + "jacobian_packet": 0.7950532608695652, + "jacobian_total": 0.7068326086956522, + "kappa2_speed2norm_packet_mean": 0.3811119565217391, + "kappa2_speed2norm_packet_median": 0.40123532608695645, + "kappa2_speed2norm_packet_trimmed10_mean": 0.400021195652174, + "kinetic_energy": 0.8569842391304348, + "kinetic_flow": 0.7170951086956522, + "kinetic_packet": 0.8814804347826086, + "packet_consistency": 0.5867461956521739, + "pna_flow": 0.11700489130434782, + "pna_packet_max": 0.44608532608695656, + "pna_packet_mean": 0.3811119565217391, + "pna_packet_median": 0.40123532608695645, + "pna_packet_trimmed10_mean": 0.400021195652174, + "terminal_flow": 0.8797543478260871, + "terminal_norm": 0.9246097826086958, + "terminal_packet": 0.8976538043478262, + "velocity_flow": 0.5962342391304347, + "velocity_flow_t01": 0.5394554347826087, + "velocity_flow_t03": 0.5400304347826087, + "velocity_flow_t05": 0.5470733695652173, + "velocity_flow_t07": 0.5783989130434782, + "velocity_flow_t09": 0.7655717391304349, + "velocity_flow_t10": 0.7577836956521738, + "velocity_packet": 0.5807907608695653, + "velocity_packet_t01": 0.20847826086956522, + "velocity_packet_t03": 0.25234728260869566, + "velocity_packet_t05": 0.44748152173913036, + "velocity_packet_t07": 0.5738489130434783, + "velocity_packet_t09": 0.6614749999999999, + "velocity_packet_t10": 0.8081695652173914, + "velocity_total": 0.789508695652174, + "velocity_total_t01": 0.35036141304347823, + "velocity_total_t03": 0.5320874999999999, + "velocity_total_t05": 0.5696815217391304, + "velocity_total_t07": 0.7776625, + "velocity_total_t09": 0.8429336956521738, + "velocity_total_t10": 0.8698353260869566 + }, + "recon-pingsweep": { + "_n": 8.0, + "arc_length": 0.8709250000000001, + "causal_surprisal_flow": 0.508675, + "causal_surprisal_packet_max": 0.52815, + "causal_surprisal_packet_mean": 0.514125, + "causal_surprisal_packet_median": 0.65885, + "causal_surprisal_packet_trimmed10_mean": 0.52455, + "causal_surprisal_total": 0.463975, + "consistency_total": 0.803975, + "curvature_flow": 0.13465, + "curvature_packet": 0.7756750000000001, + "curvature_total": 0.2435, + "direction_drift_flow": 0.35735, + "direction_drift_packet_max": 0.5889249999999999, + "direction_drift_packet_mean": 0.53905, + "direction_drift_packet_median": 0.519475, + "direction_drift_packet_trimmed10_mean": 0.546275, + "direction_drift_total": 0.453775, + "flow_consistency": 0.837675, + "jacobian_flow": 0.4592, + "jacobian_packet": 0.5367249999999999, + "jacobian_total": 0.510975, + "kappa2_speed2norm_packet_mean": 0.5249, + "kappa2_speed2norm_packet_median": 0.509925, + "kappa2_speed2norm_packet_trimmed10_mean": 0.526275, + "kinetic_energy": 0.8701, + "kinetic_flow": 0.6260249999999999, + "kinetic_packet": 0.926075, + "packet_consistency": 0.646575, + "pna_flow": 0.167225, + "pna_packet_max": 0.57625, + "pna_packet_mean": 0.5249, + "pna_packet_median": 0.509925, + "pna_packet_trimmed10_mean": 0.526275, + "terminal_flow": 0.899, + "terminal_norm": 0.953475, + "terminal_packet": 0.9493, + "velocity_flow": 0.694875, + "velocity_flow_t01": 0.649, + "velocity_flow_t03": 0.6699249999999999, + "velocity_flow_t05": 0.669575, + "velocity_flow_t07": 0.68555, + "velocity_flow_t09": 0.7434, + "velocity_flow_t10": 0.696025, + "velocity_packet": 0.618425, + "velocity_packet_t01": 0.5450250000000001, + "velocity_packet_t03": 0.573825, + "velocity_packet_t05": 0.604175, + "velocity_packet_t07": 0.6298, + "velocity_packet_t09": 0.638825, + "velocity_packet_t10": 0.560525, + "velocity_total": 0.700175, + "velocity_total_t01": 0.62505, + "velocity_total_t03": 0.6245499999999999, + "velocity_total_t05": 0.622825, + "velocity_total_t07": 0.68975, + "velocity_total_t09": 0.800275, + "velocity_total_t10": 0.75775 + }, + "recon-portscan": { + "_n": 370.0, + "arc_length": 0.8638081081081082, + "causal_surprisal_flow": 0.6196551351351351, + "causal_surprisal_packet_max": 0.5895816216216216, + "causal_surprisal_packet_mean": 0.6737697297297296, + "causal_surprisal_packet_median": 0.8182794594594596, + "causal_surprisal_packet_trimmed10_mean": 0.753414054054054, + "causal_surprisal_total": 0.6911113513513514, + "consistency_total": 0.8230037837837838, + "curvature_flow": 0.0945637837837838, + "curvature_packet": 0.7906345945945946, + "curvature_total": 0.12693513513513513, + "direction_drift_flow": 0.42669378378378386, + "direction_drift_packet_max": 0.5727886486486486, + "direction_drift_packet_mean": 0.546948918918919, + "direction_drift_packet_median": 0.5458035135135135, + "direction_drift_packet_trimmed10_mean": 0.5550954054054054, + "direction_drift_total": 0.3717616216216216, + "flow_consistency": 0.8436032432432433, + "jacobian_flow": 0.5124416216216217, + "jacobian_packet": 0.7925291891891892, + "jacobian_total": 0.6876778378378378, + "kappa2_speed2norm_packet_mean": 0.4161851351351351, + "kappa2_speed2norm_packet_median": 0.434192972972973, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4325778378378379, + "kinetic_energy": 0.8630572972972973, + "kinetic_flow": 0.7451659459459459, + "kinetic_packet": 0.8868664864864866, + "packet_consistency": 0.5973772972972974, + "pna_flow": 0.11315783783783784, + "pna_packet_max": 0.48009189189189194, + "pna_packet_mean": 0.4161851351351351, + "pna_packet_median": 0.434192972972973, + "pna_packet_trimmed10_mean": 0.4325778378378379, + "terminal_flow": 0.8699016216216215, + "terminal_norm": 0.9132854054054055, + "terminal_packet": 0.900967027027027, + "velocity_flow": 0.6053151351351351, + "velocity_flow_t01": 0.5374643243243243, + "velocity_flow_t03": 0.541408108108108, + "velocity_flow_t05": 0.5509556756756757, + "velocity_flow_t07": 0.588652972972973, + "velocity_flow_t09": 0.7812891891891892, + "velocity_flow_t10": 0.760751891891892, + "velocity_packet": 0.5842037837837838, + "velocity_packet_t01": 0.19921513513513517, + "velocity_packet_t03": 0.24163513513513513, + "velocity_packet_t05": 0.448301081081081, + "velocity_packet_t07": 0.5814764864864865, + "velocity_packet_t09": 0.6530594594594594, + "velocity_packet_t10": 0.7953332432432432, + "velocity_total": 0.807022162162162, + "velocity_total_t01": 0.36293864864864867, + "velocity_total_t03": 0.5418256756756756, + "velocity_total_t05": 0.5927508108108108, + "velocity_total_t07": 0.8009372972972972, + "velocity_total_t09": 0.8582010810810812, + "velocity_total_t10": 0.8591686486486487 + }, + "sqlinjection": { + "_n": 11.0, + "arc_length": 0.7198727272727272, + "causal_surprisal_flow": 0.4465454545454546, + "causal_surprisal_packet_max": 0.4957090909090909, + "causal_surprisal_packet_mean": 0.5251818181818182, + "causal_surprisal_packet_median": 0.5257454545454545, + "causal_surprisal_packet_trimmed10_mean": 0.5172, + "causal_surprisal_total": 0.46774545454545446, + "consistency_total": 0.5502181818181818, + "curvature_flow": 0.30421818181818183, + "curvature_packet": 0.6102909090909091, + "curvature_total": 0.41601818181818184, + "direction_drift_flow": 0.4465727272727273, + "direction_drift_packet_max": 0.4804545454545454, + "direction_drift_packet_mean": 0.46941818181818185, + "direction_drift_packet_median": 0.45681818181818185, + "direction_drift_packet_trimmed10_mean": 0.47252727272727263, + "direction_drift_total": 0.4148909090909091, + "flow_consistency": 0.5619090909090909, + "jacobian_flow": 0.48558181818181817, + "jacobian_packet": 0.5658909090909091, + "jacobian_total": 0.5358363636363636, + "kappa2_speed2norm_packet_mean": 0.5371363636363636, + "kappa2_speed2norm_packet_median": 0.5322363636363636, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5413090909090909, + "kinetic_energy": 0.7162727272727273, + "kinetic_flow": 0.577709090909091, + "kinetic_packet": 0.7273454545454545, + "packet_consistency": 0.537290909090909, + "pna_flow": 0.3300727272727273, + "pna_packet_max": 0.5070545454545454, + "pna_packet_mean": 0.5371363636363636, + "pna_packet_median": 0.5322363636363636, + "pna_packet_trimmed10_mean": 0.5413090909090909, + "terminal_flow": 0.7751272727272728, + "terminal_norm": 0.7928909090909091, + "terminal_packet": 0.7386909090909091, + "velocity_flow": 0.6093454545454545, + "velocity_flow_t01": 0.6240181818181818, + "velocity_flow_t03": 0.5646909090909091, + "velocity_flow_t05": 0.5406181818181818, + "velocity_flow_t07": 0.5765272727272728, + "velocity_flow_t09": 0.6520181818181818, + "velocity_flow_t10": 0.5863818181818182, + "velocity_packet": 0.49136363636363634, + "velocity_packet_t01": 0.4672909090909091, + "velocity_packet_t03": 0.4713272727272727, + "velocity_packet_t05": 0.5113272727272727, + "velocity_packet_t07": 0.5101818181818182, + "velocity_packet_t09": 0.48754545454545456, + "velocity_packet_t10": 0.48803636363636366, + "velocity_total": 0.6299636363636364, + "velocity_total_t01": 0.5630181818181819, + "velocity_total_t03": 0.5818181818181818, + "velocity_total_t05": 0.6018363636363636, + "velocity_total_t07": 0.6108363636363636, + "velocity_total_t09": 0.6857818181818183, + "velocity_total_t10": 0.6202909090909091 + }, + "uploading_attack": { + "_n": 3.0, + "arc_length": 0.8632000000000001, + "causal_surprisal_flow": 0.43113333333333326, + "causal_surprisal_packet_max": 0.32886666666666664, + "causal_surprisal_packet_mean": 0.38766666666666666, + "causal_surprisal_packet_median": 0.46940000000000004, + "causal_surprisal_packet_trimmed10_mean": 0.39386666666666664, + "causal_surprisal_total": 0.45186666666666664, + "consistency_total": 0.5888666666666666, + "curvature_flow": 0.07546666666666668, + "curvature_packet": 0.6587333333333334, + "curvature_total": 0.042, + "direction_drift_flow": 0.36979999999999996, + "direction_drift_packet_max": 0.5652666666666666, + "direction_drift_packet_mean": 0.5889333333333333, + "direction_drift_packet_median": 0.4039333333333333, + "direction_drift_packet_trimmed10_mean": 0.45819999999999994, + "direction_drift_total": 0.43539999999999995, + "flow_consistency": 0.4944666666666666, + "jacobian_flow": 0.5833999999999999, + "jacobian_packet": 0.3864666666666667, + "jacobian_total": 0.48660000000000003, + "kappa2_speed2norm_packet_mean": 0.5419999999999999, + "kappa2_speed2norm_packet_median": 0.5762, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4635333333333333, + "kinetic_energy": 0.8519333333333333, + "kinetic_flow": 0.6934, + "kinetic_packet": 0.7994, + "packet_consistency": 0.4948666666666667, + "pna_flow": 0.12813333333333332, + "pna_packet_max": 0.4904666666666666, + "pna_packet_mean": 0.5419999999999999, + "pna_packet_median": 0.5762, + "pna_packet_trimmed10_mean": 0.4635333333333333, + "terminal_flow": 0.9072, + "terminal_norm": 0.9361333333333333, + "terminal_packet": 0.855, + "velocity_flow": 0.6512, + "velocity_flow_t01": 0.6352666666666666, + "velocity_flow_t03": 0.6343333333333333, + "velocity_flow_t05": 0.6350666666666667, + "velocity_flow_t07": 0.6502666666666667, + "velocity_flow_t09": 0.7522666666666666, + "velocity_flow_t10": 0.6868, + "velocity_packet": 0.4774666666666666, + "velocity_packet_t01": 0.34433333333333327, + "velocity_packet_t03": 0.4186666666666667, + "velocity_packet_t05": 0.4514666666666667, + "velocity_packet_t07": 0.47073333333333334, + "velocity_packet_t09": 0.37039999999999995, + "velocity_packet_t10": 0.5122, + "velocity_total": 0.692, + "velocity_total_t01": 0.6436666666666667, + "velocity_total_t03": 0.6473333333333333, + "velocity_total_t05": 0.6465333333333333, + "velocity_total_t07": 0.706, + "velocity_total_t09": 0.8709333333333333, + "velocity_total_t10": 0.8760666666666667 + }, + "vulnerabilityscan": { + "_n": 568.0, + "arc_length": 0.7271991197183099, + "causal_surprisal_flow": 0.5787264084507042, + "causal_surprisal_packet_max": 0.4962299295774648, + "causal_surprisal_packet_mean": 0.5326510563380281, + "causal_surprisal_packet_median": 0.593294366197183, + "causal_surprisal_packet_trimmed10_mean": 0.5682429577464789, + "causal_surprisal_total": 0.6110788732394367, + "consistency_total": 0.6694994718309859, + "curvature_flow": 0.2328475352112676, + "curvature_packet": 0.6445788732394365, + "curvature_total": 0.25800704225352117, + "direction_drift_flow": 0.46088468309859154, + "direction_drift_packet_max": 0.5140514084507042, + "direction_drift_packet_mean": 0.5220380281690141, + "direction_drift_packet_median": 0.5207362676056337, + "direction_drift_packet_trimmed10_mean": 0.531118309859155, + "direction_drift_total": 0.4200045774647887, + "flow_consistency": 0.692249471830986, + "jacobian_flow": 0.5143605633802817, + "jacobian_packet": 0.6641091549295774, + "jacobian_total": 0.5986855633802817, + "kappa2_speed2norm_packet_mean": 0.47213345070422535, + "kappa2_speed2norm_packet_median": 0.4877028169014085, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4871244718309859, + "kinetic_energy": 0.7251531690140846, + "kinetic_flow": 0.6233086267605634, + "kinetic_packet": 0.7299095070422535, + "packet_consistency": 0.5186320422535212, + "pna_flow": 0.25534753521126763, + "pna_packet_max": 0.47019542253521124, + "pna_packet_mean": 0.47213345070422535, + "pna_packet_median": 0.4877028169014085, + "pna_packet_trimmed10_mean": 0.4871244718309859, + "terminal_flow": 0.7689316901408451, + "terminal_norm": 0.7946464788732395, + "terminal_packet": 0.7556422535211267, + "velocity_flow": 0.560193661971831, + "velocity_flow_t01": 0.5250299295774647, + "velocity_flow_t03": 0.5259301056338028, + "velocity_flow_t05": 0.5194651408450703, + "velocity_flow_t07": 0.5388475352112676, + "velocity_flow_t09": 0.6568676056338028, + "velocity_flow_t10": 0.6488204225352112, + "velocity_packet": 0.5194179577464789, + "velocity_packet_t01": 0.3543661971830986, + "velocity_packet_t03": 0.36945528169014086, + "velocity_packet_t05": 0.4568133802816901, + "velocity_packet_t07": 0.5111651408450704, + "velocity_packet_t09": 0.5407323943661972, + "velocity_packet_t10": 0.6175137323943662, + "velocity_total": 0.6520058098591549, + "velocity_total_t01": 0.44778063380281685, + "velocity_total_t03": 0.5269760563380281, + "velocity_total_t05": 0.5409637323943662, + "velocity_total_t07": 0.6397073943661972, + "velocity_total_t09": 0.7185147887323944, + "velocity_total_t10": 0.7203158450704225 + }, + "xss": { + "_n": 10.0, + "arc_length": 0.75456, + "causal_surprisal_flow": 0.31177999999999995, + "causal_surprisal_packet_max": 0.6239800000000001, + "causal_surprisal_packet_mean": 0.59872, + "causal_surprisal_packet_median": 0.6296799999999999, + "causal_surprisal_packet_trimmed10_mean": 0.57246, + "causal_surprisal_total": 0.31086, + "consistency_total": 0.7960400000000001, + "curvature_flow": 0.25998000000000004, + "curvature_packet": 0.7952, + "curvature_total": 0.36558, + "direction_drift_flow": 0.33632, + "direction_drift_packet_max": 0.69256, + "direction_drift_packet_mean": 0.5403, + "direction_drift_packet_median": 0.52458, + "direction_drift_packet_trimmed10_mean": 0.5163399999999999, + "direction_drift_total": 0.5146999999999999, + "flow_consistency": 0.72302, + "jacobian_flow": 0.31, + "jacobian_packet": 0.51166, + "jacobian_total": 0.42940000000000006, + "kappa2_speed2norm_packet_mean": 0.4778, + "kappa2_speed2norm_packet_median": 0.49916, + "kappa2_speed2norm_packet_trimmed10_mean": 0.44601999999999997, + "kinetic_energy": 0.7482, + "kinetic_flow": 0.6347, + "kinetic_packet": 0.8241999999999999, + "packet_consistency": 0.66844, + "pna_flow": 0.21647999999999998, + "pna_packet_max": 0.55136, + "pna_packet_mean": 0.4778, + "pna_packet_median": 0.49916, + "pna_packet_trimmed10_mean": 0.44601999999999997, + "terminal_flow": 0.83596, + "terminal_norm": 0.88114, + "terminal_packet": 0.8125399999999999, + "velocity_flow": 0.72362, + "velocity_flow_t01": 0.6864600000000001, + "velocity_flow_t03": 0.72226, + "velocity_flow_t05": 0.7221000000000001, + "velocity_flow_t07": 0.7236199999999999, + "velocity_flow_t09": 0.76144, + "velocity_flow_t10": 0.7330800000000001, + "velocity_packet": 0.6315200000000001, + "velocity_packet_t01": 0.49616, + "velocity_packet_t03": 0.5308999999999999, + "velocity_packet_t05": 0.56176, + "velocity_packet_t07": 0.57214, + "velocity_packet_t09": 0.6156400000000001, + "velocity_packet_t10": 0.7679400000000001, + "velocity_total": 0.7405400000000001, + "velocity_total_t01": 0.6130800000000001, + "velocity_total_t03": 0.6286, + "velocity_total_t05": 0.65398, + "velocity_total_t07": 0.7254400000000001, + "velocity_total_t09": 0.7683, + "velocity_total_t10": 0.7454400000000001 + } + }, + "classes": [ + "backdoor_malware", + "commandinjection", + "ddos-ack_fragmentation", + "ddos-http_flood", + "ddos-icmp_flood", + "ddos-icmp_fragmentation", + "ddos-pshack_flood", + "ddos-rstfinflood", + "ddos-slowloris", + "ddos-syn_flood", + "ddos-synonymousip_flood", + "ddos-tcp_flood", + "ddos-udp_flood", + "ddos-udp_fragmentation", + "dictionarybruteforce", + "dns_spoofing", + "dos-http_flood", + "dos-syn_flood", + "dos-tcp_flood", + "dos-udp_flood", + "mirai-greeth_flood", + "mirai-greip_flood", + "mirai-udpplain", + "mitm-arpspoofing", + "recon-hostdiscovery", + "recon-osscan", + "recon-pingsweep", + "recon-portscan", + "sqlinjection", + "uploading_attack", + "vulnerabilityscan", + "xss" + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/config.yaml b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/config.yaml new file mode 100644 index 0000000..5e44dd4 --- /dev/null +++ b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/config.yaml @@ -0,0 +1,37 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 43 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features_spectral.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_flow: 0.3 +lambda_packet: 0.3 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packet_mask_ratio: 0.5 +packet_preprocess: mixed_dequant +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43 +seed: 43 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/history.json b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/history.json new file mode 100644 index 0000000..65ffd69 --- /dev/null +++ b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/history.json @@ -0,0 +1,243 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 2.420097366357461, + 2.099719151472434, + 1.8899330573204236, + 1.678099546677027, + 1.5686047780208099, + 1.4404933574872139, + 1.3880487649868696, + 1.312768422640287, + 1.2755417701525567, + 1.2268149027457604, + 1.207103316600506, + 1.1613387450193748, + 1.1535576306856596, + 1.1314835105186853, + 1.1273591686517765, + 1.1026962873263237, + 1.0860350544636066, + 1.0882885456085205, + 1.0673487201715126, + 1.063251365453769, + 1.0518030432554393, + 1.054568900511815, + 1.0507089083011334, + 1.0281198498530266, + 1.024476170539856, + 1.007490303271856, + 1.014441681213868, + 1.0041358333367567, + 1.0105069447786381, + 0.9934646731767899, + 1.0035757621129353, + 0.9917499560576218, + 0.9823301342817453, + 0.9800162238952441, + 0.9890487942940149, + 0.9703579575587542, + 0.9831399397972302, + 0.9878802941395686, + 0.9685455025770725, + 0.9718568584857843, + 0.9678996923642281, + 0.9538876154483893, + 0.9705670842757592, + 0.9643515791648474, + 0.9690514008204142, + 0.9614299031404349, + 0.9625146068059481, + 0.9546614396266448, + 0.9615601255343511, + 0.9599612859579233 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.1767839075, + "auroc_curvature_flow": 0.10785397000000001, + "auroc_curvature_packet": 0.1125783275, + "auroc_curvature_total": 0.090084105, + "auroc_kappa2_speed2norm_packet_mean": 0.0938663375, + "auroc_kappa2_speed2norm_packet_median": 0.10894789, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.09018911999999998, + "auroc_kinetic_energy": 0.1717014925, + "auroc_kinetic_flow": 0.3060199525, + "auroc_kinetic_packet": 0.253954605, + "auroc_terminal_flow": 0.8808985875, + "auroc_terminal_norm": 0.9200642425000001, + "auroc_terminal_packet": 0.7575692825, + "auroc_velocity_flow": 0.3710490475, + "auroc_velocity_packet": 0.34776283250000006, + "auroc_velocity_total": 0.299555205 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.6540440574999999, + "auroc_curvature_flow": 0.0687275525, + "auroc_curvature_packet": 0.11893043, + "auroc_curvature_total": 0.062444205, + "auroc_kappa2_speed2norm_packet_mean": 0.0885076975, + "auroc_kappa2_speed2norm_packet_median": 0.09269525749999999, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.09276963, + "auroc_kinetic_energy": 0.617797855, + "auroc_kinetic_flow": 0.4450228825, + "auroc_kinetic_packet": 0.8254812375, + "auroc_terminal_flow": 0.9071477375000001, + "auroc_terminal_norm": 0.9524636400000001, + "auroc_terminal_packet": 0.9049310649999999, + "auroc_velocity_flow": 0.7503188475, + "auroc_velocity_packet": 0.67039266, + "auroc_velocity_total": 0.8215514475 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9248775499999999, + "auroc_curvature_flow": 0.0668702025, + "auroc_curvature_packet": 0.721705545, + "auroc_curvature_total": 0.22543057249999998, + "auroc_kappa2_speed2norm_packet_mean": 0.34931417750000004, + "auroc_kappa2_speed2norm_packet_median": 0.34517571999999996, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.3384804374999999, + "auroc_kinetic_energy": 0.9206809675000001, + "auroc_kinetic_flow": 0.674009625, + "auroc_kinetic_packet": 0.9374038725, + "auroc_terminal_flow": 0.9144319525000001, + "auroc_terminal_norm": 0.9584738724999999, + "auroc_terminal_packet": 0.9286950275, + "auroc_velocity_flow": 0.7761716175, + "auroc_velocity_packet": 0.835136855, + "auroc_velocity_total": 0.881560915 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9146234575, + "auroc_curvature_flow": 0.0737485, + "auroc_curvature_packet": 0.89272237, + "auroc_curvature_total": 0.47309714999999997, + "auroc_kappa2_speed2norm_packet_mean": 0.34849252500000005, + "auroc_kappa2_speed2norm_packet_median": 0.3461466025, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.3407238925, + "auroc_kinetic_energy": 0.9123160974999999, + "auroc_kinetic_flow": 0.6999767325, + "auroc_kinetic_packet": 0.94467666, + "auroc_terminal_flow": 0.9173187825000001, + "auroc_terminal_norm": 0.9620274324999999, + "auroc_terminal_packet": 0.936559215, + "auroc_velocity_flow": 0.767910795, + "auroc_velocity_packet": 0.824092045, + "auroc_velocity_total": 0.8829339025 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.935000245, + "auroc_curvature_flow": 0.06816626749999999, + "auroc_curvature_packet": 0.9125121125, + "auroc_curvature_total": 0.4945978575, + "auroc_kappa2_speed2norm_packet_mean": 0.41346458999999997, + "auroc_kappa2_speed2norm_packet_median": 0.41549358999999997, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.40581007999999996, + "auroc_kinetic_energy": 0.9334271375000001, + "auroc_kinetic_flow": 0.7740863825, + "auroc_kinetic_packet": 0.9491466300000001, + "auroc_terminal_flow": 0.9172556624999999, + "auroc_terminal_norm": 0.9626460900000001, + "auroc_terminal_packet": 0.94395352, + "auroc_velocity_flow": 0.7709853025, + "auroc_velocity_packet": 0.8222670275, + "auroc_velocity_total": 0.8836839449999999 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/model.pt b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/model.pt new file mode 100644 index 0000000..7c07887 Binary files /dev/null and b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/model.pt differ diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/phase1.log b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/phase1.log new file mode 100644 index 0000000..9c8209a --- /dev/null +++ b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/phase1.log @@ -0,0 +1,132 @@ +[config] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/config.yaml +[model] T=64 flow_dim=52 packet_dim=9 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets_source=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] using external flow features D=52 +[data] rows total=8,193,621 keep len>=2: 3,797,530 +[data] benign=97,045 attack=20,000 -> train=77,636 val=10,000 +[data] train=77,636 val=10,000 attack=20,000 +[eval] scoring val=5,000 and attack=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done in 12.5s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] attack done in 24.0s +[eval] score keys: 57 first 5: ['arc_length', 'causal_surprisal_flow', 'causal_surprisal_packet_max', 'causal_surprisal_packet_mean', 'causal_surprisal_packet_median'] +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/phase1_summary.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/phase1_scores.npz + +=== overall AUROC (sorted desc) === + terminal_norm AUROC=0.9620 AUPRC=0.9818 + kinetic_packet AUROC=0.9478 AUPRC=0.9748 + terminal_packet AUROC=0.9423 AUPRC=0.9709 + arc_length AUROC=0.9398 AUPRC=0.9689 + kinetic_energy AUROC=0.9387 AUPRC=0.9686 + terminal_flow AUROC=0.9197 AUPRC=0.9372 + velocity_total_t10 AUROC=0.9084 AUPRC=0.9332 + velocity_total_t09 AUROC=0.9080 AUPRC=0.9331 + velocity_packet_t10 AUROC=0.8940 AUPRC=0.9490 + velocity_total_t07 AUROC=0.8887 AUPRC=0.9269 + velocity_total AUROC=0.8877 AUPRC=0.9219 + velocity_packet_t09 AUROC=0.8830 AUPRC=0.9340 + curvature_packet AUROC=0.8657 AUPRC=0.8978 + causal_surprisal_packet_median AUROC=0.8585 AUPRC=0.9256 + consistency_total AUROC=0.8531 AUPRC=0.8960 + flow_consistency AUROC=0.8385 AUPRC=0.8861 + packet_consistency AUROC=0.8294 AUPRC=0.8898 + velocity_flow_t09 AUROC=0.8277 AUPRC=0.8349 + velocity_flow_t10 AUROC=0.8268 AUPRC=0.8340 + velocity_packet_t07 AUROC=0.8242 AUPRC=0.9027 + velocity_packet AUROC=0.8233 AUPRC=0.8997 + causal_surprisal_packet_trimmed10_mean AUROC=0.8209 AUPRC=0.8962 + velocity_total_t05 AUROC=0.8173 AUPRC=0.8782 + causal_surprisal_packet_mean AUROC=0.8097 AUPRC=0.8805 + velocity_total_t03 AUROC=0.7853 AUPRC=0.8523 + velocity_flow AUROC=0.7753 AUPRC=0.8145 + velocity_flow_t07 AUROC=0.7720 AUPRC=0.8136 + velocity_flow_t05 AUROC=0.7606 AUPRC=0.8119 + kinetic_flow AUROC=0.7594 AUPRC=0.7989 + velocity_flow_t01 AUROC=0.7551 AUPRC=0.8147 + velocity_flow_t03 AUROC=0.7551 AUPRC=0.8131 + velocity_total_t01 AUROC=0.7435 AUPRC=0.8222 + velocity_packet_t05 AUROC=0.7177 AUPRC=0.8369 + causal_surprisal_packet_max AUROC=0.6998 AUPRC=0.7784 + jacobian_packet AUROC=0.6935 AUPRC=0.8393 + direction_drift_packet_max AUROC=0.6314 AUPRC=0.7499 + velocity_packet_t03 AUROC=0.6132 AUPRC=0.7614 + direction_drift_packet_mean AUROC=0.5587 AUPRC=0.7115 + velocity_packet_t01 AUROC=0.5508 AUPRC=0.7018 + direction_drift_packet_trimmed10_mean AUROC=0.5328 AUPRC=0.7050 + direction_drift_packet_median AUROC=0.5005 AUPRC=0.6786 + jacobian_total AUROC=0.4540 AUPRC=0.6091 + direction_drift_total AUROC=0.3897 AUPRC=0.6166 + pna_packet_max AUROC=0.3160 AUPRC=0.5649 + curvature_total AUROC=0.2834 AUPRC=0.5285 + kappa2_speed2norm_packet_median AUROC=0.2693 AUPRC=0.5364 + pna_packet_median AUROC=0.2693 AUPRC=0.5364 + causal_surprisal_total AUROC=0.2639 AUPRC=0.5273 + kappa2_speed2norm_packet_mean AUROC=0.2624 AUPRC=0.5325 + pna_packet_mean AUROC=0.2624 AUPRC=0.5325 + kappa2_speed2norm_packet_trimmed10_mean AUROC=0.2581 AUPRC=0.5324 + pna_packet_trimmed10_mean AUROC=0.2581 AUPRC=0.5324 + causal_surprisal_flow AUROC=0.2205 AUPRC=0.5143 + direction_drift_flow AUROC=0.2098 AUPRC=0.5005 + jacobian_flow AUROC=0.2003 AUPRC=0.4992 + pna_flow AUROC=0.0729 AUPRC=0.4627 + curvature_flow AUROC=0.0569 AUPRC=0.4589 diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/phase1_scores.npz b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/phase1_scores.npz new file mode 100644 index 0000000..5f89e87 Binary files /dev/null and b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/phase1_summary.json b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/phase1_summary.json new file mode 100644 index 0000000..dc42b46 --- /dev/null +++ b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43/phase1_summary.json @@ -0,0 +1,2292 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43", + "config": { + "T": 64, + "attack_cap": 20000, + "batch_size": 256, + "benign_label": "normal", + "d_model": 128, + "data_seed": 43, + "device": "auto", + "epochs": 50, + "eval_batch_size": 512, + "eval_every": 10, + "eval_n": 20000, + "eval_n_steps": 8, + "flow_features_align": "auto", + "flow_features_path": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features_spectral.parquet", + "flows_parquet": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet", + "grad_clip": 1.0, + "lambda_flow": 0.3, + "lambda_packet": 0.3, + "lr": 0.0003, + "min_len": 2, + "mlp_ratio": 4.0, + "n_heads": 4, + "n_layers": 4, + "n_train": 10000, + "num_workers": 0, + "packet_mask_ratio": 0.5, + "packet_preprocess": "mixed_dequant", + "save_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed43", + "seed": 43, + "sigma": 0.1, + "source_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "time_dim": 64, + "token_dim": null, + "train_ratio": 0.8, + "use_ot": true, + "val_cap": 10000, + "weight_decay": 0.01 + }, + "n_val": 5000, + "n_atk": 10000, + "n_score_keys": 57, + "overall": { + "arc_length": { + "auroc": 0.9397936600000001, + "auprc": 0.9689041018504995 + }, + "causal_surprisal_flow": { + "auroc": 0.22046584999999996, + "auprc": 0.5143167283542294 + }, + "causal_surprisal_packet_max": { + "auroc": 0.6997845, + "auprc": 0.7784217643511377 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.8096736999999999, + "auprc": 0.8804897756884285 + }, + "causal_surprisal_packet_median": { + "auroc": 0.8584647400000001, + "auprc": 0.9256061950348455 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.82094128, + "auprc": 0.8961912036170737 + }, + "causal_surprisal_total": { + "auroc": 0.26389226, + "auprc": 0.5273079982880124 + }, + "consistency_total": { + "auroc": 0.85308443, + "auprc": 0.8960411705473746 + }, + "curvature_flow": { + "auroc": 0.05694918, + "auprc": 0.4588995170467729 + }, + "curvature_packet": { + "auroc": 0.86566096, + "auprc": 0.8978357729806737 + }, + "curvature_total": { + "auroc": 0.28341868000000003, + "auprc": 0.528467873168857 + }, + "direction_drift_flow": { + "auroc": 0.20983836, + "auprc": 0.5004970132850886 + }, + "direction_drift_packet_max": { + "auroc": 0.63142342, + "auprc": 0.7499042144063823 + }, + "direction_drift_packet_mean": { + "auroc": 0.55866986, + "auprc": 0.7115134020221863 + }, + "direction_drift_packet_median": { + "auroc": 0.5004805999999999, + "auprc": 0.6786372560336318 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.5327512300000001, + "auprc": 0.704979516874845 + }, + "direction_drift_total": { + "auroc": 0.38971966999999996, + "auprc": 0.6165572699237423 + }, + "flow_consistency": { + "auroc": 0.83850609, + "auprc": 0.8860615141573798 + }, + "jacobian_flow": { + "auroc": 0.20032619000000002, + "auprc": 0.4992122912161319 + }, + "jacobian_packet": { + "auroc": 0.6935496000000001, + "auprc": 0.8393145413359775 + }, + "jacobian_total": { + "auroc": 0.45402959000000004, + "auprc": 0.6091259791802277 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.26238896, + "auprc": 0.5325457660124411 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.26934950999999996, + "auprc": 0.5364370554279746 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.25805465, + "auprc": 0.5324464554913777 + }, + "kinetic_energy": { + "auroc": 0.93873433, + "auprc": 0.9685682376234201 + }, + "kinetic_flow": { + "auroc": 0.75943047, + "auprc": 0.7988609574890966 + }, + "kinetic_packet": { + "auroc": 0.9477674600000001, + "auprc": 0.9748080649346438 + }, + "packet_consistency": { + "auroc": 0.82940288, + "auprc": 0.8897857800437475 + }, + "pna_flow": { + "auroc": 0.07292232, + "auprc": 0.4627352743646326 + }, + "pna_packet_max": { + "auroc": 0.31600938, + "auprc": 0.5648914159653501 + }, + "pna_packet_mean": { + "auroc": 0.26238896, + "auprc": 0.5325457660124411 + }, + "pna_packet_median": { + "auroc": 0.26934950999999996, + "auprc": 0.5364370554279746 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.25805465, + "auprc": 0.5324464554913777 + }, + "terminal_flow": { + "auroc": 0.9197095200000001, + "auprc": 0.9372422449151621 + }, + "terminal_norm": { + "auroc": 0.9619845499999999, + "auprc": 0.981829472106117 + }, + "terminal_packet": { + "auroc": 0.9422720399999999, + "auprc": 0.9708529742330534 + }, + "velocity_flow": { + "auroc": 0.7753065299999999, + "auprc": 0.8145061528119089 + }, + "velocity_flow_t01": { + "auroc": 0.75514665, + "auprc": 0.8147279810733178 + }, + "velocity_flow_t03": { + "auroc": 0.75508672, + "auprc": 0.8130956125358546 + }, + "velocity_flow_t05": { + "auroc": 0.7605859999999999, + "auprc": 0.8119477560674185 + }, + "velocity_flow_t07": { + "auroc": 0.77202233, + "auprc": 0.8136484839023135 + }, + "velocity_flow_t09": { + "auroc": 0.82769602, + "auprc": 0.8348991339937144 + }, + "velocity_flow_t10": { + "auroc": 0.8268142599999999, + "auprc": 0.8340341359708507 + }, + "velocity_packet": { + "auroc": 0.82330258, + "auprc": 0.8996906291830016 + }, + "velocity_packet_t01": { + "auroc": 0.5507738600000001, + "auprc": 0.7018238717419718 + }, + "velocity_packet_t03": { + "auroc": 0.61320944, + "auprc": 0.7614312050038224 + }, + "velocity_packet_t05": { + "auroc": 0.71765152, + "auprc": 0.836900509312642 + }, + "velocity_packet_t07": { + "auroc": 0.82419581, + "auprc": 0.9026943352094168 + }, + "velocity_packet_t09": { + "auroc": 0.88295822, + "auprc": 0.9339594704622671 + }, + "velocity_packet_t10": { + "auroc": 0.8940117699999999, + "auprc": 0.948983252849582 + }, + "velocity_total": { + "auroc": 0.8877390599999999, + "auprc": 0.9218931284999765 + }, + "velocity_total_t01": { + "auroc": 0.74354776, + "auprc": 0.8222082393347552 + }, + "velocity_total_t03": { + "auroc": 0.7852973999999999, + "auprc": 0.8522523492784158 + }, + "velocity_total_t05": { + "auroc": 0.81732221, + "auprc": 0.8782448528560882 + }, + "velocity_total_t07": { + "auroc": 0.88867758, + "auprc": 0.9269370706003071 + }, + "velocity_total_t09": { + "auroc": 0.9079726899999999, + "auprc": 0.9331006440898137 + }, + "velocity_total_t10": { + "auroc": 0.9084153699999999, + "auprc": 0.9332288096641448 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 9.0, + "arc_length": 0.8301111111111112, + "causal_surprisal_flow": 0.1884222222222222, + "causal_surprisal_packet_max": 0.6068, + "causal_surprisal_packet_mean": 0.5754, + "causal_surprisal_packet_median": 0.7364, + "causal_surprisal_packet_trimmed10_mean": 0.6013777777777778, + "causal_surprisal_total": 0.20413333333333333, + "consistency_total": 0.7192444444444445, + "curvature_flow": 0.1182444444444444, + "curvature_packet": 0.7045111111111111, + "curvature_total": 0.27508888888888894, + "direction_drift_flow": 0.3121666666666667, + "direction_drift_packet_max": 0.6157555555555555, + "direction_drift_packet_mean": 0.5967777777777779, + "direction_drift_packet_median": 0.5735333333333333, + "direction_drift_packet_trimmed10_mean": 0.6039777777777777, + "direction_drift_total": 0.5105111111111111, + "flow_consistency": 0.757688888888889, + "jacobian_flow": 0.3092, + "jacobian_packet": 0.5412888888888889, + "jacobian_total": 0.4085777777777778, + "kappa2_speed2norm_packet_mean": 0.5216666666666666, + "kappa2_speed2norm_packet_median": 0.5158888888888888, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5206888888888889, + "kinetic_energy": 0.8259777777777777, + "kinetic_flow": 0.6873777777777778, + "kinetic_packet": 0.8518222222222223, + "packet_consistency": 0.5217777777777777, + "pna_flow": 0.15028888888888886, + "pna_packet_max": 0.6289555555555555, + "pna_packet_mean": 0.5216666666666666, + "pna_packet_median": 0.5158888888888888, + "pna_packet_trimmed10_mean": 0.5206888888888889, + "terminal_flow": 0.9044444444444444, + "terminal_norm": 0.9135111111111112, + "terminal_packet": 0.8516666666666666, + "velocity_flow": 0.7029555555555556, + "velocity_flow_t01": 0.6851555555555556, + "velocity_flow_t03": 0.6853555555555556, + "velocity_flow_t05": 0.6967111111111111, + "velocity_flow_t07": 0.6979333333333333, + "velocity_flow_t09": 0.7467333333333334, + "velocity_flow_t10": 0.7514000000000001, + "velocity_packet": 0.5646666666666667, + "velocity_packet_t01": 0.47826666666666673, + "velocity_packet_t03": 0.5074222222222222, + "velocity_packet_t05": 0.5504222222222221, + "velocity_packet_t07": 0.5397777777777778, + "velocity_packet_t09": 0.5349333333333334, + "velocity_packet_t10": 0.5546444444444445, + "velocity_total": 0.721288888888889, + "velocity_total_t01": 0.6139777777777777, + "velocity_total_t03": 0.6192222222222222, + "velocity_total_t05": 0.6433777777777777, + "velocity_total_t07": 0.7119111111111112, + "velocity_total_t09": 0.7468, + "velocity_total_t10": 0.7471111111111111 + }, + "browserhijacking": { + "_n": 3.0, + "arc_length": 0.8960666666666668, + "causal_surprisal_flow": 0.2778666666666666, + "causal_surprisal_packet_max": 0.6524666666666668, + "causal_surprisal_packet_mean": 0.5823333333333334, + "causal_surprisal_packet_median": 0.45253333333333334, + "causal_surprisal_packet_trimmed10_mean": 0.5108, + "causal_surprisal_total": 0.2886666666666666, + "consistency_total": 0.7525333333333333, + "curvature_flow": 0.2431333333333333, + "curvature_packet": 0.8544666666666666, + "curvature_total": 0.4802666666666666, + "direction_drift_flow": 0.3353333333333333, + "direction_drift_packet_max": 0.5531333333333334, + "direction_drift_packet_mean": 0.42213333333333336, + "direction_drift_packet_median": 0.3899333333333333, + "direction_drift_packet_trimmed10_mean": 0.3698666666666666, + "direction_drift_total": 0.34006666666666663, + "flow_consistency": 0.7969333333333333, + "jacobian_flow": 0.46546666666666664, + "jacobian_packet": 0.6043999999999998, + "jacobian_total": 0.5037333333333333, + "kappa2_speed2norm_packet_mean": 0.401, + "kappa2_speed2norm_packet_median": 0.3736, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3788666666666667, + "kinetic_energy": 0.8948666666666666, + "kinetic_flow": 0.6466666666666666, + "kinetic_packet": 0.9157333333333333, + "packet_consistency": 0.6420666666666667, + "pna_flow": 0.26966666666666667, + "pna_packet_max": 0.5581333333333334, + "pna_packet_mean": 0.401, + "pna_packet_median": 0.3736, + "pna_packet_trimmed10_mean": 0.3788666666666667, + "terminal_flow": 0.8022, + "terminal_norm": 0.9184666666666667, + "terminal_packet": 0.8864666666666666, + "velocity_flow": 0.6556666666666666, + "velocity_flow_t01": 0.6289333333333333, + "velocity_flow_t03": 0.6360666666666666, + "velocity_flow_t05": 0.6561999999999999, + "velocity_flow_t07": 0.6608666666666667, + "velocity_flow_t09": 0.7358, + "velocity_flow_t10": 0.6176666666666666, + "velocity_packet": 0.6204666666666666, + "velocity_packet_t01": 0.6723333333333333, + "velocity_packet_t03": 0.6719333333333334, + "velocity_packet_t05": 0.6558666666666667, + "velocity_packet_t07": 0.6345333333333333, + "velocity_packet_t09": 0.6412, + "velocity_packet_t10": 0.6959333333333333, + "velocity_total": 0.7302, + "velocity_total_t01": 0.6327333333333334, + "velocity_total_t03": 0.6404, + "velocity_total_t05": 0.6452666666666667, + "velocity_total_t07": 0.7440666666666667, + "velocity_total_t09": 0.7357333333333332, + "velocity_total_t10": 0.6257999999999999 + }, + "commandinjection": { + "_n": 13.0, + "arc_length": 0.7840615384615385, + "causal_surprisal_flow": 0.20729230769230772, + "causal_surprisal_packet_max": 0.6994153846153847, + "causal_surprisal_packet_mean": 0.6788923076923077, + "causal_surprisal_packet_median": 0.7436461538461538, + "causal_surprisal_packet_trimmed10_mean": 0.6887076923076924, + "causal_surprisal_total": 0.20673846153846154, + "consistency_total": 0.7579230769230769, + "curvature_flow": 0.12944615384615385, + "curvature_packet": 0.7374615384615385, + "curvature_total": 0.3105692307692308, + "direction_drift_flow": 0.17184615384615384, + "direction_drift_packet_max": 0.6967384615384615, + "direction_drift_packet_mean": 0.5230153846153847, + "direction_drift_packet_median": 0.5571538461538461, + "direction_drift_packet_trimmed10_mean": 0.4977230769230769, + "direction_drift_total": 0.4736307692307692, + "flow_consistency": 0.7347692307692308, + "jacobian_flow": 0.19729230769230768, + "jacobian_packet": 0.37020000000000003, + "jacobian_total": 0.2720923076923077, + "kappa2_speed2norm_packet_mean": 0.37021538461538467, + "kappa2_speed2norm_packet_median": 0.36030769230769233, + "kappa2_speed2norm_packet_trimmed10_mean": 0.34466153846153846, + "kinetic_energy": 0.7802153846153846, + "kinetic_flow": 0.8431692307692308, + "kinetic_packet": 0.812923076923077, + "packet_consistency": 0.8046923076923077, + "pna_flow": 0.1423076923076923, + "pna_packet_max": 0.5120769230769231, + "pna_packet_mean": 0.37021538461538467, + "pna_packet_median": 0.36030769230769233, + "pna_packet_trimmed10_mean": 0.34466153846153846, + "terminal_flow": 0.8751076923076924, + "terminal_norm": 0.8780615384615384, + "terminal_packet": 0.7946307692307693, + "velocity_flow": 0.8274153846153847, + "velocity_flow_t01": 0.8246615384615384, + "velocity_flow_t03": 0.826123076923077, + "velocity_flow_t05": 0.8270461538461539, + "velocity_flow_t07": 0.8288615384615385, + "velocity_flow_t09": 0.825876923076923, + "velocity_flow_t10": 0.7983076923076924, + "velocity_packet": 0.7411384615384616, + "velocity_packet_t01": 0.6242461538461539, + "velocity_packet_t03": 0.6542615384615384, + "velocity_packet_t05": 0.7044615384615385, + "velocity_packet_t07": 0.7090307692307692, + "velocity_packet_t09": 0.6507230769230768, + "velocity_packet_t10": 0.7642, + "velocity_total": 0.8178769230769232, + "velocity_total_t01": 0.7673692307692308, + "velocity_total_t03": 0.7747846153846154, + "velocity_total_t05": 0.7894923076923077, + "velocity_total_t07": 0.8033076923076924, + "velocity_total_t09": 0.7920307692307692, + "velocity_total_t10": 0.8052615384615385 + }, + "ddos-ack_fragmentation": { + "_n": 316.0, + "arc_length": 0.9839082278481012, + "causal_surprisal_flow": 0.07055253164556963, + "causal_surprisal_packet_max": 0.5215240506329114, + "causal_surprisal_packet_mean": 0.5384335443037974, + "causal_surprisal_packet_median": 0.783053164556962, + "causal_surprisal_packet_trimmed10_mean": 0.5696645569620253, + "causal_surprisal_total": 0.11261708860759494, + "consistency_total": 0.9291253164556962, + "curvature_flow": 0.016286708860759502, + "curvature_packet": 0.9032683544303797, + "curvature_total": 0.1257132911392405, + "direction_drift_flow": 0.14719177215189874, + "direction_drift_packet_max": 0.40585126582278486, + "direction_drift_packet_mean": 0.4128237341772152, + "direction_drift_packet_median": 0.42710886075949367, + "direction_drift_packet_trimmed10_mean": 0.4308212025316456, + "direction_drift_total": 0.08705822784810127, + "flow_consistency": 0.834676582278481, + "jacobian_flow": 0.11644367088607595, + "jacobian_packet": 0.8054341772151898, + "jacobian_total": 0.38764936708860753, + "kappa2_speed2norm_packet_mean": 0.05524556962025317, + "kappa2_speed2norm_packet_median": 0.05601265822784811, + "kappa2_speed2norm_packet_trimmed10_mean": 0.053525316455696206, + "kinetic_energy": 0.9833683544303798, + "kinetic_flow": 0.745426582278481, + "kinetic_packet": 0.9862886075949369, + "packet_consistency": 0.9820341772151899, + "pna_flow": 0.04753417721518987, + "pna_packet_max": 0.08982594936708863, + "pna_packet_mean": 0.05524556962025317, + "pna_packet_median": 0.05601265822784811, + "pna_packet_trimmed10_mean": 0.053525316455696206, + "terminal_flow": 0.9673341772151898, + "terminal_norm": 0.9924582278481012, + "terminal_packet": 0.9866867088607594, + "velocity_flow": 0.8504240506329115, + "velocity_flow_t01": 0.8773822784810127, + "velocity_flow_t03": 0.8678879746835443, + "velocity_flow_t05": 0.864143670886076, + "velocity_flow_t07": 0.8511924050632912, + "velocity_flow_t09": 0.8442734177215189, + "velocity_flow_t10": 0.8434819620253164, + "velocity_packet": 0.9778677215189872, + "velocity_packet_t01": 0.8377575949367088, + "velocity_packet_t03": 0.9462177215189874, + "velocity_packet_t05": 0.9666544303797469, + "velocity_packet_t07": 0.9782091772151899, + "velocity_packet_t09": 0.9726379746835444, + "velocity_packet_t10": 0.9843240506329114, + "velocity_total": 0.9873930379746835, + "velocity_total_t01": 0.9805499999999999, + "velocity_total_t03": 0.983136075949367, + "velocity_total_t05": 0.9844886075949367, + "velocity_total_t07": 0.9867386075949367, + "velocity_total_t09": 0.9843867088607595, + "velocity_total_t10": 0.9857386075949367 + }, + "ddos-http_flood": { + "_n": 915.0, + "arc_length": 0.9394218579234973, + "causal_surprisal_flow": 0.4184008743169399, + "causal_surprisal_packet_max": 0.7028456830601093, + "causal_surprisal_packet_mean": 0.8445178142076502, + "causal_surprisal_packet_median": 0.9342340983606557, + "causal_surprisal_packet_trimmed10_mean": 0.8945007650273225, + "causal_surprisal_total": 0.43968142076502736, + "consistency_total": 0.9146607650273224, + "curvature_flow": 0.03295912568306011, + "curvature_packet": 0.9314246994535519, + "curvature_total": 0.3271018579234973, + "direction_drift_flow": 0.26492808743169405, + "direction_drift_packet_max": 0.6292442622950819, + "direction_drift_packet_mean": 0.6316926775956285, + "direction_drift_packet_median": 0.6234979234972677, + "direction_drift_packet_trimmed10_mean": 0.6317147540983605, + "direction_drift_total": 0.42320054644808747, + "flow_consistency": 0.8774192349726776, + "jacobian_flow": 0.2809237158469945, + "jacobian_packet": 0.7596259016393442, + "jacobian_total": 0.5509022950819672, + "kappa2_speed2norm_packet_mean": 0.40029245901639343, + "kappa2_speed2norm_packet_median": 0.4205309289617486, + "kappa2_speed2norm_packet_trimmed10_mean": 0.40538983606557377, + "kinetic_energy": 0.9371368306010929, + "kinetic_flow": 0.6943262295081966, + "kinetic_packet": 0.9556558469945355, + "packet_consistency": 0.9185962841530054, + "pna_flow": 0.04136830601092897, + "pna_packet_max": 0.41785999999999995, + "pna_packet_mean": 0.40029245901639343, + "pna_packet_median": 0.4205309289617486, + "pna_packet_trimmed10_mean": 0.40538983606557377, + "terminal_flow": 0.9283680874316939, + "terminal_norm": 0.9847851366120218, + "terminal_packet": 0.9612150819672131, + "velocity_flow": 0.719742732240437, + "velocity_flow_t01": 0.6757543169398907, + "velocity_flow_t03": 0.6842485245901638, + "velocity_flow_t05": 0.7009162841530053, + "velocity_flow_t07": 0.7154498360655738, + "velocity_flow_t09": 0.8439556284153006, + "velocity_flow_t10": 0.8492133333333334, + "velocity_packet": 0.813707650273224, + "velocity_packet_t01": 0.5390767213114753, + "velocity_packet_t03": 0.5970819672131148, + "velocity_packet_t05": 0.6992644808743169, + "velocity_packet_t07": 0.8462037158469946, + "velocity_packet_t09": 0.9155079781420764, + "velocity_packet_t10": 0.8864933333333334, + "velocity_total": 0.897431912568306, + "velocity_total_t01": 0.6785968306010928, + "velocity_total_t03": 0.7186981420765026, + "velocity_total_t05": 0.7760030601092895, + "velocity_total_t07": 0.8973228415300547, + "velocity_total_t09": 0.9312295081967212, + "velocity_total_t10": 0.9218561748633881 + }, + "ddos-icmp_flood": { + "_n": 20.0, + "arc_length": 0.74235, + "causal_surprisal_flow": 0.39866, + "causal_surprisal_packet_max": 0.5364800000000001, + "causal_surprisal_packet_mean": 0.5666800000000001, + "causal_surprisal_packet_median": 0.60128, + "causal_surprisal_packet_trimmed10_mean": 0.58846, + "causal_surprisal_total": 0.44394000000000006, + "consistency_total": 0.52983, + "curvature_flow": 0.34944, + "curvature_packet": 0.60525, + "curvature_total": 0.45014, + "direction_drift_flow": 0.42169999999999996, + "direction_drift_packet_max": 0.53088, + "direction_drift_packet_mean": 0.51321, + "direction_drift_packet_median": 0.5295500000000001, + "direction_drift_packet_trimmed10_mean": 0.52163, + "direction_drift_total": 0.44204, + "flow_consistency": 0.52212, + "jacobian_flow": 0.44465000000000005, + "jacobian_packet": 0.57839, + "jacobian_total": 0.5058199999999999, + "kappa2_speed2norm_packet_mean": 0.46952, + "kappa2_speed2norm_packet_median": 0.49463, + "kappa2_speed2norm_packet_trimmed10_mean": 0.49190999999999996, + "kinetic_energy": 0.74275, + "kinetic_flow": 0.6233099999999999, + "kinetic_packet": 0.7225199999999999, + "packet_consistency": 0.54564, + "pna_flow": 0.40305, + "pna_packet_max": 0.49132, + "pna_packet_mean": 0.46952, + "pna_packet_median": 0.49463, + "pna_packet_trimmed10_mean": 0.49190999999999996, + "terminal_flow": 0.69546, + "terminal_norm": 0.7373200000000001, + "terminal_packet": 0.71923, + "velocity_flow": 0.5484, + "velocity_flow_t01": 0.57422, + "velocity_flow_t03": 0.5635, + "velocity_flow_t05": 0.5606800000000001, + "velocity_flow_t07": 0.5711200000000001, + "velocity_flow_t09": 0.58108, + "velocity_flow_t10": 0.48421000000000003, + "velocity_packet": 0.50318, + "velocity_packet_t01": 0.40937999999999997, + "velocity_packet_t03": 0.44703999999999994, + "velocity_packet_t05": 0.49939, + "velocity_packet_t07": 0.53703, + "velocity_packet_t09": 0.5406799999999999, + "velocity_packet_t10": 0.54533, + "velocity_total": 0.58858, + "velocity_total_t01": 0.56949, + "velocity_total_t03": 0.59507, + "velocity_total_t05": 0.60233, + "velocity_total_t07": 0.62332, + "velocity_total_t09": 0.5947299999999999, + "velocity_total_t10": 0.5168799999999999 + }, + "ddos-icmp_fragmentation": { + "_n": 38.0, + "arc_length": 0.7910868421052631, + "causal_surprisal_flow": 0.20695263157894733, + "causal_surprisal_packet_max": 0.4850315789473685, + "causal_surprisal_packet_mean": 0.48639473684210527, + "causal_surprisal_packet_median": 0.5122210526315789, + "causal_surprisal_packet_trimmed10_mean": 0.4896631578947368, + "causal_surprisal_total": 0.22175263157894737, + "consistency_total": 0.6072052631578948, + "curvature_flow": 0.2548578947368421, + "curvature_packet": 0.6630526315789474, + "curvature_total": 0.4307736842105263, + "direction_drift_flow": 0.3637, + "direction_drift_packet_max": 0.47246842105263165, + "direction_drift_packet_mean": 0.5030710526315789, + "direction_drift_packet_median": 0.5143421052631579, + "direction_drift_packet_trimmed10_mean": 0.5115973684210526, + "direction_drift_total": 0.3838263157894737, + "flow_consistency": 0.6282947368421052, + "jacobian_flow": 0.40129473684210526, + "jacobian_packet": 0.5330947368421053, + "jacobian_total": 0.45957894736842103, + "kappa2_speed2norm_packet_mean": 0.49052631578947364, + "kappa2_speed2norm_packet_median": 0.5046052631578948, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4915210526315789, + "kinetic_energy": 0.787878947368421, + "kinetic_flow": 0.6756368421052632, + "kinetic_packet": 0.7651052631578947, + "packet_consistency": 0.4852526315789474, + "pna_flow": 0.302578947368421, + "pna_packet_max": 0.48319999999999996, + "pna_packet_mean": 0.49052631578947364, + "pna_packet_median": 0.5046052631578948, + "pna_packet_trimmed10_mean": 0.4915210526315789, + "terminal_flow": 0.7770105263157896, + "terminal_norm": 0.8101947368421052, + "terminal_packet": 0.7643684210526316, + "velocity_flow": 0.6176684210526315, + "velocity_flow_t01": 0.6185578947368421, + "velocity_flow_t03": 0.6143526315789474, + "velocity_flow_t05": 0.6158210526315789, + "velocity_flow_t07": 0.6278105263157894, + "velocity_flow_t09": 0.6748526315789474, + "velocity_flow_t10": 0.6179631578947369, + "velocity_packet": 0.5074894736842105, + "velocity_packet_t01": 0.41422105263157893, + "velocity_packet_t03": 0.4450736842105263, + "velocity_packet_t05": 0.47635263157894736, + "velocity_packet_t07": 0.49691052631578947, + "velocity_packet_t09": 0.5255421052631579, + "velocity_packet_t10": 0.5210736842105264, + "velocity_total": 0.6835315789473684, + "velocity_total_t01": 0.5501263157894738, + "velocity_total_t03": 0.5982578947368421, + "velocity_total_t05": 0.6307263157894736, + "velocity_total_t07": 0.7036315789473684, + "velocity_total_t09": 0.7293263157894737, + "velocity_total_t10": 0.6925526315789474 + }, + "ddos-pshack_flood": { + "_n": 1046.0, + "arc_length": 0.9955107074569791, + "causal_surprisal_flow": 0.03527265774378586, + "causal_surprisal_packet_max": 0.747091395793499, + "causal_surprisal_packet_mean": 0.9086309751434035, + "causal_surprisal_packet_median": 0.9686229445506693, + "causal_surprisal_packet_trimmed10_mean": 0.9293493307839388, + "causal_surprisal_total": 0.11408776290630976, + "consistency_total": 0.8443942638623327, + "curvature_flow": 0.0121564053537285, + "curvature_packet": 0.8965038240917782, + "curvature_total": 0.23123422562141493, + "direction_drift_flow": 0.11371070745697896, + "direction_drift_packet_max": 0.529406118546845, + "direction_drift_packet_mean": 0.33773824091778204, + "direction_drift_packet_median": 0.2442411089866157, + "direction_drift_packet_trimmed10_mean": 0.2617774378585086, + "direction_drift_total": 0.11798432122370936, + "flow_consistency": 0.805697705544933, + "jacobian_flow": 0.08392925430210325, + "jacobian_packet": 0.8010460803059274, + "jacobian_total": 0.46073671128107074, + "kappa2_speed2norm_packet_mean": 0.08586673040152963, + "kappa2_speed2norm_packet_median": 0.08088040152963671, + "kappa2_speed2norm_packet_trimmed10_mean": 0.08072581261950286, + "kinetic_energy": 0.9956065009560229, + "kinetic_flow": 0.8365185468451242, + "kinetic_packet": 0.9972061185468452, + "packet_consistency": 0.9210237093690248, + "pna_flow": 0.025571319311663482, + "pna_packet_max": 0.15314435946462715, + "pna_packet_mean": 0.08586673040152963, + "pna_packet_median": 0.08088040152963671, + "pna_packet_trimmed10_mean": 0.08072581261950286, + "terminal_flow": 0.9445483747609943, + "terminal_norm": 0.9967933078393881, + "terminal_packet": 0.9908493307839389, + "velocity_flow": 0.8568801147227533, + "velocity_flow_t01": 0.8567196940726578, + "velocity_flow_t03": 0.854191395793499, + "velocity_flow_t05": 0.8489571701720842, + "velocity_flow_t07": 0.8515315487571703, + "velocity_flow_t09": 0.8652789674952199, + "velocity_flow_t10": 0.864885277246654, + "velocity_packet": 0.9481344168260037, + "velocity_packet_t01": 0.6376751434034417, + "velocity_packet_t03": 0.7436674952198854, + "velocity_packet_t05": 0.8774768642447419, + "velocity_packet_t07": 0.9560608030592734, + "velocity_packet_t09": 0.9702713193116635, + "velocity_packet_t10": 0.9842240917782027, + "velocity_total": 0.9590602294455066, + "velocity_total_t01": 0.8706801147227533, + "velocity_total_t03": 0.9154474187380496, + "velocity_total_t05": 0.9348655831739963, + "velocity_total_t07": 0.9620115678776292, + "velocity_total_t09": 0.9640481835564053, + "velocity_total_t10": 0.9680120458891014 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "arc_length": 0.7579, + "causal_surprisal_flow": 0.17769999999999997, + "causal_surprisal_packet_max": 0.4687, + "causal_surprisal_packet_mean": 0.4755, + "causal_surprisal_packet_median": 0.6131, + "causal_surprisal_packet_trimmed10_mean": 0.4787, + "causal_surprisal_total": 0.21660000000000001, + "consistency_total": 0.40369999999999995, + "curvature_flow": 0.3735, + "curvature_packet": 0.4878, + "curvature_total": 0.5625, + "direction_drift_flow": 0.6311, + "direction_drift_packet_max": 0.3045, + "direction_drift_packet_mean": 0.3478, + "direction_drift_packet_median": 0.3649, + "direction_drift_packet_trimmed10_mean": 0.3627, + "direction_drift_total": 0.3094, + "flow_consistency": 0.47439999999999993, + "jacobian_flow": 0.7718, + "jacobian_packet": 0.7041000000000001, + "jacobian_total": 0.7521000000000001, + "kappa2_speed2norm_packet_mean": 0.5422, + "kappa2_speed2norm_packet_median": 0.5608, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5772, + "kinetic_energy": 0.7552000000000001, + "kinetic_flow": 0.5631, + "kinetic_packet": 0.6, + "packet_consistency": 0.33730000000000004, + "pna_flow": 0.5112, + "pna_packet_max": 0.28990000000000005, + "pna_packet_mean": 0.5422, + "pna_packet_median": 0.5608, + "pna_packet_trimmed10_mean": 0.5772, + "terminal_flow": 0.8056, + "terminal_norm": 0.7888999999999999, + "terminal_packet": 0.6555, + "velocity_flow": 0.445, + "velocity_flow_t01": 0.4048, + "velocity_flow_t03": 0.40549999999999997, + "velocity_flow_t05": 0.39730000000000004, + "velocity_flow_t07": 0.3956, + "velocity_flow_t09": 0.4302, + "velocity_flow_t10": 0.4996, + "velocity_packet": 0.3556, + "velocity_packet_t01": 0.30750000000000005, + "velocity_packet_t03": 0.3773, + "velocity_packet_t05": 0.42679999999999996, + "velocity_packet_t07": 0.4325, + "velocity_packet_t09": 0.3405, + "velocity_packet_t10": 0.2051, + "velocity_total": 0.4425, + "velocity_total_t01": 0.3897, + "velocity_total_t03": 0.40040000000000003, + "velocity_total_t05": 0.4037, + "velocity_total_t07": 0.41009999999999996, + "velocity_total_t09": 0.4766, + "velocity_total_t10": 0.5146 + }, + "ddos-slowloris": { + "_n": 314.0, + "arc_length": 0.813584076433121, + "causal_surprisal_flow": 0.5058152866242038, + "causal_surprisal_packet_max": 0.7861191082802549, + "causal_surprisal_packet_mean": 0.7805617834394906, + "causal_surprisal_packet_median": 0.7695605095541401, + "causal_surprisal_packet_trimmed10_mean": 0.7523082802547771, + "causal_surprisal_total": 0.39543885350318475, + "consistency_total": 0.8909213375796179, + "curvature_flow": 0.09706178343949044, + "curvature_packet": 0.7913216560509555, + "curvature_total": 0.28839617834394904, + "direction_drift_flow": 0.19718503184713376, + "direction_drift_packet_max": 0.8012245222929938, + "direction_drift_packet_mean": 0.7162656050955414, + "direction_drift_packet_median": 0.6740464968152866, + "direction_drift_packet_trimmed10_mean": 0.6951624203821656, + "direction_drift_total": 0.7029197452229301, + "flow_consistency": 0.8912751592356687, + "jacobian_flow": 0.17278853503184713, + "jacobian_packet": 0.4322146496815287, + "jacobian_total": 0.36138280254777067, + "kappa2_speed2norm_packet_mean": 0.44577770700636943, + "kappa2_speed2norm_packet_median": 0.42490891719745216, + "kappa2_speed2norm_packet_trimmed10_mean": 0.40923312101910825, + "kinetic_energy": 0.8085191082802549, + "kinetic_flow": 0.7755764331210191, + "kinetic_packet": 0.8814025477707006, + "packet_consistency": 0.7827624203821655, + "pna_flow": 0.11018280254777071, + "pna_packet_max": 0.6461582802547771, + "pna_packet_mean": 0.44577770700636943, + "pna_packet_median": 0.42490891719745216, + "pna_packet_trimmed10_mean": 0.40923312101910825, + "terminal_flow": 0.9366420382165604, + "terminal_norm": 0.9528955414012739, + "terminal_packet": 0.9076882165605096, + "velocity_flow": 0.8043535031847134, + "velocity_flow_t01": 0.7673057324840764, + "velocity_flow_t03": 0.7663292993630572, + "velocity_flow_t05": 0.7717649681528662, + "velocity_flow_t07": 0.7955331210191081, + "velocity_flow_t09": 0.8396433121019108, + "velocity_flow_t10": 0.8392585987261147, + "velocity_packet": 0.6436108280254776, + "velocity_packet_t01": 0.5826089171974522, + "velocity_packet_t03": 0.5829442675159235, + "velocity_packet_t05": 0.5914624203821656, + "velocity_packet_t07": 0.6296382165605096, + "velocity_packet_t09": 0.6873694267515923, + "velocity_packet_t10": 0.7835503184713376, + "velocity_total": 0.758471974522293, + "velocity_total_t01": 0.595107643312102, + "velocity_total_t03": 0.6000707006369427, + "velocity_total_t05": 0.6400312101910829, + "velocity_total_t07": 0.7418649681528661, + "velocity_total_t09": 0.7728197452229298, + "velocity_total_t10": 0.8268961783439491 + }, + "ddos-syn_flood": { + "_n": 1141.0, + "arc_length": 0.9934552147239264, + "causal_surprisal_flow": 0.033451183172655566, + "causal_surprisal_packet_max": 0.7683843996494302, + "causal_surprisal_packet_mean": 0.9437478527607361, + "causal_surprisal_packet_median": 0.9814096406660824, + "causal_surprisal_packet_trimmed10_mean": 0.9538355828220858, + "causal_surprisal_total": 0.1314313759859772, + "consistency_total": 0.9015134092900964, + "curvature_flow": 0.013506047326906214, + "curvature_packet": 0.9344045574057844, + "curvature_total": 0.34081165644171774, + "direction_drift_flow": 0.11941463628396143, + "direction_drift_packet_max": 0.7670343558282208, + "direction_drift_packet_mean": 0.6945413672217352, + "direction_drift_packet_median": 0.5600921998247151, + "direction_drift_packet_trimmed10_mean": 0.6113361963190185, + "direction_drift_total": 0.5483816827344434, + "flow_consistency": 0.8898979842243646, + "jacobian_flow": 0.07205170902716915, + "jacobian_packet": 0.7064138475021912, + "jacobian_total": 0.44474881682734446, + "kappa2_speed2norm_packet_mean": 0.18832410166520597, + "kappa2_speed2norm_packet_median": 0.20977510955302367, + "kappa2_speed2norm_packet_trimmed10_mean": 0.15984522348816826, + "kinetic_energy": 0.9935813321647677, + "kinetic_flow": 0.8573689745836985, + "kinetic_packet": 0.9951283085013147, + "packet_consistency": 0.9077975460122699, + "pna_flow": 0.02149605609114812, + "pna_packet_max": 0.24242524101665205, + "pna_packet_mean": 0.18832410166520597, + "pna_packet_median": 0.20977510955302367, + "pna_packet_trimmed10_mean": 0.15984522348816826, + "terminal_flow": 0.9566813321647677, + "terminal_norm": 0.9966527607361964, + "terminal_packet": 0.9854480280455741, + "velocity_flow": 0.8654285714285713, + "velocity_flow_t01": 0.8691255039439089, + "velocity_flow_t03": 0.8651737072743207, + "velocity_flow_t05": 0.8598136722173532, + "velocity_flow_t07": 0.8645274320771255, + "velocity_flow_t09": 0.8640983347940403, + "velocity_flow_t10": 0.8602072743207714, + "velocity_packet": 0.9437647677475898, + "velocity_packet_t01": 0.5998699386503068, + "velocity_packet_t03": 0.7348085889570553, + "velocity_packet_t05": 0.8768978089395268, + "velocity_packet_t07": 0.9513418054338298, + "velocity_packet_t09": 0.9618383873794917, + "velocity_packet_t10": 0.9763114811568799, + "velocity_total": 0.944873356704645, + "velocity_total_t01": 0.871024014022787, + "velocity_total_t03": 0.9067807186678353, + "velocity_total_t05": 0.9267090271691499, + "velocity_total_t07": 0.9598108676599475, + "velocity_total_t09": 0.9525258545135846, + "velocity_total_t10": 0.9464876424189307 + }, + "ddos-synonymousip_flood": { + "_n": 182.0, + "arc_length": 0.9652598901098901, + "causal_surprisal_flow": 0.06190439560439562, + "causal_surprisal_packet_max": 0.9862681318681319, + "causal_surprisal_packet_mean": 0.8578417582417582, + "causal_surprisal_packet_median": 0.33193516483516483, + "causal_surprisal_packet_trimmed10_mean": 0.6156032967032967, + "causal_surprisal_total": 0.07798021978021978, + "consistency_total": 0.9946395604395605, + "curvature_flow": 0.0020934065934065773, + "curvature_packet": 0.9792395604395604, + "curvature_total": 0.7624406593406594, + "direction_drift_flow": 0.012237362637362642, + "direction_drift_packet_max": 0.9586912087912087, + "direction_drift_packet_mean": 0.8770131868131869, + "direction_drift_packet_median": 0.7827087912087912, + "direction_drift_packet_trimmed10_mean": 0.8652043956043957, + "direction_drift_total": 0.9352043956043957, + "flow_consistency": 0.9945406593406594, + "jacobian_flow": 0.005095604395604391, + "jacobian_packet": 0.12430219780219781, + "jacobian_total": 0.14367912087912088, + "kappa2_speed2norm_packet_mean": 0.8244747252747253, + "kappa2_speed2norm_packet_median": 0.7874631868131868, + "kappa2_speed2norm_packet_trimmed10_mean": 0.8266846153846154, + "kinetic_energy": 0.9659373626373626, + "kinetic_flow": 0.9182593406593407, + "kinetic_packet": 0.9936043956043956, + "packet_consistency": 0.9946175824175825, + "pna_flow": 0.0027527472527472748, + "pna_packet_max": 0.9493560439560439, + "pna_packet_mean": 0.8244747252747253, + "pna_packet_median": 0.7874631868131868, + "pna_packet_trimmed10_mean": 0.8266846153846154, + "terminal_flow": 0.9990054945054945, + "terminal_norm": 0.9986824175824176, + "terminal_packet": 0.9877043956043956, + "velocity_flow": 0.9306010989010989, + "velocity_flow_t01": 0.9333307692307692, + "velocity_flow_t03": 0.9309923076923077, + "velocity_flow_t05": 0.9300032967032967, + "velocity_flow_t07": 0.9297769230769232, + "velocity_flow_t09": 0.9307043956043956, + "velocity_flow_t10": 0.9346241758241759, + "velocity_packet": 0.9829961538461538, + "velocity_packet_t01": 0.9466296703296704, + "velocity_packet_t03": 0.9702076923076923, + "velocity_packet_t05": 0.9857296703296703, + "velocity_packet_t07": 0.9894967032967033, + "velocity_packet_t09": 0.9606505494505495, + "velocity_packet_t10": 0.6756538461538462, + "velocity_total": 0.8889395604395605, + "velocity_total_t01": 0.8739340659340659, + "velocity_total_t03": 0.9018351648351648, + "velocity_total_t05": 0.9080164835164835, + "velocity_total_t07": 0.9163373626373625, + "velocity_total_t09": 0.8682703296703297, + "velocity_total_t10": 0.7535384615384615 + }, + "ddos-tcp_flood": { + "_n": 1224.0, + "arc_length": 0.9886722222222223, + "causal_surprisal_flow": 0.017368464052287577, + "causal_surprisal_packet_max": 0.7133937908496732, + "causal_surprisal_packet_mean": 0.8917318627450982, + "causal_surprisal_packet_median": 0.9589377450980391, + "causal_surprisal_packet_trimmed10_mean": 0.9282697712418301, + "causal_surprisal_total": 0.10258643790849674, + "consistency_total": 0.8124066993464052, + "curvature_flow": 0.015812418300653608, + "curvature_packet": 0.8377411764705883, + "curvature_total": 0.1334076797385621, + "direction_drift_flow": 0.10628022875816995, + "direction_drift_packet_max": 0.48888513071895423, + "direction_drift_packet_mean": 0.3262966503267974, + "direction_drift_packet_median": 0.24629493464052288, + "direction_drift_packet_trimmed10_mean": 0.321409068627451, + "direction_drift_total": 0.08053022875816994, + "flow_consistency": 0.7844562091503268, + "jacobian_flow": 0.0828717320261438, + "jacobian_packet": 0.7645769607843137, + "jacobian_total": 0.41403954248366015, + "kappa2_speed2norm_packet_mean": 0.033828513071895425, + "kappa2_speed2norm_packet_median": 0.03379591503267974, + "kappa2_speed2norm_packet_trimmed10_mean": 0.031228431372549017, + "kinetic_energy": 0.9877176470588235, + "kinetic_flow": 0.8009295751633987, + "kinetic_packet": 0.9856161764705882, + "packet_consistency": 0.836187091503268, + "pna_flow": 0.03561241830065359, + "pna_packet_max": 0.08684411764705882, + "pna_packet_mean": 0.033828513071895425, + "pna_packet_median": 0.03379591503267974, + "pna_packet_trimmed10_mean": 0.031228431372549017, + "terminal_flow": 0.9308243464052287, + "terminal_norm": 0.9899933006535948, + "terminal_packet": 0.9576222222222223, + "velocity_flow": 0.8429828431372548, + "velocity_flow_t01": 0.8377555555555556, + "velocity_flow_t03": 0.8332506535947711, + "velocity_flow_t05": 0.8256910130718954, + "velocity_flow_t07": 0.838108660130719, + "velocity_flow_t09": 0.8525801470588235, + "velocity_flow_t10": 0.8520312091503269, + "velocity_packet": 0.959159477124183, + "velocity_packet_t01": 0.5870901960784314, + "velocity_packet_t03": 0.650936274509804, + "velocity_packet_t05": 0.8406006535947713, + "velocity_packet_t07": 0.9557888888888889, + "velocity_packet_t09": 0.9875284313725491, + "velocity_packet_t10": 0.9985576797385621, + "velocity_total": 0.9690253267973856, + "velocity_total_t01": 0.8409945261437909, + "velocity_total_t03": 0.9112306372549019, + "velocity_total_t05": 0.9368030228758171, + "velocity_total_t07": 0.9689928104575164, + "velocity_total_t09": 0.9818758986928106, + "velocity_total_t10": 0.9805176470588236 + }, + "ddos-udp_flood": { + "_n": 10.0, + "arc_length": 0.91072, + "causal_surprisal_flow": 0.6160800000000001, + "causal_surprisal_packet_max": 0.89248, + "causal_surprisal_packet_mean": 0.6765599999999999, + "causal_surprisal_packet_median": 0.27716, + "causal_surprisal_packet_trimmed10_mean": 0.55084, + "causal_surprisal_total": 0.22510000000000002, + "consistency_total": 0.8969800000000001, + "curvature_flow": 0.2431, + "curvature_packet": 0.85182, + "curvature_total": 0.43698000000000004, + "direction_drift_flow": 0.05118, + "direction_drift_packet_max": 0.82288, + "direction_drift_packet_mean": 0.87852, + "direction_drift_packet_median": 0.83366, + "direction_drift_packet_trimmed10_mean": 0.88586, + "direction_drift_total": 0.8886800000000001, + "flow_consistency": 0.91176, + "jacobian_flow": 0.08322000000000002, + "jacobian_packet": 0.46849999999999997, + "jacobian_total": 0.36362, + "kappa2_speed2norm_packet_mean": 0.69572, + "kappa2_speed2norm_packet_median": 0.6590400000000001, + "kappa2_speed2norm_packet_trimmed10_mean": 0.71248, + "kinetic_energy": 0.91352, + "kinetic_flow": 0.89498, + "kinetic_packet": 0.9520599999999999, + "packet_consistency": 0.60372, + "pna_flow": 0.17174, + "pna_packet_max": 0.81422, + "pna_packet_mean": 0.69572, + "pna_packet_median": 0.6590400000000001, + "pna_packet_trimmed10_mean": 0.71248, + "terminal_flow": 0.97094, + "terminal_norm": 0.9760400000000001, + "terminal_packet": 0.9584600000000001, + "velocity_flow": 0.9462200000000001, + "velocity_flow_t01": 0.8813399999999999, + "velocity_flow_t03": 0.8950799999999999, + "velocity_flow_t05": 0.9215800000000001, + "velocity_flow_t07": 0.9447999999999999, + "velocity_flow_t09": 0.94506, + "velocity_flow_t10": 0.94416, + "velocity_packet": 0.57994, + "velocity_packet_t01": 0.57928, + "velocity_packet_t03": 0.58884, + "velocity_packet_t05": 0.5971, + "velocity_packet_t07": 0.57066, + "velocity_packet_t09": 0.40562000000000004, + "velocity_packet_t10": 0.45536000000000004, + "velocity_total": 0.60744, + "velocity_total_t01": 0.58082, + "velocity_total_t03": 0.59538, + "velocity_total_t05": 0.62012, + "velocity_total_t07": 0.6022, + "velocity_total_t09": 0.49051999999999996, + "velocity_total_t10": 0.60234 + }, + "ddos-udp_fragmentation": { + "_n": 26.0, + "arc_length": 0.7325076923076923, + "causal_surprisal_flow": 0.35796923076923076, + "causal_surprisal_packet_max": 0.6252615384615384, + "causal_surprisal_packet_mean": 0.533876923076923, + "causal_surprisal_packet_median": 0.48163076923076925, + "causal_surprisal_packet_trimmed10_mean": 0.41485384615384624, + "causal_surprisal_total": 0.16328461538461536, + "consistency_total": 0.7217, + "curvature_flow": 0.2116230769230769, + "curvature_packet": 0.7172230769230769, + "curvature_total": 0.5049076923076923, + "direction_drift_flow": 0.2495692307692308, + "direction_drift_packet_max": 0.6309538461538462, + "direction_drift_packet_mean": 0.47526153846153846, + "direction_drift_packet_median": 0.43958461538461535, + "direction_drift_packet_trimmed10_mean": 0.4575923076923077, + "direction_drift_total": 0.4699153846153846, + "flow_consistency": 0.6946307692307693, + "jacobian_flow": 0.2680230769230769, + "jacobian_packet": 0.41856923076923075, + "jacobian_total": 0.34578461538461536, + "kappa2_speed2norm_packet_mean": 0.5459153846153846, + "kappa2_speed2norm_packet_median": 0.5513, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5474769230769232, + "kinetic_energy": 0.7283461538461539, + "kinetic_flow": 0.7058461538461539, + "kinetic_packet": 0.7513846153846153, + "packet_consistency": 0.7017153846153845, + "pna_flow": 0.2540769230769231, + "pna_packet_max": 0.6142307692307692, + "pna_packet_mean": 0.5459153846153846, + "pna_packet_median": 0.5513, + "pna_packet_trimmed10_mean": 0.5474769230769232, + "terminal_flow": 0.7976538461538462, + "terminal_norm": 0.7953384615384615, + "terminal_packet": 0.7409153846153846, + "velocity_flow": 0.7493846153846154, + "velocity_flow_t01": 0.7385384615384616, + "velocity_flow_t03": 0.7413423076923078, + "velocity_flow_t05": 0.7541769230769231, + "velocity_flow_t07": 0.7568846153846154, + "velocity_flow_t09": 0.7564, + "velocity_flow_t10": 0.7116, + "velocity_packet": 0.6925923076923077, + "velocity_packet_t01": 0.6137, + "velocity_packet_t03": 0.6304000000000001, + "velocity_packet_t05": 0.6411692307692308, + "velocity_packet_t07": 0.6494153846153846, + "velocity_packet_t09": 0.6579, + "velocity_packet_t10": 0.6755230769230769, + "velocity_total": 0.7462153846153846, + "velocity_total_t01": 0.6792230769230769, + "velocity_total_t03": 0.7208461538461539, + "velocity_total_t05": 0.7446846153846154, + "velocity_total_t07": 0.7456461538461538, + "velocity_total_t09": 0.7503000000000001, + "velocity_total_t10": 0.7029538461538463 + }, + "dictionarybruteforce": { + "_n": 19.0, + "arc_length": 0.760957894736842, + "causal_surprisal_flow": 0.2753684210526316, + "causal_surprisal_packet_max": 0.5959578947368421, + "causal_surprisal_packet_mean": 0.564, + "causal_surprisal_packet_median": 0.6118631578947369, + "causal_surprisal_packet_trimmed10_mean": 0.5668421052631578, + "causal_surprisal_total": 0.22495789473684208, + "consistency_total": 0.6664947368421053, + "curvature_flow": 0.1739578947368421, + "curvature_packet": 0.6678105263157894, + "curvature_total": 0.3430210526315789, + "direction_drift_flow": 0.2866105263157894, + "direction_drift_packet_max": 0.5748105263157895, + "direction_drift_packet_mean": 0.4818315789473684, + "direction_drift_packet_median": 0.4902210526315789, + "direction_drift_packet_trimmed10_mean": 0.4576526315789473, + "direction_drift_total": 0.41183157894736844, + "flow_consistency": 0.6459157894736841, + "jacobian_flow": 0.28930526315789473, + "jacobian_packet": 0.469957894736842, + "jacobian_total": 0.3751894736842105, + "kappa2_speed2norm_packet_mean": 0.4018842105263158, + "kappa2_speed2norm_packet_median": 0.3787789473684211, + "kappa2_speed2norm_packet_trimmed10_mean": 0.40502105263157895, + "kinetic_energy": 0.7564631578947368, + "kinetic_flow": 0.7191157894736842, + "kinetic_packet": 0.7707157894736842, + "packet_consistency": 0.6414210526315789, + "pna_flow": 0.22821052631578945, + "pna_packet_max": 0.477378947368421, + "pna_packet_mean": 0.4018842105263158, + "pna_packet_median": 0.3787789473684211, + "pna_packet_trimmed10_mean": 0.40502105263157895, + "terminal_flow": 0.8563894736842105, + "terminal_norm": 0.837178947368421, + "terminal_packet": 0.7464736842105263, + "velocity_flow": 0.7103157894736842, + "velocity_flow_t01": 0.6727052631578947, + "velocity_flow_t03": 0.686178947368421, + "velocity_flow_t05": 0.6883684210526315, + "velocity_flow_t07": 0.7040631578947368, + "velocity_flow_t09": 0.7176421052631579, + "velocity_flow_t10": 0.6714947368421053, + "velocity_packet": 0.6324842105263158, + "velocity_packet_t01": 0.5579894736842104, + "velocity_packet_t03": 0.5615368421052631, + "velocity_packet_t05": 0.582221052631579, + "velocity_packet_t07": 0.615378947368421, + "velocity_packet_t09": 0.6527157894736841, + "velocity_packet_t10": 0.6835684210526316, + "velocity_total": 0.7141684210526316, + "velocity_total_t01": 0.6215578947368421, + "velocity_total_t03": 0.666578947368421, + "velocity_total_t05": 0.6758210526315789, + "velocity_total_t07": 0.7066947368421053, + "velocity_total_t09": 0.7654736842105263, + "velocity_total_t10": 0.7261052631578947 + }, + "dns_spoofing": { + "_n": 185.0, + "arc_length": 0.7772097297297297, + "causal_surprisal_flow": 0.2827740540540541, + "causal_surprisal_packet_max": 0.5816551351351351, + "causal_surprisal_packet_mean": 0.5755891891891892, + "causal_surprisal_packet_median": 0.59316, + "causal_surprisal_packet_trimmed10_mean": 0.5772281081081081, + "causal_surprisal_total": 0.26286270270270273, + "consistency_total": 0.7138497297297297, + "curvature_flow": 0.21031135135135137, + "curvature_packet": 0.7373891891891893, + "curvature_total": 0.42863999999999997, + "direction_drift_flow": 0.3474664864864865, + "direction_drift_packet_max": 0.5437427027027026, + "direction_drift_packet_mean": 0.4660356756756757, + "direction_drift_packet_median": 0.45369351351351356, + "direction_drift_packet_trimmed10_mean": 0.4605297297297297, + "direction_drift_total": 0.41579567567567566, + "flow_consistency": 0.709254054054054, + "jacobian_flow": 0.37105081081081087, + "jacobian_packet": 0.5269751351351352, + "jacobian_total": 0.45801297297297294, + "kappa2_speed2norm_packet_mean": 0.4530562162162162, + "kappa2_speed2norm_packet_median": 0.4517156756756757, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4568648648648649, + "kinetic_energy": 0.7738929729729729, + "kinetic_flow": 0.6623600000000001, + "kinetic_packet": 0.7873697297297299, + "packet_consistency": 0.6613697297297297, + "pna_flow": 0.2656113513513514, + "pna_packet_max": 0.49859891891891894, + "pna_packet_mean": 0.4530562162162162, + "pna_packet_median": 0.4517156756756757, + "pna_packet_trimmed10_mean": 0.4568648648648649, + "terminal_flow": 0.7908605405405406, + "terminal_norm": 0.8173870270270269, + "terminal_packet": 0.7608216216216217, + "velocity_flow": 0.6581578378378379, + "velocity_flow_t01": 0.6526654054054054, + "velocity_flow_t03": 0.6536291891891892, + "velocity_flow_t05": 0.6560972972972973, + "velocity_flow_t07": 0.6644551351351351, + "velocity_flow_t09": 0.6861881081081082, + "velocity_flow_t10": 0.6516054054054053, + "velocity_packet": 0.6472854054054055, + "velocity_packet_t01": 0.5541740540540541, + "velocity_packet_t03": 0.5804475675675675, + "velocity_packet_t05": 0.6049308108108108, + "velocity_packet_t07": 0.6337183783783784, + "velocity_packet_t09": 0.677544864864865, + "velocity_packet_t10": 0.6839524324324324, + "velocity_total": 0.6964486486486487, + "velocity_total_t01": 0.6248, + "velocity_total_t03": 0.6416843243243243, + "velocity_total_t05": 0.6563448648648649, + "velocity_total_t07": 0.6978248648648648, + "velocity_total_t09": 0.7203264864864866, + "velocity_total_t10": 0.6924367567567569 + }, + "dos-http_flood": { + "_n": 704.0, + "arc_length": 0.9487254261363636, + "causal_surprisal_flow": 0.48175028409090914, + "causal_surprisal_packet_max": 0.6855119318181818, + "causal_surprisal_packet_mean": 0.8465576704545456, + "causal_surprisal_packet_median": 0.9170894886363635, + "causal_surprisal_packet_trimmed10_mean": 0.8961, + "causal_surprisal_total": 0.5153539772727274, + "consistency_total": 0.9097613636363635, + "curvature_flow": 0.02191079545454544, + "curvature_packet": 0.9351173295454546, + "curvature_total": 0.2610596590909091, + "direction_drift_flow": 0.2955240056818182, + "direction_drift_packet_max": 0.5980377840909091, + "direction_drift_packet_mean": 0.6172039772727274, + "direction_drift_packet_median": 0.6033139204545455, + "direction_drift_packet_trimmed10_mean": 0.6298957386363637, + "direction_drift_total": 0.37119076704545456, + "flow_consistency": 0.9040292613636363, + "jacobian_flow": 0.35476818181818187, + "jacobian_packet": 0.8037372159090909, + "jacobian_total": 0.5584542613636364, + "kappa2_speed2norm_packet_mean": 0.388015625, + "kappa2_speed2norm_packet_median": 0.39545142045454545, + "kappa2_speed2norm_packet_trimmed10_mean": 0.40427485795454543, + "kinetic_energy": 0.947137784090909, + "kinetic_flow": 0.6837383522727273, + "kinetic_packet": 0.9676417613636364, + "packet_consistency": 0.8516872159090908, + "pna_flow": 0.025741193181818178, + "pna_packet_max": 0.3781507102272727, + "pna_packet_mean": 0.388015625, + "pna_packet_median": 0.39545142045454545, + "pna_packet_trimmed10_mean": 0.40427485795454543, + "terminal_flow": 0.9317363636363636, + "terminal_norm": 0.9878004261363637, + "terminal_packet": 0.9671849431818182, + "velocity_flow": 0.6627494318181818, + "velocity_flow_t01": 0.627709090909091, + "velocity_flow_t03": 0.6350227272727273, + "velocity_flow_t05": 0.6526428977272727, + "velocity_flow_t07": 0.6596517045454546, + "velocity_flow_t09": 0.8448232954545455, + "velocity_flow_t10": 0.8492943181818181, + "velocity_packet": 0.7202369318181818, + "velocity_packet_t01": 0.39705113636363637, + "velocity_packet_t03": 0.4415926136363636, + "velocity_packet_t05": 0.5641795454545455, + "velocity_packet_t07": 0.7680386363636363, + "velocity_packet_t09": 0.9087482954545455, + "velocity_packet_t10": 0.8846598011363636, + "velocity_total": 0.8843394886363637, + "velocity_total_t01": 0.6195289772727273, + "velocity_total_t03": 0.6485440340909091, + "velocity_total_t05": 0.6768730113636364, + "velocity_total_t07": 0.8836244318181818, + "velocity_total_t09": 0.941759375, + "velocity_total_t10": 0.9467894886363636 + }, + "dos-syn_flood": { + "_n": 874.0, + "arc_length": 0.9874413043478261, + "causal_surprisal_flow": 0.17614897025171622, + "causal_surprisal_packet_max": 0.7774418764302059, + "causal_surprisal_packet_mean": 0.9313016018306637, + "causal_surprisal_packet_median": 0.936166132723112, + "causal_surprisal_packet_trimmed10_mean": 0.9005114416475972, + "causal_surprisal_total": 0.23271716247139587, + "consistency_total": 0.9117409610983982, + "curvature_flow": 0.06215560640732265, + "curvature_packet": 0.9224192219679633, + "curvature_total": 0.4184369565217391, + "direction_drift_flow": 0.14285045766590387, + "direction_drift_packet_max": 0.9134617848970252, + "direction_drift_packet_mean": 0.8712522883295195, + "direction_drift_packet_median": 0.7770391304347827, + "direction_drift_packet_trimmed10_mean": 0.8186358123569795, + "direction_drift_total": 0.7824350114416476, + "flow_consistency": 0.9080713958810069, + "jacobian_flow": 0.1363725400457666, + "jacobian_packet": 0.6237907322654462, + "jacobian_total": 0.40613935926773453, + "kappa2_speed2norm_packet_mean": 0.35887379862700225, + "kappa2_speed2norm_packet_median": 0.3808661327231121, + "kappa2_speed2norm_packet_trimmed10_mean": 0.33724599542334094, + "kinetic_energy": 0.9871169336384437, + "kinetic_flow": 0.8310629290617848, + "kinetic_packet": 0.9931535469107551, + "packet_consistency": 0.8979661327231121, + "pna_flow": 0.0704200228832952, + "pna_packet_max": 0.43504874141876426, + "pna_packet_mean": 0.35887379862700225, + "pna_packet_median": 0.3808661327231121, + "pna_packet_trimmed10_mean": 0.33724599542334094, + "terminal_flow": 0.9481919908466818, + "terminal_norm": 0.9960494279176201, + "terminal_packet": 0.9927320366132724, + "velocity_flow": 0.871366590389016, + "velocity_flow_t01": 0.8256491990846682, + "velocity_flow_t03": 0.82562471395881, + "velocity_flow_t05": 0.8247425629290618, + "velocity_flow_t07": 0.8622093821510298, + "velocity_flow_t09": 0.8809320366132724, + "velocity_flow_t10": 0.8805897025171624, + "velocity_packet": 0.8630197940503432, + "velocity_packet_t01": 0.6085327231121281, + "velocity_packet_t03": 0.6772350114416478, + "velocity_packet_t05": 0.7758681922196795, + "velocity_packet_t07": 0.8949663615560641, + "velocity_packet_t09": 0.9137768878718536, + "velocity_packet_t10": 0.8801688787185356, + "velocity_total": 0.9132098398169336, + "velocity_total_t01": 0.7412288329519451, + "velocity_total_t03": 0.834054233409611, + "velocity_total_t05": 0.8962233409610983, + "velocity_total_t07": 0.9223664759725402, + "velocity_total_t09": 0.9299240274599543, + "velocity_total_t10": 0.9207811212814645 + }, + "dos-tcp_flood": { + "_n": 1076.0, + "arc_length": 0.9882191449814127, + "causal_surprisal_flow": 0.0794802973977695, + "causal_surprisal_packet_max": 0.6867561338289963, + "causal_surprisal_packet_mean": 0.7938476765799256, + "causal_surprisal_packet_median": 0.8745241635687733, + "causal_surprisal_packet_trimmed10_mean": 0.8207697026022305, + "causal_surprisal_total": 0.13627955390334573, + "consistency_total": 0.8759275092936802, + "curvature_flow": 0.047874907063197025, + "curvature_packet": 0.8510278810408922, + "curvature_total": 0.21815130111524164, + "direction_drift_flow": 0.19118345724907063, + "direction_drift_packet_max": 0.5301152416356878, + "direction_drift_packet_mean": 0.3738048327137547, + "direction_drift_packet_median": 0.2994434014869889, + "direction_drift_packet_trimmed10_mean": 0.3242141263940521, + "direction_drift_total": 0.17449052044609664, + "flow_consistency": 0.8658184944237918, + "jacobian_flow": 0.15056375464684013, + "jacobian_packet": 0.6927328996282527, + "jacobian_total": 0.41384089219330855, + "kappa2_speed2norm_packet_mean": 0.05940027881040892, + "kappa2_speed2norm_packet_median": 0.06053754646840148, + "kappa2_speed2norm_packet_trimmed10_mean": 0.04953819702602231, + "kinetic_energy": 0.9873942379182156, + "kinetic_flow": 0.7861369888475837, + "kinetic_packet": 0.9894033457249071, + "packet_consistency": 0.8657488847583643, + "pna_flow": 0.06758940520446097, + "pna_packet_max": 0.15851654275092936, + "pna_packet_mean": 0.05940027881040892, + "pna_packet_median": 0.06053754646840148, + "pna_packet_trimmed10_mean": 0.04953819702602231, + "terminal_flow": 0.9424217472118959, + "terminal_norm": 0.994646468401487, + "terminal_packet": 0.9795945167286245, + "velocity_flow": 0.8117371747211897, + "velocity_flow_t01": 0.7842191449814127, + "velocity_flow_t03": 0.7872860594795539, + "velocity_flow_t05": 0.8117381040892193, + "velocity_flow_t07": 0.8130659851301115, + "velocity_flow_t09": 0.8315792750929368, + "velocity_flow_t10": 0.8405877323420076, + "velocity_packet": 0.91380343866171, + "velocity_packet_t01": 0.5570481412639405, + "velocity_packet_t03": 0.6281193308550186, + "velocity_packet_t05": 0.7505386617100372, + "velocity_packet_t07": 0.9055195167286245, + "velocity_packet_t09": 0.9769369888475836, + "velocity_packet_t10": 0.9970460966542751, + "velocity_total": 0.9451730483271377, + "velocity_total_t01": 0.7662643122676581, + "velocity_total_t03": 0.8350141263940521, + "velocity_total_t05": 0.8929453531598512, + "velocity_total_t07": 0.9456007434944238, + "velocity_total_t09": 0.9657325278810408, + "velocity_total_t10": 0.9675091078066914 + }, + "dos-udp_flood": { + "_n": 201.0, + "arc_length": 0.9889203980099504, + "causal_surprisal_flow": 0.11831492537313433, + "causal_surprisal_packet_max": 0.975555223880597, + "causal_surprisal_packet_mean": 0.8519164179104477, + "causal_surprisal_packet_median": 0.30530945273631843, + "causal_surprisal_packet_trimmed10_mean": 0.625952736318408, + "causal_surprisal_total": 0.0906955223880597, + "consistency_total": 0.9959432835820896, + "curvature_flow": 0.03523283582089554, + "curvature_packet": 0.9684825870646766, + "curvature_total": 0.7038253731343284, + "direction_drift_flow": 0.024929353233830845, + "direction_drift_packet_max": 0.9481323383084578, + "direction_drift_packet_mean": 0.7556233830845771, + "direction_drift_packet_median": 0.6772796019900498, + "direction_drift_packet_trimmed10_mean": 0.7527825870646767, + "direction_drift_total": 0.8404308457711444, + "flow_consistency": 0.9964000000000001, + "jacobian_flow": 0.01855522388059702, + "jacobian_packet": 0.09131144278606965, + "jacobian_total": 0.11244378109452735, + "kappa2_speed2norm_packet_mean": 0.24868955223880596, + "kappa2_speed2norm_packet_median": 0.25046965174129354, + "kappa2_speed2norm_packet_trimmed10_mean": 0.24897313432835821, + "kinetic_energy": 0.9896368159203981, + "kinetic_flow": 0.938807960199005, + "kinetic_packet": 0.9954686567164182, + "packet_consistency": 0.9895293532338308, + "pna_flow": 0.02275721393034826, + "pna_packet_max": 0.4097134328358209, + "pna_packet_mean": 0.24868955223880596, + "pna_packet_median": 0.25046965174129354, + "pna_packet_trimmed10_mean": 0.24897313432835821, + "terminal_flow": 0.9971353233830846, + "terminal_norm": 0.9971293532338308, + "terminal_packet": 0.9931562189054726, + "velocity_flow": 0.9823104477611938, + "velocity_flow_t01": 0.9818636815920398, + "velocity_flow_t03": 0.9817552238805971, + "velocity_flow_t05": 0.9821840796019901, + "velocity_flow_t07": 0.9824189054726369, + "velocity_flow_t09": 0.9816616915422884, + "velocity_flow_t10": 0.9807432835820895, + "velocity_packet": 0.9913402985074626, + "velocity_packet_t01": 0.9908706467661692, + "velocity_packet_t03": 0.991244776119403, + "velocity_packet_t05": 0.9910069651741292, + "velocity_packet_t07": 0.989023880597015, + "velocity_packet_t09": 0.9724398009950249, + "velocity_packet_t10": 0.975192039800995, + "velocity_total": 0.9650378109452736, + "velocity_total_t01": 0.9828796019900496, + "velocity_total_t03": 0.9856935323383084, + "velocity_total_t05": 0.9866099502487562, + "velocity_total_t07": 0.9843303482587065, + "velocity_total_t09": 0.9022507462686568, + "velocity_total_t10": 0.8654129353233831 + }, + "mirai-greeth_flood": { + "_n": 16.0, + "arc_length": 0.6561874999999999, + "causal_surprisal_flow": 0.21985, + "causal_surprisal_packet_max": 0.4896625, + "causal_surprisal_packet_mean": 0.4769375, + "causal_surprisal_packet_median": 0.5253249999999999, + "causal_surprisal_packet_trimmed10_mean": 0.48530000000000006, + "causal_surprisal_total": 0.2360375, + "consistency_total": 0.581225, + "curvature_flow": 0.4062375, + "curvature_packet": 0.5810124999999999, + "curvature_total": 0.581575, + "direction_drift_flow": 0.448825, + "direction_drift_packet_max": 0.473075, + "direction_drift_packet_mean": 0.453875, + "direction_drift_packet_median": 0.45475, + "direction_drift_packet_trimmed10_mean": 0.44972499999999993, + "direction_drift_total": 0.46347499999999997, + "flow_consistency": 0.59295, + "jacobian_flow": 0.48605000000000004, + "jacobian_packet": 0.5522625000000001, + "jacobian_total": 0.5478375, + "kappa2_speed2norm_packet_mean": 0.39935, + "kappa2_speed2norm_packet_median": 0.4046875, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3990125, + "kinetic_energy": 0.6541625, + "kinetic_flow": 0.49682499999999996, + "kinetic_packet": 0.6641374999999999, + "packet_consistency": 0.5556, + "pna_flow": 0.4642375, + "pna_packet_max": 0.4378500000000001, + "pna_packet_mean": 0.39935, + "pna_packet_median": 0.4046875, + "pna_packet_trimmed10_mean": 0.3990125, + "terminal_flow": 0.551525, + "terminal_norm": 0.632, + "terminal_packet": 0.6604749999999999, + "velocity_flow": 0.5304125, + "velocity_flow_t01": 0.5493875, + "velocity_flow_t03": 0.5618875, + "velocity_flow_t05": 0.5615, + "velocity_flow_t07": 0.5550875000000001, + "velocity_flow_t09": 0.5426875, + "velocity_flow_t10": 0.5403375, + "velocity_packet": 0.5596874999999999, + "velocity_packet_t01": 0.4712875, + "velocity_packet_t03": 0.512775, + "velocity_packet_t05": 0.536075, + "velocity_packet_t07": 0.53325, + "velocity_packet_t09": 0.5221625000000001, + "velocity_packet_t10": 0.5724874999999999, + "velocity_total": 0.5503250000000001, + "velocity_total_t01": 0.5134875, + "velocity_total_t03": 0.5430375000000001, + "velocity_total_t05": 0.5441874999999999, + "velocity_total_t07": 0.5512125, + "velocity_total_t09": 0.5644, + "velocity_total_t10": 0.5847 + }, + "mirai-greip_flood": { + "_n": 25.0, + "arc_length": 0.8408720000000001, + "causal_surprisal_flow": 0.23428, + "causal_surprisal_packet_max": 0.6078, + "causal_surprisal_packet_mean": 0.6071759999999999, + "causal_surprisal_packet_median": 0.651392, + "causal_surprisal_packet_trimmed10_mean": 0.626648, + "causal_surprisal_total": 0.212704, + "consistency_total": 0.782856, + "curvature_flow": 0.13284, + "curvature_packet": 0.720432, + "curvature_total": 0.31955999999999996, + "direction_drift_flow": 0.241184, + "direction_drift_packet_max": 0.5546, + "direction_drift_packet_mean": 0.49512799999999996, + "direction_drift_packet_median": 0.487888, + "direction_drift_packet_trimmed10_mean": 0.49252, + "direction_drift_total": 0.39897599999999994, + "flow_consistency": 0.778192, + "jacobian_flow": 0.23750400000000002, + "jacobian_packet": 0.5308160000000001, + "jacobian_total": 0.401544, + "kappa2_speed2norm_packet_mean": 0.35149600000000003, + "kappa2_speed2norm_packet_median": 0.33528800000000003, + "kappa2_speed2norm_packet_trimmed10_mean": 0.349408, + "kinetic_energy": 0.83636, + "kinetic_flow": 0.7159519999999999, + "kinetic_packet": 0.848128, + "packet_consistency": 0.675792, + "pna_flow": 0.16814400000000002, + "pna_packet_max": 0.51328, + "pna_packet_mean": 0.35149600000000003, + "pna_packet_median": 0.33528800000000003, + "pna_packet_trimmed10_mean": 0.349408, + "terminal_flow": 0.885792, + "terminal_norm": 0.906176, + "terminal_packet": 0.846328, + "velocity_flow": 0.726424, + "velocity_flow_t01": 0.709672, + "velocity_flow_t03": 0.705872, + "velocity_flow_t05": 0.7045359999999999, + "velocity_flow_t07": 0.7367760000000001, + "velocity_flow_t09": 0.748304, + "velocity_flow_t10": 0.749872, + "velocity_packet": 0.68248, + "velocity_packet_t01": 0.530664, + "velocity_packet_t03": 0.6008239999999999, + "velocity_packet_t05": 0.6468079999999999, + "velocity_packet_t07": 0.66088, + "velocity_packet_t09": 0.660048, + "velocity_packet_t10": 0.724552, + "velocity_total": 0.76312, + "velocity_total_t01": 0.66272, + "velocity_total_t03": 0.708584, + "velocity_total_t05": 0.735208, + "velocity_total_t07": 0.774856, + "velocity_total_t09": 0.7837839999999999, + "velocity_total_t10": 0.79976 + }, + "mirai-udpplain": { + "_n": 8.0, + "arc_length": 0.8784750000000001, + "causal_surprisal_flow": 0.2447, + "causal_surprisal_packet_max": 0.6163500000000001, + "causal_surprisal_packet_mean": 0.66075, + "causal_surprisal_packet_median": 0.786675, + "causal_surprisal_packet_trimmed10_mean": 0.687775, + "causal_surprisal_total": 0.26105, + "consistency_total": 0.7996000000000001, + "curvature_flow": 0.08922499999999998, + "curvature_packet": 0.86985, + "curvature_total": 0.379125, + "direction_drift_flow": 0.26625, + "direction_drift_packet_max": 0.689225, + "direction_drift_packet_mean": 0.650125, + "direction_drift_packet_median": 0.58815, + "direction_drift_packet_trimmed10_mean": 0.63715, + "direction_drift_total": 0.56215, + "flow_consistency": 0.8162750000000001, + "jacobian_flow": 0.281825, + "jacobian_packet": 0.6266750000000001, + "jacobian_total": 0.454475, + "kappa2_speed2norm_packet_mean": 0.53095, + "kappa2_speed2norm_packet_median": 0.513275, + "kappa2_speed2norm_packet_trimmed10_mean": 0.517075, + "kinetic_energy": 0.8740500000000001, + "kinetic_flow": 0.6625, + "kinetic_packet": 0.8313999999999999, + "packet_consistency": 0.7035250000000001, + "pna_flow": 0.11800000000000001, + "pna_packet_max": 0.5802499999999999, + "pna_packet_mean": 0.53095, + "pna_packet_median": 0.513275, + "pna_packet_trimmed10_mean": 0.517075, + "terminal_flow": 0.90025, + "terminal_norm": 0.906975, + "terminal_packet": 0.81275, + "velocity_flow": 0.742175, + "velocity_flow_t01": 0.7223, + "velocity_flow_t03": 0.719825, + "velocity_flow_t05": 0.7164999999999999, + "velocity_flow_t07": 0.723, + "velocity_flow_t09": 0.7938, + "velocity_flow_t10": 0.8004, + "velocity_packet": 0.634525, + "velocity_packet_t01": 0.421825, + "velocity_packet_t03": 0.483375, + "velocity_packet_t05": 0.5440999999999999, + "velocity_packet_t07": 0.607525, + "velocity_packet_t09": 0.713325, + "velocity_packet_t10": 0.7709250000000001, + "velocity_total": 0.829275, + "velocity_total_t01": 0.6856, + "velocity_total_t03": 0.731025, + "velocity_total_t05": 0.7579, + "velocity_total_t07": 0.8167, + "velocity_total_t09": 0.8356, + "velocity_total_t10": 0.83405 + }, + "mitm-arpspoofing": { + "_n": 137.0, + "arc_length": 0.8182715328467154, + "causal_surprisal_flow": 0.23006569343065694, + "causal_surprisal_packet_max": 0.5416875912408758, + "causal_surprisal_packet_mean": 0.5310919708029197, + "causal_surprisal_packet_median": 0.5464233576642336, + "causal_surprisal_packet_trimmed10_mean": 0.5242598540145986, + "causal_surprisal_total": 0.23444087591240875, + "consistency_total": 0.6358671532846716, + "curvature_flow": 0.19963795620437955, + "curvature_packet": 0.6627386861313869, + "curvature_total": 0.36843503649635034, + "direction_drift_flow": 0.36138248175182475, + "direction_drift_packet_max": 0.5467328467153285, + "direction_drift_packet_mean": 0.5059824817518248, + "direction_drift_packet_median": 0.4957459854014599, + "direction_drift_packet_trimmed10_mean": 0.5076481751824817, + "direction_drift_total": 0.3961970802919708, + "flow_consistency": 0.6547751824817518, + "jacobian_flow": 0.3715839416058394, + "jacobian_packet": 0.5712277372262773, + "jacobian_total": 0.459880291970803, + "kappa2_speed2norm_packet_mean": 0.45603722627737225, + "kappa2_speed2norm_packet_median": 0.4698934306569343, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4677678832116787, + "kinetic_energy": 0.816105109489051, + "kinetic_flow": 0.6867795620437956, + "kinetic_packet": 0.7975321167883211, + "packet_consistency": 0.5314861313868613, + "pna_flow": 0.26154306569343067, + "pna_packet_max": 0.46644598540145993, + "pna_packet_mean": 0.45603722627737225, + "pna_packet_median": 0.4698934306569343, + "pna_packet_trimmed10_mean": 0.4677678832116787, + "terminal_flow": 0.8373795620437957, + "terminal_norm": 0.8480262773722628, + "terminal_packet": 0.7869357664233575, + "velocity_flow": 0.6452058394160585, + "velocity_flow_t01": 0.6298204379562043, + "velocity_flow_t03": 0.6291656934306569, + "velocity_flow_t05": 0.6330788321167884, + "velocity_flow_t07": 0.6553328467153284, + "velocity_flow_t09": 0.6847591240875912, + "velocity_flow_t10": 0.622, + "velocity_packet": 0.5304671532846715, + "velocity_packet_t01": 0.4094306569343066, + "velocity_packet_t03": 0.43167591240875913, + "velocity_packet_t05": 0.46477518248175187, + "velocity_packet_t07": 0.5070233576642336, + "velocity_packet_t09": 0.540814598540146, + "velocity_packet_t10": 0.600556204379562, + "velocity_total": 0.6774773722627738, + "velocity_total_t01": 0.5792408759124088, + "velocity_total_t03": 0.5930963503649636, + "velocity_total_t05": 0.6334773722627738, + "velocity_total_t07": 0.6895591240875912, + "velocity_total_t09": 0.7348817518248175, + "velocity_total_t10": 0.7027167883211679 + }, + "recon-hostdiscovery": { + "_n": 163.0, + "arc_length": 0.8443116564417179, + "causal_surprisal_flow": 0.4420269938650307, + "causal_surprisal_packet_max": 0.5335116564417178, + "causal_surprisal_packet_mean": 0.6048269938650306, + "causal_surprisal_packet_median": 0.7240503067484662, + "causal_surprisal_packet_trimmed10_mean": 0.6478871165644172, + "causal_surprisal_total": 0.4620662576687117, + "consistency_total": 0.6831263803680981, + "curvature_flow": 0.1742319018404908, + "curvature_packet": 0.7375030674846625, + "curvature_total": 0.29047055214723927, + "direction_drift_flow": 0.4874638036809816, + "direction_drift_packet_max": 0.5899582822085889, + "direction_drift_packet_mean": 0.6306920245398773, + "direction_drift_packet_median": 0.6229742331288344, + "direction_drift_packet_trimmed10_mean": 0.6479349693251533, + "direction_drift_total": 0.5127901840490797, + "flow_consistency": 0.6844674846625767, + "jacobian_flow": 0.49999509202453984, + "jacobian_packet": 0.7875484662576687, + "jacobian_total": 0.6128938650306749, + "kappa2_speed2norm_packet_mean": 0.4433539877300613, + "kappa2_speed2norm_packet_median": 0.45359018404907975, + "kappa2_speed2norm_packet_trimmed10_mean": 0.46683435582822086, + "kinetic_energy": 0.8432220858895706, + "kinetic_flow": 0.5363361963190184, + "kinetic_packet": 0.8342539877300613, + "packet_consistency": 0.5612306748466258, + "pna_flow": 0.23008220858895706, + "pna_packet_max": 0.420879754601227, + "pna_packet_mean": 0.4433539877300613, + "pna_packet_median": 0.45359018404907975, + "pna_packet_trimmed10_mean": 0.46683435582822086, + "terminal_flow": 0.7849361963190185, + "terminal_norm": 0.8507239263803681, + "terminal_packet": 0.8334122699386503, + "velocity_flow": 0.5300257668711656, + "velocity_flow_t01": 0.5003717791411043, + "velocity_flow_t03": 0.500239263803681, + "velocity_flow_t05": 0.5107987730061349, + "velocity_flow_t07": 0.5202147239263804, + "velocity_flow_t09": 0.6401104294478527, + "velocity_flow_t10": 0.6500159509202453, + "velocity_packet": 0.5087619631901841, + "velocity_packet_t01": 0.29532638036809816, + "velocity_packet_t03": 0.3021472392638037, + "velocity_packet_t05": 0.3485435582822086, + "velocity_packet_t07": 0.46123190184049073, + "velocity_packet_t09": 0.6140527607361962, + "velocity_packet_t10": 0.6843693251533742, + "velocity_total": 0.6892736196319018, + "velocity_total_t01": 0.49657300613496935, + "velocity_total_t03": 0.5120981595092025, + "velocity_total_t05": 0.5319815950920246, + "velocity_total_t07": 0.6679067484662576, + "velocity_total_t09": 0.7154368098159509, + "velocity_total_t10": 0.7452932515337424 + }, + "recon-osscan": { + "_n": 352.0, + "arc_length": 0.8799420454545456, + "causal_surprisal_flow": 0.5592903409090909, + "causal_surprisal_packet_max": 0.5703107954545454, + "causal_surprisal_packet_mean": 0.629378409090909, + "causal_surprisal_packet_median": 0.7858125, + "causal_surprisal_packet_trimmed10_mean": 0.6619997159090909, + "causal_surprisal_total": 0.5722943181818182, + "consistency_total": 0.7944357954545453, + "curvature_flow": 0.08926193181818182, + "curvature_packet": 0.81185, + "curvature_total": 0.16820227272727273, + "direction_drift_flow": 0.4098315340909091, + "direction_drift_packet_max": 0.6078392045454546, + "direction_drift_packet_mean": 0.6579176136363637, + "direction_drift_packet_median": 0.6557744318181817, + "direction_drift_packet_trimmed10_mean": 0.6739397727272727, + "direction_drift_total": 0.47050142045454546, + "flow_consistency": 0.8113261363636363, + "jacobian_flow": 0.44219659090909086, + "jacobian_packet": 0.7936818181818182, + "jacobian_total": 0.5936633522727273, + "kappa2_speed2norm_packet_mean": 0.4172457386363636, + "kappa2_speed2norm_packet_median": 0.43267840909090904, + "kappa2_speed2norm_packet_trimmed10_mean": 0.43418124999999996, + "kinetic_energy": 0.8786295454545455, + "kinetic_flow": 0.6140454545454546, + "kinetic_packet": 0.8910085227272727, + "packet_consistency": 0.6093829545454547, + "pna_flow": 0.1069340909090909, + "pna_packet_max": 0.4277727272727273, + "pna_packet_mean": 0.4172457386363636, + "pna_packet_median": 0.43267840909090904, + "pna_packet_trimmed10_mean": 0.43418124999999996, + "terminal_flow": 0.8765414772727272, + "terminal_norm": 0.9137801136363637, + "terminal_packet": 0.8918113636363637, + "velocity_flow": 0.5870409090909091, + "velocity_flow_t01": 0.5452079545454546, + "velocity_flow_t03": 0.5476789772727273, + "velocity_flow_t05": 0.5647971590909091, + "velocity_flow_t07": 0.5844525568181819, + "velocity_flow_t09": 0.75396875, + "velocity_flow_t10": 0.7487267045454544, + "velocity_packet": 0.5504017045454546, + "velocity_packet_t01": 0.24831874999999998, + "velocity_packet_t03": 0.2542034090909091, + "velocity_packet_t05": 0.3293295454545454, + "velocity_packet_t07": 0.48568437500000006, + "velocity_packet_t09": 0.6984653409090908, + "velocity_packet_t10": 0.8003875, + "velocity_total": 0.7821857954545455, + "velocity_total_t01": 0.5441056818181819, + "velocity_total_t03": 0.5596818181818182, + "velocity_total_t05": 0.5829971590909091, + "velocity_total_t07": 0.7694875, + "velocity_total_t09": 0.8330426136363636, + "velocity_total_t10": 0.8613170454545453 + }, + "recon-pingsweep": { + "_n": 4.0, + "arc_length": 0.71445, + "causal_surprisal_flow": 0.5259999999999999, + "causal_surprisal_packet_max": 0.66225, + "causal_surprisal_packet_mean": 0.63395, + "causal_surprisal_packet_median": 0.623, + "causal_surprisal_packet_trimmed10_mean": 0.60865, + "causal_surprisal_total": 0.5457000000000001, + "consistency_total": 0.6880999999999999, + "curvature_flow": 0.07934999999999998, + "curvature_packet": 0.5434, + "curvature_total": 0.18300000000000002, + "direction_drift_flow": 0.34130000000000005, + "direction_drift_packet_max": 0.49174999999999996, + "direction_drift_packet_mean": 0.4977, + "direction_drift_packet_median": 0.4899, + "direction_drift_packet_trimmed10_mean": 0.4828, + "direction_drift_total": 0.45925000000000005, + "flow_consistency": 0.72295, + "jacobian_flow": 0.43475, + "jacobian_packet": 0.4692, + "jacobian_total": 0.48035, + "kappa2_speed2norm_packet_mean": 0.44665, + "kappa2_speed2norm_packet_median": 0.41035, + "kappa2_speed2norm_packet_trimmed10_mean": 0.41764999999999997, + "kinetic_energy": 0.7073499999999999, + "kinetic_flow": 0.54195, + "kinetic_packet": 0.7835, + "packet_consistency": 0.47625, + "pna_flow": 0.11595, + "pna_packet_max": 0.47739999999999994, + "pna_packet_mean": 0.44665, + "pna_packet_median": 0.41035, + "pna_packet_trimmed10_mean": 0.41764999999999997, + "terminal_flow": 0.8884, + "terminal_norm": 0.8525499999999999, + "terminal_packet": 0.8069999999999999, + "velocity_flow": 0.67205, + "velocity_flow_t01": 0.56845, + "velocity_flow_t03": 0.5662999999999999, + "velocity_flow_t05": 0.58175, + "velocity_flow_t07": 0.6295000000000001, + "velocity_flow_t09": 0.69665, + "velocity_flow_t10": 0.7251, + "velocity_packet": 0.4508, + "velocity_packet_t01": 0.50705, + "velocity_packet_t03": 0.4157, + "velocity_packet_t05": 0.38165, + "velocity_packet_t07": 0.3852, + "velocity_packet_t09": 0.4626, + "velocity_packet_t10": 0.536, + "velocity_total": 0.6134999999999999, + "velocity_total_t01": 0.49955, + "velocity_total_t03": 0.49735, + "velocity_total_t05": 0.497, + "velocity_total_t07": 0.5369, + "velocity_total_t09": 0.76575, + "velocity_total_t10": 0.8169000000000001 + }, + "recon-portscan": { + "_n": 385.0, + "arc_length": 0.9035028571428572, + "causal_surprisal_flow": 0.5785506493506494, + "causal_surprisal_packet_max": 0.5719994805194806, + "causal_surprisal_packet_mean": 0.6396607792207791, + "causal_surprisal_packet_median": 0.8202374025974026, + "causal_surprisal_packet_trimmed10_mean": 0.682337142857143, + "causal_surprisal_total": 0.5925418181818183, + "consistency_total": 0.8207584415584417, + "curvature_flow": 0.0635116883116883, + "curvature_packet": 0.8440207792207792, + "curvature_total": 0.14817506493506494, + "direction_drift_flow": 0.41738961038961037, + "direction_drift_packet_max": 0.6359537662337662, + "direction_drift_packet_mean": 0.6869833766233766, + "direction_drift_packet_median": 0.6846379220779221, + "direction_drift_packet_trimmed10_mean": 0.7043745454545455, + "direction_drift_total": 0.4771581818181818, + "flow_consistency": 0.8379516883116882, + "jacobian_flow": 0.4377446753246753, + "jacobian_packet": 0.8352062337662338, + "jacobian_total": 0.5834698701298701, + "kappa2_speed2norm_packet_mean": 0.4035862337662338, + "kappa2_speed2norm_packet_median": 0.42192155844155843, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4251366233766234, + "kinetic_energy": 0.9024046753246753, + "kinetic_flow": 0.6215657142857143, + "kinetic_packet": 0.9124571428571429, + "packet_consistency": 0.6158327272727273, + "pna_flow": 0.07876415584415584, + "pna_packet_max": 0.41805870129870126, + "pna_packet_mean": 0.4035862337662338, + "pna_packet_median": 0.42192155844155843, + "pna_packet_trimmed10_mean": 0.4251366233766234, + "terminal_flow": 0.8860727272727273, + "terminal_norm": 0.9300181818181817, + "terminal_packet": 0.9140748051948052, + "velocity_flow": 0.5748597402597403, + "velocity_flow_t01": 0.5343958441558442, + "velocity_flow_t03": 0.5351023376623376, + "velocity_flow_t05": 0.5538192207792207, + "velocity_flow_t07": 0.5704607792207792, + "velocity_flow_t09": 0.7763901298701298, + "velocity_flow_t10": 0.7817854545454543, + "velocity_packet": 0.5556857142857143, + "velocity_packet_t01": 0.216387012987013, + "velocity_packet_t03": 0.2218420779220779, + "velocity_packet_t05": 0.30690545454545454, + "velocity_packet_t07": 0.4852877922077922, + "velocity_packet_t09": 0.7326612987012987, + "velocity_packet_t10": 0.8429225974025975, + "velocity_total": 0.8166049350649349, + "velocity_total_t01": 0.5438477922077922, + "velocity_total_t03": 0.5545589610389611, + "velocity_total_t05": 0.5879864935064935, + "velocity_total_t07": 0.7962348051948053, + "velocity_total_t09": 0.8632025974025974, + "velocity_total_t10": 0.9039740259740261 + }, + "sqlinjection": { + "_n": 11.0, + "arc_length": 0.5483818181818182, + "causal_surprisal_flow": 0.5484363636363635, + "causal_surprisal_packet_max": 0.7419090909090909, + "causal_surprisal_packet_mean": 0.6908727272727273, + "causal_surprisal_packet_median": 0.6121272727272727, + "causal_surprisal_packet_trimmed10_mean": 0.6193272727272727, + "causal_surprisal_total": 0.45061818181818186, + "consistency_total": 0.7429636363636364, + "curvature_flow": 0.1826, + "curvature_packet": 0.6000181818181818, + "curvature_total": 0.2765454545454546, + "direction_drift_flow": 0.34392727272727275, + "direction_drift_packet_max": 0.6780363636363637, + "direction_drift_packet_mean": 0.5736, + "direction_drift_packet_median": 0.5386363636363636, + "direction_drift_packet_trimmed10_mean": 0.5522363636363636, + "direction_drift_total": 0.6036, + "flow_consistency": 0.7518545454545453, + "jacobian_flow": 0.26627272727272727, + "jacobian_packet": 0.3742727272727272, + "jacobian_total": 0.34294545454545455, + "kappa2_speed2norm_packet_mean": 0.4425636363636363, + "kappa2_speed2norm_packet_median": 0.46345454545454545, + "kappa2_speed2norm_packet_trimmed10_mean": 0.43876363636363636, + "kinetic_energy": 0.5409272727272727, + "kinetic_flow": 0.6774, + "kinetic_packet": 0.6814727272727272, + "packet_consistency": 0.6799818181818181, + "pna_flow": 0.20061818181818183, + "pna_packet_max": 0.4545272727272728, + "pna_packet_mean": 0.4425636363636363, + "pna_packet_median": 0.46345454545454545, + "pna_packet_trimmed10_mean": 0.43876363636363636, + "terminal_flow": 0.8726909090909092, + "terminal_norm": 0.7855454545454545, + "terminal_packet": 0.7155090909090909, + "velocity_flow": 0.7050000000000001, + "velocity_flow_t01": 0.6579454545454545, + "velocity_flow_t03": 0.6596363636363636, + "velocity_flow_t05": 0.6639272727272727, + "velocity_flow_t07": 0.6984909090909089, + "velocity_flow_t09": 0.7200181818181818, + "velocity_flow_t10": 0.7081818181818181, + "velocity_packet": 0.6717272727272727, + "velocity_packet_t01": 0.6912727272727273, + "velocity_packet_t03": 0.6924545454545454, + "velocity_packet_t05": 0.6836181818181818, + "velocity_packet_t07": 0.644109090909091, + "velocity_packet_t09": 0.631, + "velocity_packet_t10": 0.6676727272727272, + "velocity_total": 0.6482363636363636, + "velocity_total_t01": 0.6697090909090909, + "velocity_total_t03": 0.6608181818181819, + "velocity_total_t05": 0.6475636363636363, + "velocity_total_t07": 0.6305272727272727, + "velocity_total_t09": 0.653490909090909, + "velocity_total_t10": 0.6729090909090909 + }, + "uploading_attack": { + "_n": 2.0, + "arc_length": 0.6282, + "causal_surprisal_flow": 0.060399999999999954, + "causal_surprisal_packet_max": 0.7615000000000001, + "causal_surprisal_packet_mean": 0.6454, + "causal_surprisal_packet_median": 0.6277, + "causal_surprisal_packet_trimmed10_mean": 0.689, + "causal_surprisal_total": 0.043999999999999984, + "consistency_total": 0.8611000000000001, + "curvature_flow": 0.031799999999999995, + "curvature_packet": 0.8544999999999999, + "curvature_total": 0.4234, + "direction_drift_flow": 0.1184, + "direction_drift_packet_max": 0.7196, + "direction_drift_packet_mean": 0.705, + "direction_drift_packet_median": 0.7818, + "direction_drift_packet_trimmed10_mean": 0.7274, + "direction_drift_total": 0.6345000000000001, + "flow_consistency": 0.7558, + "jacobian_flow": 0.059, + "jacobian_packet": 0.2858, + "jacobian_total": 0.15350000000000003, + "kappa2_speed2norm_packet_mean": 0.7008, + "kappa2_speed2norm_packet_median": 0.7561, + "kappa2_speed2norm_packet_trimmed10_mean": 0.7418, + "kinetic_energy": 0.6204000000000001, + "kinetic_flow": 0.8972, + "kinetic_packet": 0.7716, + "packet_consistency": 0.9365999999999999, + "pna_flow": 0.04260000000000003, + "pna_packet_max": 0.6944, + "pna_packet_mean": 0.7008, + "pna_packet_median": 0.7561, + "pna_packet_trimmed10_mean": 0.7418, + "terminal_flow": 0.8903000000000001, + "terminal_norm": 0.7519999999999999, + "terminal_packet": 0.7167, + "velocity_flow": 0.8946000000000001, + "velocity_flow_t01": 0.8930000000000001, + "velocity_flow_t03": 0.8953, + "velocity_flow_t05": 0.8942000000000001, + "velocity_flow_t07": 0.8950999999999999, + "velocity_flow_t09": 0.894, + "velocity_flow_t10": 0.8906999999999999, + "velocity_packet": 0.8598, + "velocity_packet_t01": 0.7594000000000001, + "velocity_packet_t03": 0.7945, + "velocity_packet_t05": 0.8241, + "velocity_packet_t07": 0.8805000000000001, + "velocity_packet_t09": 0.882, + "velocity_packet_t10": 0.8489, + "velocity_total": 0.7913, + "velocity_total_t01": 0.7884, + "velocity_total_t03": 0.7861, + "velocity_total_t05": 0.7790999999999999, + "velocity_total_t07": 0.8023, + "velocity_total_t09": 0.8447, + "velocity_total_t10": 0.8536000000000001 + }, + "vulnerabilityscan": { + "_n": 567.0, + "arc_length": 0.7055622574955909, + "causal_surprisal_flow": 0.5133647266313932, + "causal_surprisal_packet_max": 0.5548539682539682, + "causal_surprisal_packet_mean": 0.5792920634920635, + "causal_surprisal_packet_median": 0.6811432098765432, + "causal_surprisal_packet_trimmed10_mean": 0.596831040564374, + "causal_surprisal_total": 0.5215624338624338, + "consistency_total": 0.6669823633156967, + "curvature_flow": 0.22993403880070545, + "curvature_packet": 0.6704003527336861, + "curvature_total": 0.29056331569664906, + "direction_drift_flow": 0.4440308641975308, + "direction_drift_packet_max": 0.563679012345679, + "direction_drift_packet_mean": 0.5812352733686066, + "direction_drift_packet_median": 0.5747693121693122, + "direction_drift_packet_trimmed10_mean": 0.5851573192239858, + "direction_drift_total": 0.487289241622575, + "flow_consistency": 0.6837061728395062, + "jacobian_flow": 0.44562892416225747, + "jacobian_packet": 0.6342462081128748, + "jacobian_total": 0.5114871252204586, + "kappa2_speed2norm_packet_mean": 0.4934943562610229, + "kappa2_speed2norm_packet_median": 0.4990857142857143, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4975848324514991, + "kinetic_energy": 0.7036335097001764, + "kinetic_flow": 0.5751255731922398, + "kinetic_packet": 0.7238084656084656, + "packet_consistency": 0.5405174603174603, + "pna_flow": 0.2537830687830688, + "pna_packet_max": 0.49140599647266314, + "pna_packet_mean": 0.4934943562610229, + "pna_packet_median": 0.4990857142857143, + "pna_packet_trimmed10_mean": 0.4975848324514991, + "terminal_flow": 0.7623668430335097, + "terminal_norm": 0.7604589065255732, + "terminal_packet": 0.7293361552028219, + "velocity_flow": 0.5549613756613756, + "velocity_flow_t01": 0.5175594356261022, + "velocity_flow_t03": 0.5144680776014109, + "velocity_flow_t05": 0.5241467372134039, + "velocity_flow_t07": 0.5473827160493827, + "velocity_flow_t09": 0.6506095238095237, + "velocity_flow_t10": 0.6493336860670195, + "velocity_packet": 0.5241488536155203, + "velocity_packet_t01": 0.39545890652557314, + "velocity_packet_t03": 0.39923192239858907, + "velocity_packet_t05": 0.4315283950617284, + "velocity_packet_t07": 0.49564268077601414, + "velocity_packet_t09": 0.5850197530864197, + "velocity_packet_t10": 0.6357837742504409, + "velocity_total": 0.6532652557319223, + "velocity_total_t01": 0.5416469135802469, + "velocity_total_t03": 0.5412216931216931, + "velocity_total_t05": 0.5525100529100528, + "velocity_total_t07": 0.6376902998236331, + "velocity_total_t09": 0.6906860670194003, + "velocity_total_t10": 0.7137008818342152 + }, + "xss": { + "_n": 12.0, + "arc_length": 0.7566499999999999, + "causal_surprisal_flow": 0.20204999999999998, + "causal_surprisal_packet_max": 0.61165, + "causal_surprisal_packet_mean": 0.5881333333333334, + "causal_surprisal_packet_median": 0.6206833333333334, + "causal_surprisal_packet_trimmed10_mean": 0.58115, + "causal_surprisal_total": 0.25453333333333333, + "consistency_total": 0.6312666666666668, + "curvature_flow": 0.12853333333333333, + "curvature_packet": 0.7010666666666666, + "curvature_total": 0.38134999999999997, + "direction_drift_flow": 0.30888333333333334, + "direction_drift_packet_max": 0.6320666666666667, + "direction_drift_packet_mean": 0.5144833333333333, + "direction_drift_packet_median": 0.5145666666666667, + "direction_drift_packet_trimmed10_mean": 0.5052, + "direction_drift_total": 0.43535, + "flow_consistency": 0.6110833333333333, + "jacobian_flow": 0.3107833333333333, + "jacobian_packet": 0.4574499999999999, + "jacobian_total": 0.3876666666666667, + "kappa2_speed2norm_packet_mean": 0.5500166666666667, + "kappa2_speed2norm_packet_median": 0.5513583333333334, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5322, + "kinetic_energy": 0.7527333333333334, + "kinetic_flow": 0.7863666666666667, + "kinetic_packet": 0.7375166666666667, + "packet_consistency": 0.6567833333333333, + "pna_flow": 0.2085, + "pna_packet_max": 0.6339166666666667, + "pna_packet_mean": 0.5500166666666667, + "pna_packet_median": 0.5513583333333334, + "pna_packet_trimmed10_mean": 0.5322, + "terminal_flow": 0.8576666666666667, + "terminal_norm": 0.8002333333333334, + "terminal_packet": 0.7087666666666667, + "velocity_flow": 0.7031166666666666, + "velocity_flow_t01": 0.7089333333333334, + "velocity_flow_t03": 0.7032166666666666, + "velocity_flow_t05": 0.6982166666666667, + "velocity_flow_t07": 0.70155, + "velocity_flow_t09": 0.7065166666666667, + "velocity_flow_t10": 0.6830666666666666, + "velocity_packet": 0.6129333333333334, + "velocity_packet_t01": 0.5149666666666667, + "velocity_packet_t03": 0.5488833333333334, + "velocity_packet_t05": 0.5904166666666667, + "velocity_packet_t07": 0.63125, + "velocity_packet_t09": 0.6011333333333333, + "velocity_packet_t10": 0.6119833333333333, + "velocity_total": 0.70045, + "velocity_total_t01": 0.6609666666666667, + "velocity_total_t03": 0.6825000000000001, + "velocity_total_t05": 0.6837, + "velocity_total_t07": 0.70275, + "velocity_total_t09": 0.7405666666666666, + "velocity_total_t10": 0.7049666666666666 + } + }, + "classes": [ + "backdoor_malware", + "browserhijacking", + "commandinjection", + "ddos-ack_fragmentation", + "ddos-http_flood", + "ddos-icmp_flood", + "ddos-icmp_fragmentation", + "ddos-pshack_flood", + "ddos-rstfinflood", + "ddos-slowloris", + "ddos-syn_flood", + "ddos-synonymousip_flood", + "ddos-tcp_flood", + "ddos-udp_flood", + "ddos-udp_fragmentation", + "dictionarybruteforce", + "dns_spoofing", + "dos-http_flood", + "dos-syn_flood", + "dos-tcp_flood", + "dos-udp_flood", + "mirai-greeth_flood", + "mirai-greip_flood", + "mirai-udpplain", + "mitm-arpspoofing", + "recon-hostdiscovery", + "recon-osscan", + "recon-pingsweep", + "recon-portscan", + "sqlinjection", + "uploading_attack", + "vulnerabilityscan", + "xss" + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/config.yaml b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/config.yaml new file mode 100644 index 0000000..70be26c --- /dev/null +++ b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/config.yaml @@ -0,0 +1,37 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 44 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features_spectral.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_flow: 0.3 +lambda_packet: 0.3 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +packet_mask_ratio: 0.5 +packet_preprocess: mixed_dequant +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44 +seed: 44 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/history.json b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/history.json new file mode 100644 index 0000000..e1d73af --- /dev/null +++ b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/history.json @@ -0,0 +1,243 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 2.4961540423906765, + 2.1768155495325723, + 1.9340730538735023, + 1.7437882576233301, + 1.58461389480493, + 1.502570662743006, + 1.3984988836141734, + 1.3477420317821014, + 1.3081341034326799, + 1.2861155026998274, + 1.244910506101755, + 1.2066846596889007, + 1.1772568883040013, + 1.1562001200822682, + 1.1414412535153902, + 1.11942674104984, + 1.1145884501628387, + 1.110061268011729, + 1.0889992194297986, + 1.094079104753641, + 1.0880212065501091, + 1.0632610458594103, + 1.0621276620106819, + 1.059438630556449, + 1.0446719557811053, + 1.0394633656893022, + 1.030307840078305, + 1.0136121419759898, + 1.0252030476545677, + 1.009239531480349, + 1.0127309209261186, + 0.9991048268782787, + 0.9912692980888562, + 1.0052880094601557, + 0.9959790202287527, + 0.9959266415009131, + 0.9912711901542468, + 0.9909359919719207, + 0.986128324117416, + 0.9788765892004355, + 0.9754712887299366, + 0.9815681148798038, + 0.977269016779386, + 0.9758520921071371, + 0.9732384452453027, + 0.9797460880035009, + 0.9767938225697248, + 0.9763845174740522, + 0.9781083113107926, + 0.9713934980905973 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.3903861475, + "auroc_curvature_flow": 0.08158634000000001, + "auroc_curvature_packet": 0.32604988749999997, + "auroc_curvature_total": 0.1080981175, + "auroc_kappa2_speed2norm_packet_mean": 0.19625299499999999, + "auroc_kappa2_speed2norm_packet_median": 0.22718660000000002, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.19057978250000002, + "auroc_kinetic_energy": 0.389535655, + "auroc_kinetic_flow": 0.2981401525, + "auroc_kinetic_packet": 0.5721048725, + "auroc_terminal_flow": 0.8809260274999998, + "auroc_terminal_norm": 0.9216132875, + "auroc_terminal_packet": 0.886717975, + "auroc_velocity_flow": 0.5030130500000001, + "auroc_velocity_packet": 0.23908011499999998, + "auroc_velocity_total": 0.33131623 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.7786082550000001, + "auroc_curvature_flow": 0.0683291675, + "auroc_curvature_packet": 0.115638795, + "auroc_curvature_total": 0.06468051, + "auroc_kappa2_speed2norm_packet_mean": 0.0811801925, + "auroc_kappa2_speed2norm_packet_median": 0.08403726749999998, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.082787975, + "auroc_kinetic_energy": 0.7472070524999999, + "auroc_kinetic_flow": 0.6383665924999999, + "auroc_kinetic_packet": 0.8446483225000001, + "auroc_terminal_flow": 0.90521684, + "auroc_terminal_norm": 0.952704075, + "auroc_terminal_packet": 0.905126795, + "auroc_velocity_flow": 0.809379465, + "auroc_velocity_packet": 0.629003215, + "auroc_velocity_total": 0.8467663025000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.7973434650000001, + "auroc_curvature_flow": 0.06548493250000001, + "auroc_curvature_packet": 0.5260178849999999, + "auroc_curvature_total": 0.08444468499999999, + "auroc_kappa2_speed2norm_packet_mean": 0.2666302425, + "auroc_kappa2_speed2norm_packet_median": 0.27213530750000003, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.2593833575, + "auroc_kinetic_energy": 0.7857158725000001, + "auroc_kinetic_flow": 0.6763558725000001, + "auroc_kinetic_packet": 0.8384802675, + "auroc_terminal_flow": 0.9142258499999999, + "auroc_terminal_norm": 0.95532824, + "auroc_terminal_packet": 0.8717630850000001, + "auroc_velocity_flow": 0.7797104699999999, + "auroc_velocity_packet": 0.7806864375, + "auroc_velocity_total": 0.8728445725 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.8907370375000001, + "auroc_curvature_flow": 0.059499579999999996, + "auroc_curvature_packet": 0.7460739550000001, + "auroc_curvature_total": 0.10046826749999999, + "auroc_kappa2_speed2norm_packet_mean": 0.1667819925, + "auroc_kappa2_speed2norm_packet_median": 0.1705457675, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.1618944025, + "auroc_kinetic_energy": 0.8854571125, + "auroc_kinetic_flow": 0.73376285, + "auroc_kinetic_packet": 0.9228976350000001, + "auroc_terminal_flow": 0.920364525, + "auroc_terminal_norm": 0.9605609949999999, + "auroc_terminal_packet": 0.9167675550000001, + "auroc_velocity_flow": 0.7697896225, + "auroc_velocity_packet": 0.799260685, + "auroc_velocity_total": 0.87750605 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_arc_length": 0.9051324350000001, + "auroc_curvature_flow": 0.0587619125, + "auroc_curvature_packet": 0.8151358175, + "auroc_curvature_total": 0.11792413000000002, + "auroc_kappa2_speed2norm_packet_mean": 0.2395314925, + "auroc_kappa2_speed2norm_packet_median": 0.24040084250000002, + "auroc_kappa2_speed2norm_packet_trimmed10_mean": 0.2299926175, + "auroc_kinetic_energy": 0.9002758774999999, + "auroc_kinetic_flow": 0.7702606399999999, + "auroc_kinetic_packet": 0.9308315325, + "auroc_terminal_flow": 0.919042685, + "auroc_terminal_norm": 0.961097565, + "auroc_terminal_packet": 0.9259743775, + "auroc_velocity_flow": 0.7716350874999999, + "auroc_velocity_packet": 0.7982609825, + "auroc_velocity_total": 0.878552535 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/model.pt b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/model.pt new file mode 100644 index 0000000..aade85f Binary files /dev/null and b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/model.pt differ diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/phase1.log b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/phase1.log new file mode 100644 index 0000000..2f5a614 --- /dev/null +++ b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/phase1.log @@ -0,0 +1,132 @@ +[config] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/config.yaml +[model] T=64 flow_dim=52 packet_dim=9 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets_source=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] using external flow features D=52 +[data] rows total=8,193,621 keep len>=2: 3,797,530 +[data] benign=97,045 attack=20,000 -> train=77,636 val=10,000 +[data] train=77,636 val=10,000 attack=20,000 +[eval] scoring val=5,000 and attack=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done in 12.1s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] attack done in 22.6s +[eval] score keys: 57 first 5: ['arc_length', 'causal_surprisal_flow', 'causal_surprisal_packet_max', 'causal_surprisal_packet_mean', 'causal_surprisal_packet_median'] +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/phase1_summary.json +[saved] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/phase1_scores.npz + +=== overall AUROC (sorted desc) === + terminal_norm AUROC=0.9602 AUPRC=0.9801 + kinetic_packet AUROC=0.9249 AUPRC=0.9594 + terminal_packet AUROC=0.9223 AUPRC=0.9586 + terminal_flow AUROC=0.9218 AUPRC=0.9394 + arc_length AUROC=0.9067 AUPRC=0.9477 + kinetic_energy AUROC=0.9031 AUPRC=0.9460 + velocity_total_t10 AUROC=0.9026 AUPRC=0.9335 + velocity_total_t09 AUROC=0.8892 AUPRC=0.9157 + velocity_packet_t10 AUROC=0.8760 AUPRC=0.9404 + velocity_total AUROC=0.8744 AUPRC=0.9072 + velocity_total_t07 AUROC=0.8654 AUPRC=0.8973 + velocity_packet_t09 AUROC=0.8350 AUPRC=0.9002 + causal_surprisal_packet_mean AUROC=0.8256 AUPRC=0.9073 + velocity_flow_t09 AUROC=0.8201 AUPRC=0.8258 + velocity_flow_t10 AUROC=0.8175 AUPRC=0.8239 + velocity_total_t05 AUROC=0.7964 AUPRC=0.8528 + consistency_total AUROC=0.7952 AUPRC=0.8599 + velocity_packet AUROC=0.7928 AUPRC=0.8750 + velocity_packet_t07 AUROC=0.7820 AUPRC=0.8624 + packet_consistency AUROC=0.7795 AUPRC=0.8418 + velocity_flow AUROC=0.7666 AUPRC=0.8051 + causal_surprisal_packet_max AUROC=0.7664 AUPRC=0.8591 + velocity_flow_t07 AUROC=0.7633 AUPRC=0.8041 + velocity_total_t03 AUROC=0.7617 AUPRC=0.8280 + causal_surprisal_packet_median AUROC=0.7503 AUPRC=0.8622 + causal_surprisal_packet_trimmed10_mean AUROC=0.7488 AUPRC=0.8682 + velocity_flow_t05 AUROC=0.7477 AUPRC=0.7996 + velocity_flow_t03 AUROC=0.7449 AUPRC=0.8015 + velocity_flow_t01 AUROC=0.7448 AUPRC=0.8047 + flow_consistency AUROC=0.7439 AUPRC=0.8346 + velocity_total_t01 AUROC=0.7398 AUPRC=0.8121 + kinetic_flow AUROC=0.7331 AUPRC=0.7863 + velocity_packet_t05 AUROC=0.6884 AUPRC=0.8049 + curvature_packet AUROC=0.6582 AUPRC=0.7548 + jacobian_packet AUROC=0.6312 AUPRC=0.8000 + direction_drift_packet_max AUROC=0.5872 AUPRC=0.6965 + velocity_packet_t03 AUROC=0.5737 AUPRC=0.7252 + velocity_packet_t01 AUROC=0.4946 AUPRC=0.6572 + direction_drift_packet_mean AUROC=0.4900 AUPRC=0.6775 + direction_drift_packet_trimmed10_mean AUROC=0.4599 AUPRC=0.6769 + direction_drift_packet_median AUROC=0.4337 AUPRC=0.6534 + jacobian_total AUROC=0.3930 AUPRC=0.6257 + direction_drift_total AUROC=0.3140 AUPRC=0.5665 + causal_surprisal_total AUROC=0.3125 AUPRC=0.5641 + causal_surprisal_flow AUROC=0.2535 AUPRC=0.5311 + direction_drift_flow AUROC=0.2193 AUPRC=0.5037 + jacobian_flow AUROC=0.2137 AUPRC=0.5089 + pna_packet_max AUROC=0.2111 AUPRC=0.5157 + kappa2_speed2norm_packet_median AUROC=0.1562 AUPRC=0.4935 + pna_packet_median AUROC=0.1562 AUPRC=0.4935 + kappa2_speed2norm_packet_mean AUROC=0.1518 AUPRC=0.4935 + pna_packet_mean AUROC=0.1518 AUPRC=0.4935 + kappa2_speed2norm_packet_trimmed10_mean AUROC=0.1513 AUPRC=0.4933 + pna_packet_trimmed10_mean AUROC=0.1513 AUPRC=0.4933 + curvature_total AUROC=0.0922 AUPRC=0.4674 + pna_flow AUROC=0.0728 AUPRC=0.4630 + curvature_flow AUROC=0.0572 AUPRC=0.4596 diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/phase1_scores.npz b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/phase1_scores.npz new file mode 100644 index 0000000..105bca1 Binary files /dev/null and b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/phase1_summary.json b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/phase1_summary.json new file mode 100644 index 0000000..8603f61 --- /dev/null +++ b/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44/phase1_summary.json @@ -0,0 +1,2292 @@ +{ + "model_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44", + "config": { + "T": 64, + "attack_cap": 20000, + "batch_size": 256, + "benign_label": "normal", + "d_model": 128, + "data_seed": 44, + "device": "auto", + "epochs": 50, + "eval_batch_size": 512, + "eval_every": 10, + "eval_n": 20000, + "eval_n_steps": 8, + "flow_features_align": "auto", + "flow_features_path": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features_spectral.parquet", + "flows_parquet": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet", + "grad_clip": 1.0, + "lambda_flow": 0.3, + "lambda_packet": 0.3, + "lr": 0.0003, + "min_len": 2, + "mlp_ratio": 4.0, + "n_heads": 4, + "n_layers": 4, + "n_train": 10000, + "num_workers": 0, + "packet_mask_ratio": 0.5, + "packet_preprocess": "mixed_dequant", + "save_dir": "/home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_b_spectral_ciciot2023_seed44", + "seed": 44, + "sigma": 0.1, + "source_store": "/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store", + "time_dim": 64, + "token_dim": null, + "train_ratio": 0.8, + "use_ot": true, + "val_cap": 10000, + "weight_decay": 0.01 + }, + "n_val": 5000, + "n_atk": 10000, + "n_score_keys": 57, + "overall": { + "arc_length": { + "auroc": 0.90665419, + "auprc": 0.947707471654812 + }, + "causal_surprisal_flow": { + "auroc": 0.25354400000000005, + "auprc": 0.5311042218668938 + }, + "causal_surprisal_packet_max": { + "auroc": 0.76635169, + "auprc": 0.8590825121255402 + }, + "causal_surprisal_packet_mean": { + "auroc": 0.82555577, + "auprc": 0.9072730236032447 + }, + "causal_surprisal_packet_median": { + "auroc": 0.7503251, + "auprc": 0.862208811730839 + }, + "causal_surprisal_packet_trimmed10_mean": { + "auroc": 0.74881806, + "auprc": 0.86821693175041 + }, + "causal_surprisal_total": { + "auroc": 0.3124855, + "auprc": 0.564094385728062 + }, + "consistency_total": { + "auroc": 0.79523563, + "auprc": 0.859886451583171 + }, + "curvature_flow": { + "auroc": 0.05718508, + "auprc": 0.4595947367213169 + }, + "curvature_packet": { + "auroc": 0.6582388899999999, + "auprc": 0.7548275953563655 + }, + "curvature_total": { + "auroc": 0.09224311999999998, + "auprc": 0.4674373507143684 + }, + "direction_drift_flow": { + "auroc": 0.21933973, + "auprc": 0.5037160957801321 + }, + "direction_drift_packet_max": { + "auroc": 0.58716354, + "auprc": 0.696459874051284 + }, + "direction_drift_packet_mean": { + "auroc": 0.48995699, + "auprc": 0.6775182884981508 + }, + "direction_drift_packet_median": { + "auroc": 0.43370529, + "auprc": 0.6533545631741142 + }, + "direction_drift_packet_trimmed10_mean": { + "auroc": 0.45992494000000006, + "auprc": 0.6769248065741247 + }, + "direction_drift_total": { + "auroc": 0.31404795, + "auprc": 0.5664865968186017 + }, + "flow_consistency": { + "auroc": 0.7438744399999999, + "auprc": 0.8345989533058676 + }, + "jacobian_flow": { + "auroc": 0.21373894000000002, + "auprc": 0.5089300369884443 + }, + "jacobian_packet": { + "auroc": 0.63120588, + "auprc": 0.8000176896330289 + }, + "jacobian_total": { + "auroc": 0.39299242, + "auprc": 0.6257148547994669 + }, + "kappa2_speed2norm_packet_mean": { + "auroc": 0.15179963, + "auprc": 0.4935077070155788 + }, + "kappa2_speed2norm_packet_median": { + "auroc": 0.1562248, + "auprc": 0.4935481597217469 + }, + "kappa2_speed2norm_packet_trimmed10_mean": { + "auroc": 0.15130407, + "auprc": 0.49333106149220524 + }, + "kinetic_energy": { + "auroc": 0.9031206999999999, + "auprc": 0.9459506862143696 + }, + "kinetic_flow": { + "auroc": 0.73311413, + "auprc": 0.7862920107536614 + }, + "kinetic_packet": { + "auroc": 0.9249356500000001, + "auprc": 0.9593785085346878 + }, + "packet_consistency": { + "auroc": 0.7795033, + "auprc": 0.8418031512244164 + }, + "pna_flow": { + "auroc": 0.07284513000000001, + "auprc": 0.46301405803020856 + }, + "pna_packet_max": { + "auroc": 0.21109521999999997, + "auprc": 0.515680058064795 + }, + "pna_packet_mean": { + "auroc": 0.15179963, + "auprc": 0.4935077070155788 + }, + "pna_packet_median": { + "auroc": 0.1562248, + "auprc": 0.4935481597217469 + }, + "pna_packet_trimmed10_mean": { + "auroc": 0.15130407, + "auprc": 0.49333106149220524 + }, + "terminal_flow": { + "auroc": 0.9217844500000001, + "auprc": 0.9393673960936424 + }, + "terminal_norm": { + "auroc": 0.9602109499999999, + "auprc": 0.9801215781749298 + }, + "terminal_packet": { + "auroc": 0.92233951, + "auprc": 0.9585721545803558 + }, + "velocity_flow": { + "auroc": 0.7666109000000001, + "auprc": 0.8051097260487191 + }, + "velocity_flow_t01": { + "auroc": 0.74483193, + "auprc": 0.80466111940016 + }, + "velocity_flow_t03": { + "auroc": 0.74486501, + "auprc": 0.8015063321550628 + }, + "velocity_flow_t05": { + "auroc": 0.74770637, + "auprc": 0.7995955631190417 + }, + "velocity_flow_t07": { + "auroc": 0.7632833200000001, + "auprc": 0.8041461617865013 + }, + "velocity_flow_t09": { + "auroc": 0.82005006, + "auprc": 0.8258109660167013 + }, + "velocity_flow_t10": { + "auroc": 0.81751799, + "auprc": 0.8238981312667082 + }, + "velocity_packet": { + "auroc": 0.79277778, + "auprc": 0.8750000681434434 + }, + "velocity_packet_t01": { + "auroc": 0.49458553, + "auprc": 0.6572344820955628 + }, + "velocity_packet_t03": { + "auroc": 0.5737400100000001, + "auprc": 0.7251622275411751 + }, + "velocity_packet_t05": { + "auroc": 0.68844795, + "auprc": 0.8048831096668627 + }, + "velocity_packet_t07": { + "auroc": 0.7819891600000001, + "auprc": 0.86242637438954 + }, + "velocity_packet_t09": { + "auroc": 0.83497949, + "auprc": 0.9002381818227201 + }, + "velocity_packet_t10": { + "auroc": 0.87599898, + "auprc": 0.940409421562902 + }, + "velocity_total": { + "auroc": 0.87441749, + "auprc": 0.9072123425567009 + }, + "velocity_total_t01": { + "auroc": 0.73979079, + "auprc": 0.8120523471403641 + }, + "velocity_total_t03": { + "auroc": 0.7617314399999999, + "auprc": 0.8279800302659963 + }, + "velocity_total_t05": { + "auroc": 0.79638498, + "auprc": 0.8527951354086035 + }, + "velocity_total_t07": { + "auroc": 0.8654439599999999, + "auprc": 0.8973255580789545 + }, + "velocity_total_t09": { + "auroc": 0.88920198, + "auprc": 0.9156955424661093 + }, + "velocity_total_t10": { + "auroc": 0.9026309499999998, + "auprc": 0.9334612087600014 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 7.0, + "arc_length": 0.8076285714285715, + "causal_surprisal_flow": 0.23791428571428572, + "causal_surprisal_packet_max": 0.38719999999999993, + "causal_surprisal_packet_mean": 0.4403714285714285, + "causal_surprisal_packet_median": 0.6165714285714285, + "causal_surprisal_packet_trimmed10_mean": 0.4729428571428571, + "causal_surprisal_total": 0.27114285714285713, + "consistency_total": 0.7230857142857143, + "curvature_flow": 0.15045714285714284, + "curvature_packet": 0.4689428571428571, + "curvature_total": 0.13325714285714285, + "direction_drift_flow": 0.4053428571428571, + "direction_drift_packet_max": 0.3119142857142857, + "direction_drift_packet_mean": 0.28577142857142857, + "direction_drift_packet_median": 0.29345714285714286, + "direction_drift_packet_trimmed10_mean": 0.2554285714285714, + "direction_drift_total": 0.21019999999999997, + "flow_consistency": 0.7521428571428571, + "jacobian_flow": 0.4678, + "jacobian_packet": 0.4999142857142857, + "jacobian_total": 0.4784, + "kappa2_speed2norm_packet_mean": 0.2126, + "kappa2_speed2norm_packet_median": 0.20225714285714286, + "kappa2_speed2norm_packet_trimmed10_mean": 0.20162857142857138, + "kinetic_energy": 0.7978571428571428, + "kinetic_flow": 0.5688571428571428, + "kinetic_packet": 0.8270571428571428, + "packet_consistency": 0.5768571428571428, + "pna_flow": 0.18137142857142857, + "pna_packet_max": 0.2714, + "pna_packet_mean": 0.2126, + "pna_packet_median": 0.20225714285714286, + "pna_packet_trimmed10_mean": 0.20162857142857138, + "terminal_flow": 0.8876285714285713, + "terminal_norm": 0.9375142857142856, + "terminal_packet": 0.8486, + "velocity_flow": 0.6159428571428571, + "velocity_flow_t01": 0.5702, + "velocity_flow_t03": 0.5724571428571429, + "velocity_flow_t05": 0.5833428571428572, + "velocity_flow_t07": 0.6009142857142857, + "velocity_flow_t09": 0.6833142857142857, + "velocity_flow_t10": 0.6669142857142858, + "velocity_packet": 0.701, + "velocity_packet_t01": 0.4606285714285715, + "velocity_packet_t03": 0.5146857142857143, + "velocity_packet_t05": 0.5666857142857142, + "velocity_packet_t07": 0.6755142857142857, + "velocity_packet_t09": 0.8180285714285714, + "velocity_packet_t10": 0.8070857142857142, + "velocity_total": 0.7298285714285714, + "velocity_total_t01": 0.5616285714285714, + "velocity_total_t03": 0.5724857142857143, + "velocity_total_t05": 0.6267428571428572, + "velocity_total_t07": 0.7288, + "velocity_total_t09": 0.8482857142857142, + "velocity_total_t10": 0.8206857142857142 + }, + "browserhijacking": { + "_n": 9.0, + "arc_length": 0.667, + "causal_surprisal_flow": 0.34131111111111107, + "causal_surprisal_packet_max": 0.6591555555555555, + "causal_surprisal_packet_mean": 0.6671111111111111, + "causal_surprisal_packet_median": 0.5567555555555556, + "causal_surprisal_packet_trimmed10_mean": 0.5568222222222221, + "causal_surprisal_total": 0.24580000000000002, + "consistency_total": 0.6946, + "curvature_flow": 0.34528888888888887, + "curvature_packet": 0.5081777777777777, + "curvature_total": 0.35373333333333334, + "direction_drift_flow": 0.2680444444444444, + "direction_drift_packet_max": 0.6488666666666667, + "direction_drift_packet_mean": 0.48897777777777773, + "direction_drift_packet_median": 0.5054888888888889, + "direction_drift_packet_trimmed10_mean": 0.48673333333333335, + "direction_drift_total": 0.4619777777777778, + "flow_consistency": 0.6880000000000001, + "jacobian_flow": 0.32891111111111115, + "jacobian_packet": 0.48364444444444443, + "jacobian_total": 0.45862222222222215, + "kappa2_speed2norm_packet_mean": 0.26997777777777776, + "kappa2_speed2norm_packet_median": 0.2645777777777778, + "kappa2_speed2norm_packet_trimmed10_mean": 0.28779999999999994, + "kinetic_energy": 0.6621777777777778, + "kinetic_flow": 0.7395111111111111, + "kinetic_packet": 0.6859777777777777, + "packet_consistency": 0.722488888888889, + "pna_flow": 0.31733333333333336, + "pna_packet_max": 0.3751777777777778, + "pna_packet_mean": 0.26997777777777776, + "pna_packet_median": 0.2645777777777778, + "pna_packet_trimmed10_mean": 0.28779999999999994, + "terminal_flow": 0.7656888888888889, + "terminal_norm": 0.7949555555555555, + "terminal_packet": 0.7283111111111111, + "velocity_flow": 0.6688000000000001, + "velocity_flow_t01": 0.6707333333333333, + "velocity_flow_t03": 0.6676888888888889, + "velocity_flow_t05": 0.6697555555555554, + "velocity_flow_t07": 0.6751333333333334, + "velocity_flow_t09": 0.7107777777777777, + "velocity_flow_t10": 0.6667555555555555, + "velocity_packet": 0.6809333333333334, + "velocity_packet_t01": 0.5836666666666667, + "velocity_packet_t03": 0.590911111111111, + "velocity_packet_t05": 0.6040666666666666, + "velocity_packet_t07": 0.6720444444444444, + "velocity_packet_t09": 0.6830222222222222, + "velocity_packet_t10": 0.6557777777777778, + "velocity_total": 0.6546, + "velocity_total_t01": 0.5633999999999999, + "velocity_total_t03": 0.6040000000000001, + "velocity_total_t05": 0.6113111111111111, + "velocity_total_t07": 0.6951333333333334, + "velocity_total_t09": 0.6903111111111111, + "velocity_total_t10": 0.6439555555555555 + }, + "commandinjection": { + "_n": 11.0, + "arc_length": 0.6465090909090909, + "causal_surprisal_flow": 0.31585454545454544, + "causal_surprisal_packet_max": 0.6145090909090909, + "causal_surprisal_packet_mean": 0.6233454545454545, + "causal_surprisal_packet_median": 0.5450545454545455, + "causal_surprisal_packet_trimmed10_mean": 0.5661454545454545, + "causal_surprisal_total": 0.2094, + "consistency_total": 0.741, + "curvature_flow": 0.1392909090909091, + "curvature_packet": 0.8249909090909091, + "curvature_total": 0.2692, + "direction_drift_flow": 0.24530909090909092, + "direction_drift_packet_max": 0.6376909090909091, + "direction_drift_packet_mean": 0.5562363636363636, + "direction_drift_packet_median": 0.5267272727272727, + "direction_drift_packet_trimmed10_mean": 0.5446909090909091, + "direction_drift_total": 0.4348727272727273, + "flow_consistency": 0.6999818181818181, + "jacobian_flow": 0.2685272727272727, + "jacobian_packet": 0.2393090909090909, + "jacobian_total": 0.2521090909090909, + "kappa2_speed2norm_packet_mean": 0.6272727272727272, + "kappa2_speed2norm_packet_median": 0.6385272727272727, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6175272727272728, + "kinetic_energy": 0.6389090909090909, + "kinetic_flow": 0.6257454545454545, + "kinetic_packet": 0.7390181818181818, + "packet_consistency": 0.6743272727272727, + "pna_flow": 0.16165454545454544, + "pna_packet_max": 0.7489818181818182, + "pna_packet_mean": 0.6272727272727272, + "pna_packet_median": 0.6385272727272727, + "pna_packet_trimmed10_mean": 0.6175272727272728, + "terminal_flow": 0.9055818181818183, + "terminal_norm": 0.8796, + "terminal_packet": 0.7359636363636364, + "velocity_flow": 0.7354181818181817, + "velocity_flow_t01": 0.7187454545454545, + "velocity_flow_t03": 0.7185272727272727, + "velocity_flow_t05": 0.7236363636363636, + "velocity_flow_t07": 0.7402545454545455, + "velocity_flow_t09": 0.7333636363636363, + "velocity_flow_t10": 0.7302, + "velocity_packet": 0.7112181818181819, + "velocity_packet_t01": 0.5893636363636363, + "velocity_packet_t03": 0.6442909090909091, + "velocity_packet_t05": 0.6962909090909092, + "velocity_packet_t07": 0.7104545454545454, + "velocity_packet_t09": 0.7249818181818182, + "velocity_packet_t10": 0.6532909090909091, + "velocity_total": 0.7308363636363636, + "velocity_total_t01": 0.6872181818181818, + "velocity_total_t03": 0.708690909090909, + "velocity_total_t05": 0.7154363636363636, + "velocity_total_t07": 0.7523090909090909, + "velocity_total_t09": 0.7909818181818182, + "velocity_total_t10": 0.7794545454545453 + }, + "ddos-ack_fragmentation": { + "_n": 340.0, + "arc_length": 0.9777458823529414, + "causal_surprisal_flow": 0.1259588235294118, + "causal_surprisal_packet_max": 0.38452705882352944, + "causal_surprisal_packet_mean": 0.5282658823529411, + "causal_surprisal_packet_median": 0.7916623529411764, + "causal_surprisal_packet_trimmed10_mean": 0.6523441176470588, + "causal_surprisal_total": 0.23657999999999998, + "consistency_total": 0.9188970588235293, + "curvature_flow": 0.029309999999999996, + "curvature_packet": 0.8714308823529411, + "curvature_total": 0.05735294117647059, + "direction_drift_flow": 0.1691735294117647, + "direction_drift_packet_max": 0.44677470588235296, + "direction_drift_packet_mean": 0.47301029411764706, + "direction_drift_packet_median": 0.4934123529411766, + "direction_drift_packet_trimmed10_mean": 0.49094000000000004, + "direction_drift_total": 0.10485529411764706, + "flow_consistency": 0.7417111764705883, + "jacobian_flow": 0.1323464705882353, + "jacobian_packet": 0.8093311764705883, + "jacobian_total": 0.25620588235294117, + "kappa2_speed2norm_packet_mean": 0.03925294117647059, + "kappa2_speed2norm_packet_median": 0.04180352941176471, + "kappa2_speed2norm_packet_trimmed10_mean": 0.04075764705882352, + "kinetic_energy": 0.9772582352941177, + "kinetic_flow": 0.7837341176470589, + "kinetic_packet": 0.9803576470588236, + "packet_consistency": 0.9604217647058825, + "pna_flow": 0.04687176470588235, + "pna_packet_max": 0.07523529411764707, + "pna_packet_mean": 0.03925294117647059, + "pna_packet_median": 0.04180352941176471, + "pna_packet_trimmed10_mean": 0.04075764705882352, + "terminal_flow": 0.9645900000000001, + "terminal_norm": 0.9871041176470589, + "terminal_packet": 0.9801770588235293, + "velocity_flow": 0.837514705882353, + "velocity_flow_t01": 0.8464282352941177, + "velocity_flow_t03": 0.8450535294117648, + "velocity_flow_t05": 0.8406600000000001, + "velocity_flow_t07": 0.8379111764705882, + "velocity_flow_t09": 0.8307376470588235, + "velocity_flow_t10": 0.8278594117647059, + "velocity_packet": 0.9723600000000001, + "velocity_packet_t01": 0.8429570588235294, + "velocity_packet_t03": 0.9370405882352942, + "velocity_packet_t05": 0.9586835294117646, + "velocity_packet_t07": 0.9684788235294117, + "velocity_packet_t09": 0.9682817647058823, + "velocity_packet_t10": 0.978525294117647, + "velocity_total": 0.9767294117647058, + "velocity_total_t01": 0.970395294117647, + "velocity_total_t03": 0.9725417647058824, + "velocity_total_t05": 0.9749635294117647, + "velocity_total_t07": 0.975755294117647, + "velocity_total_t09": 0.9735052941176471, + "velocity_total_t10": 0.9742894117647058 + }, + "ddos-http_flood": { + "_n": 893.0, + "arc_length": 0.8986721164613662, + "causal_surprisal_flow": 0.5359126539753639, + "causal_surprisal_packet_max": 0.8979254199328107, + "causal_surprisal_packet_mean": 0.9424223964165733, + "causal_surprisal_packet_median": 0.8868568868980963, + "causal_surprisal_packet_trimmed10_mean": 0.9084960806270996, + "causal_surprisal_total": 0.6102777155655096, + "consistency_total": 0.8752015677491601, + "curvature_flow": 0.03779843225083986, + "curvature_packet": 0.8411332586786114, + "curvature_total": 0.11952004479283314, + "direction_drift_flow": 0.2845758118701008, + "direction_drift_packet_max": 0.6039840985442329, + "direction_drift_packet_mean": 0.6423397536394176, + "direction_drift_packet_median": 0.6154479283314669, + "direction_drift_packet_trimmed10_mean": 0.6370701007838746, + "direction_drift_total": 0.4390432250839866, + "flow_consistency": 0.8468020156774915, + "jacobian_flow": 0.29925442329227325, + "jacobian_packet": 0.7415414333706607, + "jacobian_total": 0.5586107502799552, + "kappa2_speed2norm_packet_mean": 0.26142060470324746, + "kappa2_speed2norm_packet_median": 0.28224759238521835, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2648313549832027, + "kinetic_energy": 0.8930864501679731, + "kinetic_flow": 0.6786185890257559, + "kinetic_packet": 0.9403599104143336, + "packet_consistency": 0.7651619260918253, + "pna_flow": 0.060430907054871225, + "pna_packet_max": 0.31293325867861144, + "pna_packet_mean": 0.26142060470324746, + "pna_packet_median": 0.28224759238521835, + "pna_packet_trimmed10_mean": 0.2648313549832027, + "terminal_flow": 0.9243357222844345, + "terminal_norm": 0.9833081746920492, + "terminal_packet": 0.9539110862262038, + "velocity_flow": 0.7077594624860023, + "velocity_flow_t01": 0.6712535274356104, + "velocity_flow_t03": 0.6738002239641656, + "velocity_flow_t05": 0.6755919372900336, + "velocity_flow_t07": 0.701171556550952, + "velocity_flow_t09": 0.8334078387458007, + "velocity_flow_t10": 0.8326459126539753, + "velocity_packet": 0.6950548712206047, + "velocity_packet_t01": 0.33650795072788353, + "velocity_packet_t03": 0.3934326987681971, + "velocity_packet_t05": 0.5262541993281075, + "velocity_packet_t07": 0.6825478163493841, + "velocity_packet_t09": 0.7389023516237403, + "velocity_packet_t10": 0.8261156774916013, + "velocity_total": 0.8785941769316911, + "velocity_total_t01": 0.6177229563269876, + "velocity_total_t03": 0.6681232922732363, + "velocity_total_t05": 0.7350452407614783, + "velocity_total_t07": 0.8725592385218365, + "velocity_total_t09": 0.8912098544232923, + "velocity_total_t10": 0.9150400895856663 + }, + "ddos-icmp_flood": { + "_n": 20.0, + "arc_length": 0.61591, + "causal_surprisal_flow": 0.51723, + "causal_surprisal_packet_max": 0.60211, + "causal_surprisal_packet_mean": 0.59273, + "causal_surprisal_packet_median": 0.55424, + "causal_surprisal_packet_trimmed10_mean": 0.5753699999999999, + "causal_surprisal_total": 0.45780000000000004, + "consistency_total": 0.65035, + "curvature_flow": 0.34281999999999996, + "curvature_packet": 0.6312399999999999, + "curvature_total": 0.39688999999999997, + "direction_drift_flow": 0.42594, + "direction_drift_packet_max": 0.59745, + "direction_drift_packet_mean": 0.60124, + "direction_drift_packet_median": 0.6059800000000001, + "direction_drift_packet_trimmed10_mean": 0.60998, + "direction_drift_total": 0.5626199999999999, + "flow_consistency": 0.67113, + "jacobian_flow": 0.4785499999999999, + "jacobian_packet": 0.47889, + "jacobian_total": 0.51285, + "kappa2_speed2norm_packet_mean": 0.55768, + "kappa2_speed2norm_packet_median": 0.56493, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5653, + "kinetic_energy": 0.61381, + "kinetic_flow": 0.55203, + "kinetic_packet": 0.67146, + "packet_consistency": 0.6078100000000001, + "pna_flow": 0.3614800000000001, + "pna_packet_max": 0.5495300000000001, + "pna_packet_mean": 0.55768, + "pna_packet_median": 0.56493, + "pna_packet_trimmed10_mean": 0.5653, + "terminal_flow": 0.71139, + "terminal_norm": 0.72758, + "terminal_packet": 0.69607, + "velocity_flow": 0.59609, + "velocity_flow_t01": 0.58795, + "velocity_flow_t03": 0.58949, + "velocity_flow_t05": 0.59375, + "velocity_flow_t07": 0.59526, + "velocity_flow_t09": 0.61621, + "velocity_flow_t10": 0.5893600000000001, + "velocity_packet": 0.55668, + "velocity_packet_t01": 0.5055500000000002, + "velocity_packet_t03": 0.51747, + "velocity_packet_t05": 0.5533899999999999, + "velocity_packet_t07": 0.5735, + "velocity_packet_t09": 0.56217, + "velocity_packet_t10": 0.529435, + "velocity_total": 0.6138699999999999, + "velocity_total_t01": 0.55229, + "velocity_total_t03": 0.5568399999999999, + "velocity_total_t05": 0.5776200000000001, + "velocity_total_t07": 0.60577, + "velocity_total_t09": 0.6223700000000001, + "velocity_total_t10": 0.58027 + }, + "ddos-icmp_fragmentation": { + "_n": 35.0, + "arc_length": 0.7083257142857143, + "causal_surprisal_flow": 0.37961142857142854, + "causal_surprisal_packet_max": 0.5090399999999999, + "causal_surprisal_packet_mean": 0.5214799999999999, + "causal_surprisal_packet_median": 0.5678171428571428, + "causal_surprisal_packet_trimmed10_mean": 0.5282571428571429, + "causal_surprisal_total": 0.3699257142857143, + "consistency_total": 0.6568171428571429, + "curvature_flow": 0.17358857142857143, + "curvature_packet": 0.6427228571428572, + "curvature_total": 0.24628, + "direction_drift_flow": 0.35964, + "direction_drift_packet_max": 0.5416742857142857, + "direction_drift_packet_mean": 0.5360971428571428, + "direction_drift_packet_median": 0.5284285714285715, + "direction_drift_packet_trimmed10_mean": 0.5451028571428571, + "direction_drift_total": 0.40952000000000005, + "flow_consistency": 0.6860228571428572, + "jacobian_flow": 0.3916114285714286, + "jacobian_packet": 0.5199199999999999, + "jacobian_total": 0.41677142857142857, + "kappa2_speed2norm_packet_mean": 0.5025371428571429, + "kappa2_speed2norm_packet_median": 0.5015714285714286, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5160685714285714, + "kinetic_energy": 0.7044171428571429, + "kinetic_flow": 0.49069142857142856, + "kinetic_packet": 0.7674628571428572, + "packet_consistency": 0.5636285714285715, + "pna_flow": 0.22044, + "pna_packet_max": 0.5160742857142857, + "pna_packet_mean": 0.5025371428571429, + "pna_packet_median": 0.5015714285714286, + "pna_packet_trimmed10_mean": 0.5160685714285714, + "terminal_flow": 0.8764971428571429, + "terminal_norm": 0.8883028571428572, + "terminal_packet": 0.7786857142857143, + "velocity_flow": 0.60448, + "velocity_flow_t01": 0.5588971428571428, + "velocity_flow_t03": 0.5609257142857142, + "velocity_flow_t05": 0.5656971428571429, + "velocity_flow_t07": 0.5856114285714286, + "velocity_flow_t09": 0.6000057142857143, + "velocity_flow_t10": 0.6092628571428571, + "velocity_packet": 0.5549200000000001, + "velocity_packet_t01": 0.46546285714285707, + "velocity_packet_t03": 0.4821885714285714, + "velocity_packet_t05": 0.5143028571428571, + "velocity_packet_t07": 0.5917657142857142, + "velocity_packet_t09": 0.5823828571428571, + "velocity_packet_t10": 0.5239428571428572, + "velocity_total": 0.6367371428571429, + "velocity_total_t01": 0.5556742857142857, + "velocity_total_t03": 0.5657771428571429, + "velocity_total_t05": 0.5845485714285714, + "velocity_total_t07": 0.6309828571428572, + "velocity_total_t09": 0.66584, + "velocity_total_t10": 0.6725885714285714 + }, + "ddos-pshack_flood": { + "_n": 1065.0, + "arc_length": 0.9754105164319249, + "causal_surprisal_flow": 0.03169295774647887, + "causal_surprisal_packet_max": 0.8156957746478873, + "causal_surprisal_packet_mean": 0.890433427230047, + "causal_surprisal_packet_median": 0.7297653521126761, + "causal_surprisal_packet_trimmed10_mean": 0.7970756807511736, + "causal_surprisal_total": 0.11873971830985916, + "consistency_total": 0.7010388732394366, + "curvature_flow": 0.00852826291079812, + "curvature_packet": 0.6041879812206572, + "curvature_total": 0.020896150234741787, + "direction_drift_flow": 0.11371765258215963, + "direction_drift_packet_max": 0.48209201877934277, + "direction_drift_packet_mean": 0.31616187793427225, + "direction_drift_packet_median": 0.23255530516431927, + "direction_drift_packet_trimmed10_mean": 0.24673352112676056, + "direction_drift_total": 0.09491117370892019, + "flow_consistency": 0.5914169953051642, + "jacobian_flow": 0.07515511737089202, + "jacobian_packet": 0.6468035680751174, + "jacobian_total": 0.2957722065727699, + "kappa2_speed2norm_packet_mean": 0.001407511737089194, + "kappa2_speed2norm_packet_median": 0.001829107981220659, + "kappa2_speed2norm_packet_trimmed10_mean": 0.0011611267605633672, + "kinetic_energy": 0.9721994366197183, + "kinetic_flow": 0.812145821596244, + "kinetic_packet": 0.9692306103286386, + "packet_consistency": 0.8708007511737088, + "pna_flow": 0.01703117370892019, + "pna_packet_max": 0.016740281690140843, + "pna_packet_mean": 0.001407511737089194, + "pna_packet_median": 0.001829107981220659, + "pna_packet_trimmed10_mean": 0.0011611267605633672, + "terminal_flow": 0.950791737089202, + "terminal_norm": 0.9918711737089202, + "terminal_packet": 0.9640854460093897, + "velocity_flow": 0.8718195305164318, + "velocity_flow_t01": 0.8471536150234742, + "velocity_flow_t03": 0.8424698591549296, + "velocity_flow_t05": 0.8459106103286385, + "velocity_flow_t07": 0.8705975586854461, + "velocity_flow_t09": 0.8660261032863851, + "velocity_flow_t10": 0.8628550234741784, + "velocity_packet": 0.9332901408450706, + "velocity_packet_t01": 0.5844336150234741, + "velocity_packet_t03": 0.6543396244131457, + "velocity_packet_t05": 0.841010234741784, + "velocity_packet_t07": 0.9030537089201879, + "velocity_packet_t09": 0.9689699530516431, + "velocity_packet_t10": 0.9985057276995304, + "velocity_total": 0.9469132394366199, + "velocity_total_t01": 0.8981023474178403, + "velocity_total_t03": 0.9033861971830984, + "velocity_total_t05": 0.9052920187793427, + "velocity_total_t07": 0.9099323943661972, + "velocity_total_t09": 0.962254835680751, + "velocity_total_t10": 0.9840935211267605 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "arc_length": 0.9084, + "causal_surprisal_flow": 0.4058, + "causal_surprisal_packet_max": 0.5617, + "causal_surprisal_packet_mean": 0.6203, + "causal_surprisal_packet_median": 0.754, + "causal_surprisal_packet_trimmed10_mean": 0.668, + "causal_surprisal_total": 0.4411, + "consistency_total": 0.7296, + "curvature_flow": 0.16720000000000002, + "curvature_packet": 0.6058, + "curvature_total": 0.2742, + "direction_drift_flow": 0.6055, + "direction_drift_packet_max": 0.6252, + "direction_drift_packet_mean": 0.6289, + "direction_drift_packet_median": 0.5171, + "direction_drift_packet_trimmed10_mean": 0.6315999999999999, + "direction_drift_total": 0.7234, + "flow_consistency": 0.7704999999999999, + "jacobian_flow": 0.5092, + "jacobian_packet": 0.9479, + "jacobian_total": 0.6446000000000001, + "kappa2_speed2norm_packet_mean": 0.3399, + "kappa2_speed2norm_packet_median": 0.2768, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3805, + "kinetic_energy": 0.911, + "kinetic_flow": 0.3436, + "kinetic_packet": 0.9449, + "packet_consistency": 0.5006999999999999, + "pna_flow": 0.33299999999999996, + "pna_packet_max": 0.3292, + "pna_packet_mean": 0.3399, + "pna_packet_median": 0.2768, + "pna_packet_trimmed10_mean": 0.3805, + "terminal_flow": 0.6857, + "terminal_norm": 0.8886999999999999, + "terminal_packet": 0.9424, + "velocity_flow": 0.4225, + "velocity_flow_t01": 0.4616, + "velocity_flow_t03": 0.4573, + "velocity_flow_t05": 0.445, + "velocity_flow_t07": 0.41380000000000006, + "velocity_flow_t09": 0.42500000000000004, + "velocity_flow_t10": 0.42510000000000003, + "velocity_packet": 0.5097, + "velocity_packet_t01": 0.3964, + "velocity_packet_t03": 0.4543, + "velocity_packet_t05": 0.49520000000000003, + "velocity_packet_t07": 0.4991, + "velocity_packet_t09": 0.3698, + "velocity_packet_t10": 0.4855, + "velocity_total": 0.6199999999999999, + "velocity_total_t01": 0.48350000000000004, + "velocity_total_t03": 0.4909, + "velocity_total_t05": 0.5843, + "velocity_total_t07": 0.6242, + "velocity_total_t09": 0.5389999999999999, + "velocity_total_t10": 0.5295 + }, + "ddos-slowloris": { + "_n": 336.0, + "arc_length": 0.6588886904761905, + "causal_surprisal_flow": 0.6045130952380953, + "causal_surprisal_packet_max": 0.7049047619047619, + "causal_surprisal_packet_mean": 0.6594196428571428, + "causal_surprisal_packet_median": 0.6299494047619048, + "causal_surprisal_packet_trimmed10_mean": 0.5896809523809524, + "causal_surprisal_total": 0.46750357142857146, + "consistency_total": 0.8819901785714285, + "curvature_flow": 0.10249583333333334, + "curvature_packet": 0.7881500000000001, + "curvature_total": 0.1834047619047619, + "direction_drift_flow": 0.2146154761904762, + "direction_drift_packet_max": 0.838082738095238, + "direction_drift_packet_mean": 0.7911389880952381, + "direction_drift_packet_median": 0.7509285714285714, + "direction_drift_packet_trimmed10_mean": 0.7751113095238095, + "direction_drift_total": 0.751645238095238, + "flow_consistency": 0.8799714285714285, + "jacobian_flow": 0.18462976190476194, + "jacobian_packet": 0.3976226190476191, + "jacobian_total": 0.30592380952380954, + "kappa2_speed2norm_packet_mean": 0.4896952380952381, + "kappa2_speed2norm_packet_median": 0.45268273809523807, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4445264880952381, + "kinetic_energy": 0.6495714285714286, + "kinetic_flow": 0.690017857142857, + "kinetic_packet": 0.8353767857142859, + "packet_consistency": 0.7796934523809522, + "pna_flow": 0.11888809523809524, + "pna_packet_max": 0.6499869047619048, + "pna_packet_mean": 0.4896952380952381, + "pna_packet_median": 0.45268273809523807, + "pna_packet_trimmed10_mean": 0.4445264880952381, + "terminal_flow": 0.9383315476190477, + "terminal_norm": 0.947952380952381, + "terminal_packet": 0.8825523809523809, + "velocity_flow": 0.7816660714285715, + "velocity_flow_t01": 0.7542309523809524, + "velocity_flow_t03": 0.752535119047619, + "velocity_flow_t05": 0.7553559523809524, + "velocity_flow_t07": 0.7735297619047619, + "velocity_flow_t09": 0.8133470238095238, + "velocity_flow_t10": 0.8245357142857144, + "velocity_packet": 0.633579761904762, + "velocity_packet_t01": 0.6047803571428572, + "velocity_packet_t03": 0.6068916666666667, + "velocity_packet_t05": 0.6071416666666667, + "velocity_packet_t07": 0.5914172619047618, + "velocity_packet_t09": 0.5446726190476191, + "velocity_packet_t10": 0.7290125, + "velocity_total": 0.7393125, + "velocity_total_t01": 0.6357482142857144, + "velocity_total_t03": 0.633807738095238, + "velocity_total_t05": 0.6430077380952381, + "velocity_total_t07": 0.6998392857142858, + "velocity_total_t09": 0.7136675595238096, + "velocity_total_t10": 0.7897458333333333 + }, + "ddos-syn_flood": { + "_n": 1089.0, + "arc_length": 0.9865136822773186, + "causal_surprisal_flow": 0.037341230486685036, + "causal_surprisal_packet_max": 0.8789186409550046, + "causal_surprisal_packet_mean": 0.9441961432506887, + "causal_surprisal_packet_median": 0.8020642791551883, + "causal_surprisal_packet_trimmed10_mean": 0.8287410468319559, + "causal_surprisal_total": 0.1562932966023875, + "consistency_total": 0.7830158861340679, + "curvature_flow": 0.008582001836547278, + "curvature_packet": 0.7017202938475665, + "curvature_total": 0.03204747474747475, + "direction_drift_flow": 0.11740358126721764, + "direction_drift_packet_max": 0.6109896235078054, + "direction_drift_packet_mean": 0.3690488521579431, + "direction_drift_packet_median": 0.20540459136822772, + "direction_drift_packet_trimmed10_mean": 0.24419632690541782, + "direction_drift_total": 0.13525913682277318, + "flow_consistency": 0.6551770431588614, + "jacobian_flow": 0.07157887970615243, + "jacobian_packet": 0.6361770431588613, + "jacobian_total": 0.27919320477502296, + "kappa2_speed2norm_packet_mean": 0.022001652892561986, + "kappa2_speed2norm_packet_median": 0.028360881542699726, + "kappa2_speed2norm_packet_trimmed10_mean": 0.02001836547291093, + "kinetic_energy": 0.9856793388429752, + "kinetic_flow": 0.843337741046832, + "kinetic_packet": 0.9825320477502295, + "packet_consistency": 0.8789851239669421, + "pna_flow": 0.015589715335169885, + "pna_packet_max": 0.05310137741046832, + "pna_packet_mean": 0.022001652892561986, + "pna_packet_median": 0.028360881542699726, + "pna_packet_trimmed10_mean": 0.02001836547291093, + "terminal_flow": 0.9575829201101929, + "terminal_norm": 0.9945933884297521, + "terminal_packet": 0.9774752984389348, + "velocity_flow": 0.871811753902663, + "velocity_flow_t01": 0.8691340679522498, + "velocity_flow_t03": 0.8610721763085399, + "velocity_flow_t05": 0.858421671258035, + "velocity_flow_t07": 0.8713028466483013, + "velocity_flow_t09": 0.8677246097337007, + "velocity_flow_t10": 0.8628162534435261, + "velocity_packet": 0.9263264462809917, + "velocity_packet_t01": 0.5788784205693296, + "velocity_packet_t03": 0.7154050505050504, + "velocity_packet_t05": 0.865442883379247, + "velocity_packet_t07": 0.9240347107438016, + "velocity_packet_t09": 0.9517533516988061, + "velocity_packet_t10": 0.9759928374655648, + "velocity_total": 0.9523452708907255, + "velocity_total_t01": 0.8939506887052342, + "velocity_total_t03": 0.9054168044077135, + "velocity_total_t05": 0.9194105601469239, + "velocity_total_t07": 0.9442323232323231, + "velocity_total_t09": 0.9545873278236916, + "velocity_total_t10": 0.9624945821854913 + }, + "ddos-synonymousip_flood": { + "_n": 191.0, + "arc_length": 0.8667560209424084, + "causal_surprisal_flow": 0.047807329842931935, + "causal_surprisal_packet_max": 0.9887874345549738, + "causal_surprisal_packet_mean": 0.7421895287958115, + "causal_surprisal_packet_median": 0.12596230366492145, + "causal_surprisal_packet_trimmed10_mean": 0.2649759162303665, + "causal_surprisal_total": 0.027131937172774873, + "consistency_total": 0.9973570680628273, + "curvature_flow": 0.0015256544502617586, + "curvature_packet": 0.5187068062827225, + "curvature_total": 0.04183664921465968, + "direction_drift_flow": 0.018052356020942413, + "direction_drift_packet_max": 0.9133193717277488, + "direction_drift_packet_mean": 0.5528722513089006, + "direction_drift_packet_median": 0.47929738219895285, + "direction_drift_packet_trimmed10_mean": 0.5032, + "direction_drift_total": 0.5888188481675393, + "flow_consistency": 0.997413612565445, + "jacobian_flow": 0.005737172774869114, + "jacobian_packet": 0.08430890052356022, + "jacobian_total": 0.11416858638743456, + "kappa2_speed2norm_packet_mean": 0.11715392670157068, + "kappa2_speed2norm_packet_median": 0.11016753926701572, + "kappa2_speed2norm_packet_trimmed10_mean": 0.1032020942408377, + "kinetic_energy": 0.8646240837696335, + "kinetic_flow": 0.8951633507853403, + "kinetic_packet": 0.9677905759162303, + "packet_consistency": 0.9669811518324608, + "pna_flow": 0.0015696335078534023, + "pna_packet_max": 0.4619204188481676, + "pna_packet_mean": 0.11715392670157068, + "pna_packet_median": 0.11016753926701572, + "pna_packet_trimmed10_mean": 0.1032020942408377, + "terminal_flow": 0.9991130890052357, + "terminal_norm": 0.998855497382199, + "terminal_packet": 0.9733078534031413, + "velocity_flow": 0.9064586387434556, + "velocity_flow_t01": 0.9149141361256544, + "velocity_flow_t03": 0.912598952879581, + "velocity_flow_t05": 0.9101853403141361, + "velocity_flow_t07": 0.9070073298429319, + "velocity_flow_t09": 0.9052188481675392, + "velocity_flow_t10": 0.9044020942408377, + "velocity_packet": 0.909469109947644, + "velocity_packet_t01": 0.6214952879581152, + "velocity_packet_t03": 0.8167471204188481, + "velocity_packet_t05": 0.9094041884816754, + "velocity_packet_t07": 0.9160581151832461, + "velocity_packet_t09": 0.8634450261780104, + "velocity_packet_t10": 0.6742575916230367, + "velocity_total": 0.8464628272251309, + "velocity_total_t01": 0.5759465968586388, + "velocity_total_t03": 0.6391989528795812, + "velocity_total_t05": 0.8536900523560209, + "velocity_total_t07": 0.8606376963350786, + "velocity_total_t09": 0.8056031413612565, + "velocity_total_t10": 0.6545015706806283 + }, + "ddos-tcp_flood": { + "_n": 1198.0, + "arc_length": 0.9551312186978298, + "causal_surprisal_flow": 0.029639065108514193, + "causal_surprisal_packet_max": 0.7616168614357263, + "causal_surprisal_packet_mean": 0.8563940734557596, + "causal_surprisal_packet_median": 0.7876931552587646, + "causal_surprisal_packet_trimmed10_mean": 0.8463283806343906, + "causal_surprisal_total": 0.10650601001669449, + "consistency_total": 0.6953766277128548, + "curvature_flow": 0.009021869782971611, + "curvature_packet": 0.43401010016694486, + "curvature_total": 0.0064480801335559295, + "direction_drift_flow": 0.11592963272120199, + "direction_drift_packet_max": 0.4249208681135226, + "direction_drift_packet_mean": 0.16296060100166943, + "direction_drift_packet_median": 0.08644307178631051, + "direction_drift_packet_trimmed10_mean": 0.1534338898163606, + "direction_drift_total": 0.011560767946577637, + "flow_consistency": 0.5696752921535893, + "jacobian_flow": 0.08191803005008347, + "jacobian_packet": 0.5855511686143573, + "jacobian_total": 0.24065375626043406, + "kappa2_speed2norm_packet_mean": 0.0008863105175292043, + "kappa2_speed2norm_packet_median": 0.0008742904841402324, + "kappa2_speed2norm_packet_trimmed10_mean": 0.0009298831385642572, + "kinetic_energy": 0.9494934891485809, + "kinetic_flow": 0.7930055091819699, + "kinetic_packet": 0.93428530884808, + "packet_consistency": 0.846156594323873, + "pna_flow": 0.019652838063439072, + "pna_packet_max": 0.012430217028380632, + "pna_packet_mean": 0.0008863105175292043, + "pna_packet_median": 0.0008742904841402324, + "pna_packet_trimmed10_mean": 0.0009298831385642572, + "terminal_flow": 0.9406525876460768, + "terminal_norm": 0.9815883138564274, + "terminal_packet": 0.8929980801335557, + "velocity_flow": 0.8650315525876462, + "velocity_flow_t01": 0.8275049248747914, + "velocity_flow_t03": 0.8257011686143572, + "velocity_flow_t05": 0.8302818864774624, + "velocity_flow_t07": 0.8644225375626042, + "velocity_flow_t09": 0.8570303839732888, + "velocity_flow_t10": 0.8539272120200334, + "velocity_packet": 0.9733846410684474, + "velocity_packet_t01": 0.6334273789649416, + "velocity_packet_t03": 0.7879365609348915, + "velocity_packet_t05": 0.8938357262103506, + "velocity_packet_t07": 0.9618958263772954, + "velocity_packet_t09": 0.9850066777963271, + "velocity_packet_t10": 0.9994387312186979, + "velocity_total": 0.9785922370617697, + "velocity_total_t01": 0.9123505843071785, + "velocity_total_t03": 0.9251272954924875, + "velocity_total_t05": 0.9459228714524207, + "velocity_total_t07": 0.9715197829716193, + "velocity_total_t09": 0.9824347245409015, + "velocity_total_t10": 0.9877946577629383 + }, + "ddos-udp_flood": { + "_n": 9.0, + "arc_length": 0.8529666666666665, + "causal_surprisal_flow": 0.6347555555555557, + "causal_surprisal_packet_max": 0.7330888888888888, + "causal_surprisal_packet_mean": 0.43428888888888884, + "causal_surprisal_packet_median": 0.24884444444444445, + "causal_surprisal_packet_trimmed10_mean": 0.21793333333333334, + "causal_surprisal_total": 0.26402222222222216, + "consistency_total": 0.7993111111111111, + "curvature_flow": 0.18988888888888888, + "curvature_packet": 0.7535333333333333, + "curvature_total": 0.16935555555555554, + "direction_drift_flow": 0.19024444444444444, + "direction_drift_packet_max": 0.5885777777777778, + "direction_drift_packet_mean": 0.47931111111111113, + "direction_drift_packet_median": 0.48431111111111114, + "direction_drift_packet_trimmed10_mean": 0.4936888888888889, + "direction_drift_total": 0.48773333333333335, + "flow_consistency": 0.8322888888888889, + "jacobian_flow": 0.2895333333333333, + "jacobian_packet": 0.32591111111111115, + "jacobian_total": 0.39293333333333336, + "kappa2_speed2norm_packet_mean": 0.3925333333333333, + "kappa2_speed2norm_packet_median": 0.41962222222222223, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4382, + "kinetic_energy": 0.8518666666666667, + "kinetic_flow": 0.7732888888888889, + "kinetic_packet": 0.8844888888888889, + "packet_consistency": 0.5030666666666667, + "pna_flow": 0.17824444444444443, + "pna_packet_max": 0.4453111111111111, + "pna_packet_mean": 0.3925333333333333, + "pna_packet_median": 0.41962222222222223, + "pna_packet_trimmed10_mean": 0.4382, + "terminal_flow": 0.9524444444444444, + "terminal_norm": 0.9480888888888889, + "terminal_packet": 0.8845111111111111, + "velocity_flow": 0.8116444444444444, + "velocity_flow_t01": 0.7931555555555555, + "velocity_flow_t03": 0.7945333333333333, + "velocity_flow_t05": 0.7958444444444444, + "velocity_flow_t07": 0.8033999999999999, + "velocity_flow_t09": 0.8264666666666665, + "velocity_flow_t10": 0.8270888888888889, + "velocity_packet": 0.48308888888888885, + "velocity_packet_t01": 0.23682222222222224, + "velocity_packet_t03": 0.2427333333333333, + "velocity_packet_t05": 0.3292222222222222, + "velocity_packet_t07": 0.48346666666666666, + "velocity_packet_t09": 0.44226666666666664, + "velocity_packet_t10": 0.4996666666666667, + "velocity_total": 0.5316222222222222, + "velocity_total_t01": 0.4891333333333333, + "velocity_total_t03": 0.4904, + "velocity_total_t05": 0.4975777777777778, + "velocity_total_t07": 0.517511111111111, + "velocity_total_t09": 0.6445555555555555, + "velocity_total_t10": 0.6731111111111112 + }, + "ddos-udp_fragmentation": { + "_n": 22.0, + "arc_length": 0.7096, + "causal_surprisal_flow": 0.2761272727272728, + "causal_surprisal_packet_max": 0.7099272727272727, + "causal_surprisal_packet_mean": 0.6769454545454546, + "causal_surprisal_packet_median": 0.634590909090909, + "causal_surprisal_packet_trimmed10_mean": 0.5987363636363636, + "causal_surprisal_total": 0.2655363636363637, + "consistency_total": 0.7407999999999999, + "curvature_flow": 0.22264545454545454, + "curvature_packet": 0.6583909090909091, + "curvature_total": 0.34167272727272724, + "direction_drift_flow": 0.32329090909090913, + "direction_drift_packet_max": 0.5344, + "direction_drift_packet_mean": 0.44035454545454544, + "direction_drift_packet_median": 0.4382363636363636, + "direction_drift_packet_trimmed10_mean": 0.42219090909090906, + "direction_drift_total": 0.3891818181818182, + "flow_consistency": 0.745, + "jacobian_flow": 0.2756545454545455, + "jacobian_packet": 0.4036909090909091, + "jacobian_total": 0.32230000000000003, + "kappa2_speed2norm_packet_mean": 0.38556363636363644, + "kappa2_speed2norm_packet_median": 0.3946363636363636, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3915909090909091, + "kinetic_energy": 0.7039909090909091, + "kinetic_flow": 0.6867363636363636, + "kinetic_packet": 0.7049818181818182, + "packet_consistency": 0.6743818181818181, + "pna_flow": 0.24769090909090907, + "pna_packet_max": 0.4324545454545454, + "pna_packet_mean": 0.38556363636363644, + "pna_packet_median": 0.3946363636363636, + "pna_packet_trimmed10_mean": 0.3915909090909091, + "terminal_flow": 0.8319727272727273, + "terminal_norm": 0.8010727272727273, + "terminal_packet": 0.6947454545454546, + "velocity_flow": 0.6765272727272726, + "velocity_flow_t01": 0.6914727272727272, + "velocity_flow_t03": 0.6864909090909092, + "velocity_flow_t05": 0.6855818181818182, + "velocity_flow_t07": 0.6873000000000001, + "velocity_flow_t09": 0.6859636363636363, + "velocity_flow_t10": 0.680309090909091, + "velocity_packet": 0.6865454545454546, + "velocity_packet_t01": 0.5337636363636364, + "velocity_packet_t03": 0.5696545454545455, + "velocity_packet_t05": 0.6289727272727272, + "velocity_packet_t07": 0.6920636363636362, + "velocity_packet_t09": 0.7232090909090908, + "velocity_packet_t10": 0.7064818181818182, + "velocity_total": 0.7032727272727273, + "velocity_total_t01": 0.6355363636363637, + "velocity_total_t03": 0.6421454545454546, + "velocity_total_t05": 0.6830181818181817, + "velocity_total_t07": 0.7058818181818182, + "velocity_total_t09": 0.7079636363636364, + "velocity_total_t10": 0.7096727272727272 + }, + "dictionarybruteforce": { + "_n": 20.0, + "arc_length": 0.5999099999999999, + "causal_surprisal_flow": 0.42693, + "causal_surprisal_packet_max": 0.5651900000000001, + "causal_surprisal_packet_mean": 0.44871000000000005, + "causal_surprisal_packet_median": 0.44971, + "causal_surprisal_packet_trimmed10_mean": 0.42141999999999996, + "causal_surprisal_total": 0.30144, + "consistency_total": 0.6626799999999999, + "curvature_flow": 0.29955, + "curvature_packet": 0.55854, + "curvature_total": 0.30771, + "direction_drift_flow": 0.35215, + "direction_drift_packet_max": 0.6027500000000001, + "direction_drift_packet_mean": 0.59425, + "direction_drift_packet_median": 0.598155, + "direction_drift_packet_trimmed10_mean": 0.60789, + "direction_drift_total": 0.55145, + "flow_consistency": 0.67628, + "jacobian_flow": 0.39474, + "jacobian_packet": 0.49049, + "jacobian_total": 0.44735, + "kappa2_speed2norm_packet_mean": 0.44528, + "kappa2_speed2norm_packet_median": 0.4578, + "kappa2_speed2norm_packet_trimmed10_mean": 0.46068, + "kinetic_energy": 0.5940300000000001, + "kinetic_flow": 0.63556, + "kinetic_packet": 0.67575, + "packet_consistency": 0.5424800000000001, + "pna_flow": 0.31624, + "pna_packet_max": 0.49167999999999995, + "pna_packet_mean": 0.44528, + "pna_packet_median": 0.4578, + "pna_packet_trimmed10_mean": 0.46068, + "terminal_flow": 0.83231, + "terminal_norm": 0.81212, + "terminal_packet": 0.70209, + "velocity_flow": 0.64466, + "velocity_flow_t01": 0.5991000000000001, + "velocity_flow_t03": 0.60754, + "velocity_flow_t05": 0.6166699999999999, + "velocity_flow_t07": 0.6445099999999999, + "velocity_flow_t09": 0.66781, + "velocity_flow_t10": 0.6407799999999999, + "velocity_packet": 0.49562, + "velocity_packet_t01": 0.47907999999999995, + "velocity_packet_t03": 0.48382000000000003, + "velocity_packet_t05": 0.49051, + "velocity_packet_t07": 0.44121, + "velocity_packet_t09": 0.46547, + "velocity_packet_t10": 0.58465, + "velocity_total": 0.60539, + "velocity_total_t01": 0.50683, + "velocity_total_t03": 0.52128, + "velocity_total_t05": 0.51997, + "velocity_total_t07": 0.53464, + "velocity_total_t09": 0.65097, + "velocity_total_t10": 0.66209 + }, + "dns_spoofing": { + "_n": 163.0, + "arc_length": 0.7190588957055213, + "causal_surprisal_flow": 0.3377153374233129, + "causal_surprisal_packet_max": 0.6216564417177913, + "causal_surprisal_packet_mean": 0.589440490797546, + "causal_surprisal_packet_median": 0.5644539877300614, + "causal_surprisal_packet_trimmed10_mean": 0.5214257668711657, + "causal_surprisal_total": 0.28933865030674843, + "consistency_total": 0.7335239263803681, + "curvature_flow": 0.21832024539877298, + "curvature_packet": 0.6503760736196319, + "curvature_total": 0.2844858895705521, + "direction_drift_flow": 0.33232147239263804, + "direction_drift_packet_max": 0.5590723926380368, + "direction_drift_packet_mean": 0.47241472392638034, + "direction_drift_packet_median": 0.45186748466257676, + "direction_drift_packet_trimmed10_mean": 0.4643165644171779, + "direction_drift_total": 0.40529079754601227, + "flow_consistency": 0.7125791411042944, + "jacobian_flow": 0.31613742331288347, + "jacobian_packet": 0.47025644171779146, + "jacobian_total": 0.39564049079754604, + "kappa2_speed2norm_packet_mean": 0.3638871165644172, + "kappa2_speed2norm_packet_median": 0.3519435582822086, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3698, + "kinetic_energy": 0.7129656441717791, + "kinetic_flow": 0.6332319018404908, + "kinetic_packet": 0.7446907975460123, + "packet_consistency": 0.6650085889570552, + "pna_flow": 0.2274245398773006, + "pna_packet_max": 0.43352269938650306, + "pna_packet_mean": 0.3638871165644172, + "pna_packet_median": 0.3519435582822086, + "pna_packet_trimmed10_mean": 0.3698, + "terminal_flow": 0.7958441717791411, + "terminal_norm": 0.8152085889570551, + "terminal_packet": 0.7259852760736196, + "velocity_flow": 0.6758122699386504, + "velocity_flow_t01": 0.6491104294478527, + "velocity_flow_t03": 0.6517386503067485, + "velocity_flow_t05": 0.6567865030674848, + "velocity_flow_t07": 0.6707196319018405, + "velocity_flow_t09": 0.6975055214723926, + "velocity_flow_t10": 0.7134098159509201, + "velocity_packet": 0.6477435582822085, + "velocity_packet_t01": 0.5369999999999999, + "velocity_packet_t03": 0.5512453987730062, + "velocity_packet_t05": 0.6063067484662577, + "velocity_packet_t07": 0.6387877300613496, + "velocity_packet_t09": 0.6610184049079754, + "velocity_packet_t10": 0.6880049079754601, + "velocity_total": 0.7084220858895706, + "velocity_total_t01": 0.6140993865030675, + "velocity_total_t03": 0.626560736196319, + "velocity_total_t05": 0.64619754601227, + "velocity_total_t07": 0.7014441717791411, + "velocity_total_t09": 0.7217398773006134, + "velocity_total_t10": 0.7351509202453987 + }, + "dos-http_flood": { + "_n": 714.0, + "arc_length": 0.8943795518207284, + "causal_surprisal_flow": 0.5574515406162465, + "causal_surprisal_packet_max": 0.8909235294117647, + "causal_surprisal_packet_mean": 0.9274366946778712, + "causal_surprisal_packet_median": 0.9045728291316527, + "causal_surprisal_packet_trimmed10_mean": 0.9108857142857144, + "causal_surprisal_total": 0.6291518207282913, + "consistency_total": 0.907635994397759, + "curvature_flow": 0.02665098039215686, + "curvature_packet": 0.8060679271708684, + "curvature_total": 0.07924593837535014, + "direction_drift_flow": 0.3236228291316527, + "direction_drift_packet_max": 0.6146675070028012, + "direction_drift_packet_mean": 0.6907980392156863, + "direction_drift_packet_median": 0.6680974789915967, + "direction_drift_packet_trimmed10_mean": 0.7000049019607844, + "direction_drift_total": 0.45482717086834734, + "flow_consistency": 0.8964733893557424, + "jacobian_flow": 0.3682316526610644, + "jacobian_packet": 0.7740266106442577, + "jacobian_total": 0.6149119047619047, + "kappa2_speed2norm_packet_mean": 0.18687787114845938, + "kappa2_speed2norm_packet_median": 0.1907204481792717, + "kappa2_speed2norm_packet_trimmed10_mean": 0.19265126050420167, + "kinetic_energy": 0.8907708683473389, + "kinetic_flow": 0.719818487394958, + "kinetic_packet": 0.9504156862745097, + "packet_consistency": 0.7407717086834734, + "pna_flow": 0.03612100840336135, + "pna_packet_max": 0.24378851540616248, + "pna_packet_mean": 0.18687787114845938, + "pna_packet_median": 0.1907204481792717, + "pna_packet_trimmed10_mean": 0.19265126050420167, + "terminal_flow": 0.9299218487394959, + "terminal_norm": 0.9849173669467788, + "terminal_packet": 0.9516563025210084, + "velocity_flow": 0.6487935574229692, + "velocity_flow_t01": 0.6082596638655462, + "velocity_flow_t03": 0.6220126050420168, + "velocity_flow_t05": 0.6337983193277311, + "velocity_flow_t07": 0.6453288515406163, + "velocity_flow_t09": 0.8359294117647059, + "velocity_flow_t10": 0.8364114845938376, + "velocity_packet": 0.6758591036414565, + "velocity_packet_t01": 0.26846610644257707, + "velocity_packet_t03": 0.3543211484593838, + "velocity_packet_t05": 0.5089271708683474, + "velocity_packet_t07": 0.6871018207282913, + "velocity_packet_t09": 0.7881815126050421, + "velocity_packet_t10": 0.8559616246498599, + "velocity_total": 0.8697806722689075, + "velocity_total_t01": 0.5559380952380952, + "velocity_total_t03": 0.6006857142857143, + "velocity_total_t05": 0.6591743697478992, + "velocity_total_t07": 0.8672338935574229, + "velocity_total_t09": 0.906190756302521, + "velocity_total_t10": 0.9387949579831933 + }, + "dos-syn_flood": { + "_n": 836.0, + "arc_length": 0.9721983253588516, + "causal_surprisal_flow": 0.15080311004784688, + "causal_surprisal_packet_max": 0.8159552631578947, + "causal_surprisal_packet_mean": 0.9159590909090908, + "causal_surprisal_packet_median": 0.7617613636363636, + "causal_surprisal_packet_trimmed10_mean": 0.690201913875598, + "causal_surprisal_total": 0.2124799043062201, + "consistency_total": 0.8306944976076555, + "curvature_flow": 0.04016411483253589, + "curvature_packet": 0.7489863636363637, + "curvature_total": 0.06456674641148326, + "direction_drift_flow": 0.12513576555023925, + "direction_drift_packet_max": 0.7875062200956939, + "direction_drift_packet_mean": 0.6681105263157895, + "direction_drift_packet_median": 0.573988038277512, + "direction_drift_packet_trimmed10_mean": 0.6107861244019139, + "direction_drift_total": 0.5174974880382774, + "flow_consistency": 0.8169688995215311, + "jacobian_flow": 0.1347267942583732, + "jacobian_packet": 0.6266523923444975, + "jacobian_total": 0.3277943779904306, + "kappa2_speed2norm_packet_mean": 0.1468598086124402, + "kappa2_speed2norm_packet_median": 0.17182990430622008, + "kappa2_speed2norm_packet_trimmed10_mean": 0.1292846889952153, + "kinetic_energy": 0.9702526315789475, + "kinetic_flow": 0.7950303827751197, + "kinetic_packet": 0.9795016746411482, + "packet_consistency": 0.8078485645933015, + "pna_flow": 0.05808229665071771, + "pna_packet_max": 0.32164138755980864, + "pna_packet_mean": 0.1468598086124402, + "pna_packet_median": 0.17182990430622008, + "pna_packet_trimmed10_mean": 0.1292846889952153, + "terminal_flow": 0.9444863636363636, + "terminal_norm": 0.9925072966507177, + "terminal_packet": 0.9838110047846891, + "velocity_flow": 0.8287523923444976, + "velocity_flow_t01": 0.8179990430622011, + "velocity_flow_t03": 0.8144284688995215, + "velocity_flow_t05": 0.8113485645933015, + "velocity_flow_t07": 0.8184992822966507, + "velocity_flow_t09": 0.8667724880382774, + "velocity_flow_t10": 0.8667322966507176, + "velocity_packet": 0.7781544258373205, + "velocity_packet_t01": 0.45634760765550236, + "velocity_packet_t03": 0.52631004784689, + "velocity_packet_t05": 0.6591758373205743, + "velocity_packet_t07": 0.7919822966507176, + "velocity_packet_t09": 0.8402754784688995, + "velocity_packet_t10": 0.8829868421052631, + "velocity_total": 0.8825586124401914, + "velocity_total_t01": 0.7651486842105264, + "velocity_total_t03": 0.8118000000000001, + "velocity_total_t05": 0.8412232057416268, + "velocity_total_t07": 0.8790602870813398, + "velocity_total_t09": 0.8967235645933015, + "velocity_total_t10": 0.9210761961722489 + }, + "dos-tcp_flood": { + "_n": 1084.0, + "arc_length": 0.9425547970479705, + "causal_surprisal_flow": 0.07015701107011069, + "causal_surprisal_packet_max": 0.8641725092250921, + "causal_surprisal_packet_mean": 0.9506656826568267, + "causal_surprisal_packet_median": 0.8294367158671587, + "causal_surprisal_packet_trimmed10_mean": 0.8230826568265682, + "causal_surprisal_total": 0.16733367158671586, + "consistency_total": 0.8302381918819188, + "curvature_flow": 0.026828413284132838, + "curvature_packet": 0.453754704797048, + "curvature_total": 0.017615129151291514, + "direction_drift_flow": 0.18094031365313656, + "direction_drift_packet_max": 0.5201944649446495, + "direction_drift_packet_mean": 0.37034437269372694, + "direction_drift_packet_median": 0.32324280442804426, + "direction_drift_packet_trimmed10_mean": 0.3263067343173432, + "direction_drift_total": 0.15107592250922508, + "flow_consistency": 0.7904652214022141, + "jacobian_flow": 0.1434840405904059, + "jacobian_packet": 0.5562861623616236, + "jacobian_total": 0.2754386531365314, + "kappa2_speed2norm_packet_mean": 0.010068819188191877, + "kappa2_speed2norm_packet_median": 0.011168450184501848, + "kappa2_speed2norm_packet_trimmed10_mean": 0.00949280442804427, + "kinetic_energy": 0.9365529520295204, + "kinetic_flow": 0.7081142066420665, + "kinetic_packet": 0.944846217712177, + "packet_consistency": 0.8049979704797048, + "pna_flow": 0.04956531365313654, + "pna_packet_max": 0.08258081180811808, + "pna_packet_mean": 0.010068819188191877, + "pna_packet_median": 0.011168450184501848, + "pna_packet_trimmed10_mean": 0.00949280442804427, + "terminal_flow": 0.9503758302583025, + "terminal_norm": 0.9877476014760148, + "terminal_packet": 0.9385308118081181, + "velocity_flow": 0.8047086715867159, + "velocity_flow_t01": 0.8114555350553506, + "velocity_flow_t03": 0.8078571955719558, + "velocity_flow_t05": 0.8035269372693726, + "velocity_flow_t07": 0.8041239852398524, + "velocity_flow_t09": 0.8496415129151293, + "velocity_flow_t10": 0.8519097785977859, + "velocity_packet": 0.8779647601476016, + "velocity_packet_t01": 0.498589852398524, + "velocity_packet_t03": 0.5886008302583026, + "velocity_packet_t05": 0.718539852398524, + "velocity_packet_t07": 0.8420240774907748, + "velocity_packet_t09": 0.9273016605166052, + "velocity_packet_t10": 0.9954621771217712, + "velocity_total": 0.9345066420664206, + "velocity_total_t01": 0.8037324723247232, + "velocity_total_t03": 0.8289920664206643, + "velocity_total_t05": 0.8763782287822878, + "velocity_total_t07": 0.9215666051660515, + "velocity_total_t09": 0.9442976014760147, + "velocity_total_t10": 0.9723256457564576 + }, + "dos-udp_flood": { + "_n": 201.0, + "arc_length": 0.9708009950248756, + "causal_surprisal_flow": 0.16686567164179106, + "causal_surprisal_packet_max": 0.9920218905472635, + "causal_surprisal_packet_mean": 0.6779980099502487, + "causal_surprisal_packet_median": 0.0073572139303482685, + "causal_surprisal_packet_trimmed10_mean": 0.0629084577114428, + "causal_surprisal_total": 0.021608955223880594, + "consistency_total": 0.9930547263681592, + "curvature_flow": 0.01744477611940297, + "curvature_packet": 0.9262497512437811, + "curvature_total": 0.31911592039801, + "direction_drift_flow": 0.08215124378109454, + "direction_drift_packet_max": 0.8358348258706467, + "direction_drift_packet_mean": 0.6162009950248755, + "direction_drift_packet_median": 0.6073134328358208, + "direction_drift_packet_trimmed10_mean": 0.628563184079602, + "direction_drift_total": 0.658547263681592, + "flow_consistency": 0.991350248756219, + "jacobian_flow": 0.013677611940298512, + "jacobian_packet": 0.08854228855721394, + "jacobian_total": 0.11813731343283584, + "kappa2_speed2norm_packet_mean": 0.08383283582089551, + "kappa2_speed2norm_packet_median": 0.08259601990049752, + "kappa2_speed2norm_packet_trimmed10_mean": 0.08134328358208955, + "kinetic_energy": 0.9687577114427861, + "kinetic_flow": 0.9341512437810946, + "kinetic_packet": 0.988273631840796, + "packet_consistency": 0.995270646766169, + "pna_flow": 0.011683582089552245, + "pna_packet_max": 0.2984835820895522, + "pna_packet_mean": 0.08383283582089551, + "pna_packet_median": 0.08259601990049752, + "pna_packet_trimmed10_mean": 0.08134328358208955, + "terminal_flow": 0.9982308457711442, + "terminal_norm": 0.9948457711442785, + "terminal_packet": 0.9813711442786068, + "velocity_flow": 0.9805870646766169, + "velocity_flow_t01": 0.9815820895522388, + "velocity_flow_t03": 0.9813910447761194, + "velocity_flow_t05": 0.9811462686567164, + "velocity_flow_t07": 0.9805492537313433, + "velocity_flow_t09": 0.9799691542288557, + "velocity_flow_t10": 0.9790805970149254, + "velocity_packet": 0.9935333333333333, + "velocity_packet_t01": 0.9957761194029852, + "velocity_packet_t03": 0.9953273631840797, + "velocity_packet_t05": 0.9946786069651742, + "velocity_packet_t07": 0.9894049751243782, + "velocity_packet_t09": 0.9767383084577116, + "velocity_packet_t10": 0.9711960199004975, + "velocity_total": 0.9109164179104479, + "velocity_total_t01": 0.9649880597014925, + "velocity_total_t03": 0.9638776119402984, + "velocity_total_t05": 0.9611711442786068, + "velocity_total_t07": 0.9482626865671641, + "velocity_total_t09": 0.8801860696517413, + "velocity_total_t10": 0.8531557213930347 + }, + "mirai-greeth_flood": { + "_n": 12.0, + "arc_length": 0.6750333333333334, + "causal_surprisal_flow": 0.1897666666666667, + "causal_surprisal_packet_max": 0.4836166666666667, + "causal_surprisal_packet_mean": 0.5456333333333333, + "causal_surprisal_packet_median": 0.6825333333333333, + "causal_surprisal_packet_trimmed10_mean": 0.6306499999999999, + "causal_surprisal_total": 0.27136666666666664, + "consistency_total": 0.5715833333333333, + "curvature_flow": 0.3519333333333333, + "curvature_packet": 0.5002333333333333, + "curvature_total": 0.38585, + "direction_drift_flow": 0.45496666666666674, + "direction_drift_packet_max": 0.3970666666666667, + "direction_drift_packet_mean": 0.37543333333333334, + "direction_drift_packet_median": 0.4178833333333334, + "direction_drift_packet_trimmed10_mean": 0.3696333333333333, + "direction_drift_total": 0.31155, + "flow_consistency": 0.5755333333333332, + "jacobian_flow": 0.3919166666666667, + "jacobian_packet": 0.4825166666666667, + "jacobian_total": 0.4140666666666667, + "kappa2_speed2norm_packet_mean": 0.26265, + "kappa2_speed2norm_packet_median": 0.25601666666666667, + "kappa2_speed2norm_packet_trimmed10_mean": 0.2749833333333333, + "kinetic_energy": 0.6719833333333333, + "kinetic_flow": 0.4369833333333333, + "kinetic_packet": 0.6756, + "packet_consistency": 0.5257833333333334, + "pna_flow": 0.40356666666666663, + "pna_packet_max": 0.2874333333333333, + "pna_packet_mean": 0.26265, + "pna_packet_median": 0.25601666666666667, + "pna_packet_trimmed10_mean": 0.2749833333333333, + "terminal_flow": 0.6094166666666666, + "terminal_norm": 0.7, + "terminal_packet": 0.6670999999999999, + "velocity_flow": 0.5107666666666667, + "velocity_flow_t01": 0.4729833333333333, + "velocity_flow_t03": 0.46495000000000003, + "velocity_flow_t05": 0.4655166666666667, + "velocity_flow_t07": 0.49681666666666663, + "velocity_flow_t09": 0.5239333333333334, + "velocity_flow_t10": 0.57665, + "velocity_packet": 0.5967166666666666, + "velocity_packet_t01": 0.4171666666666667, + "velocity_packet_t03": 0.43648333333333333, + "velocity_packet_t05": 0.5050666666666667, + "velocity_packet_t07": 0.5879833333333334, + "velocity_packet_t09": 0.5745, + "velocity_packet_t10": 0.6265833333333333, + "velocity_total": 0.5507833333333333, + "velocity_total_t01": 0.47436666666666677, + "velocity_total_t03": 0.49701666666666666, + "velocity_total_t05": 0.5257333333333334, + "velocity_total_t07": 0.5334666666666668, + "velocity_total_t09": 0.5637833333333334, + "velocity_total_t10": 0.6487833333333333 + }, + "mirai-greip_flood": { + "_n": 18.0, + "arc_length": 0.7228111111111112, + "causal_surprisal_flow": 0.2690444444444444, + "causal_surprisal_packet_max": 0.5756666666666667, + "causal_surprisal_packet_mean": 0.5774111111111111, + "causal_surprisal_packet_median": 0.6022111111111111, + "causal_surprisal_packet_trimmed10_mean": 0.5286888888888889, + "causal_surprisal_total": 0.24993333333333334, + "consistency_total": 0.7505, + "curvature_flow": 0.25145555555555554, + "curvature_packet": 0.6025555555555555, + "curvature_total": 0.33391111111111116, + "direction_drift_flow": 0.3413833333333333, + "direction_drift_packet_max": 0.5035888888888889, + "direction_drift_packet_mean": 0.4371333333333333, + "direction_drift_packet_median": 0.4236111111111111, + "direction_drift_packet_trimmed10_mean": 0.4278888888888889, + "direction_drift_total": 0.39490000000000003, + "flow_consistency": 0.8039888888888889, + "jacobian_flow": 0.35738888888888887, + "jacobian_packet": 0.5087, + "jacobian_total": 0.4677555555555556, + "kappa2_speed2norm_packet_mean": 0.3271611111111111, + "kappa2_speed2norm_packet_median": 0.3377555555555556, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3338888888888889, + "kinetic_energy": 0.7166111111111111, + "kinetic_flow": 0.6862333333333334, + "kinetic_packet": 0.7545444444444445, + "packet_consistency": 0.5568555555555555, + "pna_flow": 0.25566666666666665, + "pna_packet_max": 0.40146666666666664, + "pna_packet_mean": 0.3271611111111111, + "pna_packet_median": 0.3377555555555556, + "pna_packet_trimmed10_mean": 0.3338888888888889, + "terminal_flow": 0.8776666666666667, + "terminal_norm": 0.878411111111111, + "terminal_packet": 0.7855111111111112, + "velocity_flow": 0.6676111111111112, + "velocity_flow_t01": 0.6499555555555555, + "velocity_flow_t03": 0.6500555555555556, + "velocity_flow_t05": 0.6536555555555555, + "velocity_flow_t07": 0.6614111111111112, + "velocity_flow_t09": 0.6822555555555556, + "velocity_flow_t10": 0.6615666666666666, + "velocity_packet": 0.5709333333333333, + "velocity_packet_t01": 0.43888888888888883, + "velocity_packet_t03": 0.45104444444444447, + "velocity_packet_t05": 0.4711666666666666, + "velocity_packet_t07": 0.5607666666666666, + "velocity_packet_t09": 0.6301333333333333, + "velocity_packet_t10": 0.6508444444444444, + "velocity_total": 0.673911111111111, + "velocity_total_t01": 0.5150444444444444, + "velocity_total_t03": 0.5342333333333333, + "velocity_total_t05": 0.5668888888888889, + "velocity_total_t07": 0.6740333333333334, + "velocity_total_t09": 0.7518444444444444, + "velocity_total_t10": 0.7019444444444445 + }, + "mirai-udpplain": { + "_n": 9.0, + "arc_length": 0.7178888888888889, + "causal_surprisal_flow": 0.17037777777777777, + "causal_surprisal_packet_max": 0.5710444444444445, + "causal_surprisal_packet_mean": 0.669711111111111, + "causal_surprisal_packet_median": 0.7764888888888888, + "causal_surprisal_packet_trimmed10_mean": 0.7201555555555555, + "causal_surprisal_total": 0.23193333333333335, + "consistency_total": 0.5699333333333333, + "curvature_flow": 0.32024444444444444, + "curvature_packet": 0.6576, + "curvature_total": 0.44953333333333334, + "direction_drift_flow": 0.531511111111111, + "direction_drift_packet_max": 0.45068888888888886, + "direction_drift_packet_mean": 0.44595555555555555, + "direction_drift_packet_median": 0.41575555555555554, + "direction_drift_packet_trimmed10_mean": 0.4565555555555555, + "direction_drift_total": 0.42915555555555557, + "flow_consistency": 0.6389555555555555, + "jacobian_flow": 0.3867555555555556, + "jacobian_packet": 0.6486222222222222, + "jacobian_total": 0.5728222222222222, + "kappa2_speed2norm_packet_mean": 0.4344888888888888, + "kappa2_speed2norm_packet_median": 0.44357777777777774, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4562444444444444, + "kinetic_energy": 0.7182, + "kinetic_flow": 0.4092444444444444, + "kinetic_packet": 0.7314888888888889, + "packet_consistency": 0.4251333333333333, + "pna_flow": 0.3879111111111111, + "pna_packet_max": 0.36713333333333337, + "pna_packet_mean": 0.4344888888888888, + "pna_packet_median": 0.44357777777777774, + "pna_packet_trimmed10_mean": 0.4562444444444444, + "terminal_flow": 0.6517777777777777, + "terminal_norm": 0.711911111111111, + "terminal_packet": 0.6868888888888889, + "velocity_flow": 0.4862888888888888, + "velocity_flow_t01": 0.4919111111111111, + "velocity_flow_t03": 0.4854666666666666, + "velocity_flow_t05": 0.4851333333333333, + "velocity_flow_t07": 0.4806444444444445, + "velocity_flow_t09": 0.47182222222222225, + "velocity_flow_t10": 0.5142444444444445, + "velocity_packet": 0.42239999999999994, + "velocity_packet_t01": 0.31275555555555556, + "velocity_packet_t03": 0.34173333333333333, + "velocity_packet_t05": 0.3498, + "velocity_packet_t07": 0.3711777777777778, + "velocity_packet_t09": 0.5139777777777778, + "velocity_packet_t10": 0.5856888888888888, + "velocity_total": 0.5178222222222222, + "velocity_total_t01": 0.43795555555555554, + "velocity_total_t03": 0.46713333333333334, + "velocity_total_t05": 0.5190444444444444, + "velocity_total_t07": 0.5044, + "velocity_total_t09": 0.5129777777777778, + "velocity_total_t10": 0.5891333333333333 + }, + "mitm-arpspoofing": { + "_n": 134.0, + "arc_length": 0.7430626865671642, + "causal_surprisal_flow": 0.3185686567164179, + "causal_surprisal_packet_max": 0.47859104477611936, + "causal_surprisal_packet_mean": 0.4587492537313433, + "causal_surprisal_packet_median": 0.5739328358208955, + "causal_surprisal_packet_trimmed10_mean": 0.4601089552238806, + "causal_surprisal_total": 0.2716455223880597, + "consistency_total": 0.6175447761194031, + "curvature_flow": 0.26809253731343285, + "curvature_packet": 0.6207582089552238, + "curvature_total": 0.3431373134328358, + "direction_drift_flow": 0.4027037313432836, + "direction_drift_packet_max": 0.5346761194029851, + "direction_drift_packet_mean": 0.5142626865671641, + "direction_drift_packet_median": 0.5141089552238806, + "direction_drift_packet_trimmed10_mean": 0.5187014925373133, + "direction_drift_total": 0.4284529850746269, + "flow_consistency": 0.6776731343283582, + "jacobian_flow": 0.455439552238806, + "jacobian_packet": 0.5929417910447761, + "jacobian_total": 0.5189074626865672, + "kappa2_speed2norm_packet_mean": 0.4461074626865671, + "kappa2_speed2norm_packet_median": 0.4427805970149254, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4643298507462687, + "kinetic_energy": 0.7389925373134328, + "kinetic_flow": 0.6150776119402985, + "kinetic_packet": 0.7479746268656718, + "packet_consistency": 0.5228164179104478, + "pna_flow": 0.29635223880597017, + "pna_packet_max": 0.4665701492537313, + "pna_packet_mean": 0.4461074626865671, + "pna_packet_median": 0.4427805970149254, + "pna_packet_trimmed10_mean": 0.4643298507462687, + "terminal_flow": 0.8105156716417911, + "terminal_norm": 0.8369940298507463, + "terminal_packet": 0.7593253731343284, + "velocity_flow": 0.5976432835820896, + "velocity_flow_t01": 0.5626940298507462, + "velocity_flow_t03": 0.5653626865671642, + "velocity_flow_t05": 0.5709597014925373, + "velocity_flow_t07": 0.5909194029850746, + "velocity_flow_t09": 0.6309522388059701, + "velocity_flow_t10": 0.5971164179104478, + "velocity_packet": 0.5136746268656717, + "velocity_packet_t01": 0.42011940298507466, + "velocity_packet_t03": 0.4362716417910448, + "velocity_packet_t05": 0.4672537313432836, + "velocity_packet_t07": 0.5127298507462686, + "velocity_packet_t09": 0.5601567164179104, + "velocity_packet_t10": 0.5512985074626866, + "velocity_total": 0.626089552238806, + "velocity_total_t01": 0.5100805970149254, + "velocity_total_t03": 0.5201895522388059, + "velocity_total_t05": 0.5472044776119402, + "velocity_total_t07": 0.6365029850746268, + "velocity_total_t09": 0.7051626865671641, + "velocity_total_t10": 0.6543552238805971 + }, + "recon-hostdiscovery": { + "_n": 179.0, + "arc_length": 0.8451206703910615, + "causal_surprisal_flow": 0.5162402234636871, + "causal_surprisal_packet_max": 0.5207877094972067, + "causal_surprisal_packet_mean": 0.6514346368715085, + "causal_surprisal_packet_median": 0.8008837988826814, + "causal_surprisal_packet_trimmed10_mean": 0.7206290502793297, + "causal_surprisal_total": 0.5772737430167598, + "consistency_total": 0.7018234636871509, + "curvature_flow": 0.22409720670391062, + "curvature_packet": 0.6530502793296089, + "curvature_total": 0.27094078212290507, + "direction_drift_flow": 0.5044217877094972, + "direction_drift_packet_max": 0.5754318435754191, + "direction_drift_packet_mean": 0.6380614525139665, + "direction_drift_packet_median": 0.6344826815642458, + "direction_drift_packet_trimmed10_mean": 0.6528134078212291, + "direction_drift_total": 0.5364491620111732, + "flow_consistency": 0.7194759776536314, + "jacobian_flow": 0.5389798882681565, + "jacobian_packet": 0.7911385474860335, + "jacobian_total": 0.7166189944134078, + "kappa2_speed2norm_packet_mean": 0.3591815642458101, + "kappa2_speed2norm_packet_median": 0.36971899441340783, + "kappa2_speed2norm_packet_trimmed10_mean": 0.3817977653631285, + "kinetic_energy": 0.8441720670391062, + "kinetic_flow": 0.5645296089385475, + "kinetic_packet": 0.8453832402234637, + "packet_consistency": 0.5280882681564246, + "pna_flow": 0.25597206703910613, + "pna_packet_max": 0.36364581005586594, + "pna_packet_mean": 0.3591815642458101, + "pna_packet_median": 0.36971899441340783, + "pna_packet_trimmed10_mean": 0.3817977653631285, + "terminal_flow": 0.7904938547486032, + "terminal_norm": 0.8658335195530726, + "terminal_packet": 0.8519329608938547, + "velocity_flow": 0.5262067039106145, + "velocity_flow_t01": 0.4931508379888268, + "velocity_flow_t03": 0.5030882681564246, + "velocity_flow_t05": 0.5128837988826815, + "velocity_flow_t07": 0.5247888268156424, + "velocity_flow_t09": 0.6372446927374302, + "velocity_flow_t10": 0.6328122905027934, + "velocity_packet": 0.4978960893854749, + "velocity_packet_t01": 0.27995642458100556, + "velocity_packet_t03": 0.29821452513966484, + "velocity_packet_t05": 0.38392737430167595, + "velocity_packet_t07": 0.4948569832402234, + "velocity_packet_t09": 0.5848318435754191, + "velocity_packet_t10": 0.6204201117318436, + "velocity_total": 0.6673072625698324, + "velocity_total_t01": 0.4659117318435754, + "velocity_total_t03": 0.4870569832402234, + "velocity_total_t05": 0.5243877094972067, + "velocity_total_t07": 0.6746173184357542, + "velocity_total_t09": 0.7049329608938547, + "velocity_total_t10": 0.7040402234636871 + }, + "recon-osscan": { + "_n": 371.0, + "arc_length": 0.8771956873315364, + "causal_surprisal_flow": 0.5946959568733153, + "causal_surprisal_packet_max": 0.5577940700808626, + "causal_surprisal_packet_mean": 0.6988134770889488, + "causal_surprisal_packet_median": 0.7882420485175202, + "causal_surprisal_packet_trimmed10_mean": 0.7380905660377359, + "causal_surprisal_total": 0.6480140161725066, + "consistency_total": 0.8216970350404313, + "curvature_flow": 0.08755471698113208, + "curvature_packet": 0.7094264150943397, + "curvature_total": 0.12399568733153639, + "direction_drift_flow": 0.4124938005390836, + "direction_drift_packet_max": 0.6194622641509434, + "direction_drift_packet_mean": 0.7083816711590296, + "direction_drift_packet_median": 0.7044469002695417, + "direction_drift_packet_trimmed10_mean": 0.7263967654986523, + "direction_drift_total": 0.5280215633423181, + "flow_consistency": 0.8497180592991914, + "jacobian_flow": 0.5034393530997304, + "jacobian_packet": 0.8118264150943396, + "jacobian_total": 0.7058485175202157, + "kappa2_speed2norm_packet_mean": 0.32725067385444745, + "kappa2_speed2norm_packet_median": 0.33353746630727765, + "kappa2_speed2norm_packet_trimmed10_mean": 0.33734716981132074, + "kinetic_energy": 0.8755194070080863, + "kinetic_flow": 0.5981026954177898, + "kinetic_packet": 0.9027940700808624, + "packet_consistency": 0.5759180592991914, + "pna_flow": 0.11866576819407008, + "pna_packet_max": 0.34414070080862535, + "pna_packet_mean": 0.32725067385444745, + "pna_packet_median": 0.33353746630727765, + "pna_packet_trimmed10_mean": 0.33734716981132074, + "terminal_flow": 0.8882636118598383, + "terminal_norm": 0.9317309973045822, + "terminal_packet": 0.9055547169811321, + "velocity_flow": 0.5788404312668464, + "velocity_flow_t01": 0.5342199460916441, + "velocity_flow_t03": 0.5445161725067386, + "velocity_flow_t05": 0.5553865229110512, + "velocity_flow_t07": 0.5740059299191375, + "velocity_flow_t09": 0.7367617250673856, + "velocity_flow_t10": 0.7249277628032345, + "velocity_packet": 0.5632808625336928, + "velocity_packet_t01": 0.2496814016172507, + "velocity_packet_t03": 0.2854652291105121, + "velocity_packet_t05": 0.39449703504043127, + "velocity_packet_t07": 0.5589129380053908, + "velocity_packet_t09": 0.6708029649595686, + "velocity_packet_t10": 0.743279245283019, + "velocity_total": 0.7882533692722372, + "velocity_total_t01": 0.5214754716981131, + "velocity_total_t03": 0.5425045822102427, + "velocity_total_t05": 0.608167115902965, + "velocity_total_t07": 0.7858711590296497, + "velocity_total_t09": 0.8303299191374663, + "velocity_total_t10": 0.8512582210242589 + }, + "recon-pingsweep": { + "_n": 6.0, + "arc_length": 0.6220666666666667, + "causal_surprisal_flow": 0.5065333333333334, + "causal_surprisal_packet_max": 0.8910666666666667, + "causal_surprisal_packet_mean": 0.7725666666666666, + "causal_surprisal_packet_median": 0.5789, + "causal_surprisal_packet_trimmed10_mean": 0.5521, + "causal_surprisal_total": 0.4462666666666667, + "consistency_total": 0.8771, + "curvature_flow": 0.09486666666666665, + "curvature_packet": 0.9534333333333334, + "curvature_total": 0.3759, + "direction_drift_flow": 0.23309999999999997, + "direction_drift_packet_max": 0.9128000000000001, + "direction_drift_packet_mean": 0.7587666666666666, + "direction_drift_packet_median": 0.6584, + "direction_drift_packet_trimmed10_mean": 0.7250000000000001, + "direction_drift_total": 0.6901333333333334, + "flow_consistency": 0.8723333333333333, + "jacobian_flow": 0.15040000000000003, + "jacobian_packet": 0.43346666666666667, + "jacobian_total": 0.2705666666666666, + "kappa2_speed2norm_packet_mean": 0.6341666666666667, + "kappa2_speed2norm_packet_median": 0.6192333333333333, + "kappa2_speed2norm_packet_trimmed10_mean": 0.6225333333333334, + "kinetic_energy": 0.6182000000000001, + "kinetic_flow": 0.5693666666666666, + "kinetic_packet": 0.8310333333333333, + "packet_consistency": 0.8621, + "pna_flow": 0.08756666666666668, + "pna_packet_max": 0.7594666666666666, + "pna_packet_mean": 0.6341666666666667, + "pna_packet_median": 0.6192333333333333, + "pna_packet_trimmed10_mean": 0.6225333333333334, + "terminal_flow": 0.9360333333333333, + "terminal_norm": 0.9023, + "terminal_packet": 0.7998333333333334, + "velocity_flow": 0.7482, + "velocity_flow_t01": 0.7393333333333333, + "velocity_flow_t03": 0.7225999999999999, + "velocity_flow_t05": 0.7147666666666666, + "velocity_flow_t07": 0.7114666666666667, + "velocity_flow_t09": 0.8182666666666667, + "velocity_flow_t10": 0.8276, + "velocity_packet": 0.7400666666666667, + "velocity_packet_t01": 0.8096, + "velocity_packet_t03": 0.7866666666666667, + "velocity_packet_t05": 0.7645666666666666, + "velocity_packet_t07": 0.7548333333333334, + "velocity_packet_t09": 0.6668333333333334, + "velocity_packet_t10": 0.6737666666666667, + "velocity_total": 0.7420333333333333, + "velocity_total_t01": 0.7681666666666668, + "velocity_total_t03": 0.7990999999999999, + "velocity_total_t05": 0.7756666666666667, + "velocity_total_t07": 0.7301333333333333, + "velocity_total_t09": 0.6987, + "velocity_total_t10": 0.7165333333333332 + }, + "recon-portscan": { + "_n": 397.0, + "arc_length": 0.8696647355163729, + "causal_surprisal_flow": 0.6098337531486147, + "causal_surprisal_packet_max": 0.5728244332493702, + "causal_surprisal_packet_mean": 0.734375314861461, + "causal_surprisal_packet_median": 0.8113133501259446, + "causal_surprisal_packet_trimmed10_mean": 0.7800297229219144, + "causal_surprisal_total": 0.6587687657430731, + "consistency_total": 0.8342937027707811, + "curvature_flow": 0.09926498740554156, + "curvature_packet": 0.6977317380352646, + "curvature_total": 0.12243879093198992, + "direction_drift_flow": 0.42603576826196465, + "direction_drift_packet_max": 0.6541083123425693, + "direction_drift_packet_mean": 0.7527652392947104, + "direction_drift_packet_median": 0.7467062972292191, + "direction_drift_packet_trimmed10_mean": 0.7730141057934509, + "direction_drift_total": 0.5770750629722922, + "flow_consistency": 0.85460201511335, + "jacobian_flow": 0.4835813602015113, + "jacobian_packet": 0.8300685138539043, + "jacobian_total": 0.7192503778337531, + "kappa2_speed2norm_packet_mean": 0.2907501259445844, + "kappa2_speed2norm_packet_median": 0.2969133501259446, + "kappa2_speed2norm_packet_trimmed10_mean": 0.29904937027707806, + "kinetic_energy": 0.8691581863979849, + "kinetic_flow": 0.607456926952141, + "kinetic_packet": 0.8957491183879093, + "packet_consistency": 0.5950035264483629, + "pna_flow": 0.11989471032745593, + "pna_packet_max": 0.3327783375314861, + "pna_packet_mean": 0.2907501259445844, + "pna_packet_median": 0.2969133501259446, + "pna_packet_trimmed10_mean": 0.29904937027707806, + "terminal_flow": 0.8784327455919395, + "terminal_norm": 0.91787959697733, + "terminal_packet": 0.9016967254408061, + "velocity_flow": 0.5709214105793451, + "velocity_flow_t01": 0.5227481108312343, + "velocity_flow_t03": 0.5349284634760705, + "velocity_flow_t05": 0.5503340050377833, + "velocity_flow_t07": 0.5691707808564231, + "velocity_flow_t09": 0.7498080604534005, + "velocity_flow_t10": 0.7365158690176322, + "velocity_packet": 0.5646231738035264, + "velocity_packet_t01": 0.23801863979848867, + "velocity_packet_t03": 0.271316120906801, + "velocity_packet_t05": 0.3848226700251889, + "velocity_packet_t07": 0.5496780856423173, + "velocity_packet_t09": 0.6834833753148615, + "velocity_packet_t10": 0.7667491183879093, + "velocity_total": 0.7988715365239295, + "velocity_total_t01": 0.5246639798488665, + "velocity_total_t03": 0.5453148614609572, + "velocity_total_t05": 0.6130493702770781, + "velocity_total_t07": 0.7956272040302267, + "velocity_total_t09": 0.820614105793451, + "velocity_total_t10": 0.8412624685138538 + }, + "sqlinjection": { + "_n": 15.0, + "arc_length": 0.6612666666666667, + "causal_surprisal_flow": 0.43555999999999995, + "causal_surprisal_packet_max": 0.3790266666666667, + "causal_surprisal_packet_mean": 0.3524933333333333, + "causal_surprisal_packet_median": 0.47737333333333337, + "causal_surprisal_packet_trimmed10_mean": 0.3408, + "causal_surprisal_total": 0.38910666666666666, + "consistency_total": 0.57208, + "curvature_flow": 0.34796, + "curvature_packet": 0.6255066666666668, + "curvature_total": 0.3666, + "direction_drift_flow": 0.45102666666666674, + "direction_drift_packet_max": 0.49207999999999996, + "direction_drift_packet_mean": 0.51328, + "direction_drift_packet_median": 0.5298533333333333, + "direction_drift_packet_trimmed10_mean": 0.5174666666666667, + "direction_drift_total": 0.42408, + "flow_consistency": 0.64968, + "jacobian_flow": 0.5135733333333333, + "jacobian_packet": 0.6717066666666667, + "jacobian_total": 0.5691599999999999, + "kappa2_speed2norm_packet_mean": 0.5158666666666667, + "kappa2_speed2norm_packet_median": 0.5258533333333333, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5283866666666668, + "kinetic_energy": 0.6592533333333332, + "kinetic_flow": 0.5321133333333333, + "kinetic_packet": 0.6585866666666667, + "packet_consistency": 0.4104266666666666, + "pna_flow": 0.36074666666666666, + "pna_packet_max": 0.44197333333333333, + "pna_packet_mean": 0.5158666666666667, + "pna_packet_median": 0.5258533333333333, + "pna_packet_trimmed10_mean": 0.5283866666666668, + "terminal_flow": 0.8301466666666667, + "terminal_norm": 0.80244, + "terminal_packet": 0.6689333333333334, + "velocity_flow": 0.51132, + "velocity_flow_t01": 0.46770666666666666, + "velocity_flow_t03": 0.47824, + "velocity_flow_t05": 0.4875333333333334, + "velocity_flow_t07": 0.4935733333333334, + "velocity_flow_t09": 0.55772, + "velocity_flow_t10": 0.5043866666666666, + "velocity_packet": 0.47372, + "velocity_packet_t01": 0.44452, + "velocity_packet_t03": 0.4404933333333333, + "velocity_packet_t05": 0.44156, + "velocity_packet_t07": 0.4593066666666667, + "velocity_packet_t09": 0.5115333333333334, + "velocity_packet_t10": 0.5216933333333333, + "velocity_total": 0.5674133333333333, + "velocity_total_t01": 0.47164, + "velocity_total_t03": 0.47705333333333333, + "velocity_total_t05": 0.49423999999999996, + "velocity_total_t07": 0.5638266666666667, + "velocity_total_t09": 0.6540933333333333, + "velocity_total_t10": 0.5698133333333334 + }, + "uploading_attack": { + "_n": 5.0, + "arc_length": 0.75948, + "causal_surprisal_flow": 0.39283999999999997, + "causal_surprisal_packet_max": 0.39052, + "causal_surprisal_packet_mean": 0.45488, + "causal_surprisal_packet_median": 0.65532, + "causal_surprisal_packet_trimmed10_mean": 0.56128, + "causal_surprisal_total": 0.38332, + "consistency_total": 0.41156, + "curvature_flow": 0.36136, + "curvature_packet": 0.59476, + "curvature_total": 0.41191999999999995, + "direction_drift_flow": 0.46496000000000004, + "direction_drift_packet_max": 0.37892, + "direction_drift_packet_mean": 0.4690000000000001, + "direction_drift_packet_median": 0.48808, + "direction_drift_packet_trimmed10_mean": 0.49083999999999994, + "direction_drift_total": 0.29852, + "flow_consistency": 0.32328, + "jacobian_flow": 0.563, + "jacobian_packet": 0.6018, + "jacobian_total": 0.60292, + "kappa2_speed2norm_packet_mean": 0.5803999999999999, + "kappa2_speed2norm_packet_median": 0.5916, + "kappa2_speed2norm_packet_trimmed10_mean": 0.63724, + "kinetic_energy": 0.75284, + "kinetic_flow": 0.433, + "kinetic_packet": 0.77156, + "packet_consistency": 0.51192, + "pna_flow": 0.38739999999999997, + "pna_packet_max": 0.42268, + "pna_packet_mean": 0.5803999999999999, + "pna_packet_median": 0.5916, + "pna_packet_trimmed10_mean": 0.63724, + "terminal_flow": 0.7624, + "terminal_norm": 0.8602799999999999, + "terminal_packet": 0.8028, + "velocity_flow": 0.6096, + "velocity_flow_t01": 0.5461199999999999, + "velocity_flow_t03": 0.51488, + "velocity_flow_t05": 0.50172, + "velocity_flow_t07": 0.59824, + "velocity_flow_t09": 0.63888, + "velocity_flow_t10": 0.50284, + "velocity_packet": 0.48992, + "velocity_packet_t01": 0.447, + "velocity_packet_t03": 0.446, + "velocity_packet_t05": 0.46404, + "velocity_packet_t07": 0.5244800000000001, + "velocity_packet_t09": 0.55896, + "velocity_packet_t10": 0.45944, + "velocity_total": 0.63832, + "velocity_total_t01": 0.58404, + "velocity_total_t03": 0.617, + "velocity_total_t05": 0.6200000000000001, + "velocity_total_t07": 0.63916, + "velocity_total_t09": 0.76056, + "velocity_total_t10": 0.6128 + }, + "vulnerabilityscan": { + "_n": 598.0, + "arc_length": 0.7247219063545152, + "causal_surprisal_flow": 0.5483183946488295, + "causal_surprisal_packet_max": 0.5012832775919732, + "causal_surprisal_packet_mean": 0.5571404682274248, + "causal_surprisal_packet_median": 0.6410096989966555, + "causal_surprisal_packet_trimmed10_mean": 0.5689685618729097, + "causal_surprisal_total": 0.5752521739130434, + "consistency_total": 0.6533933110367893, + "curvature_flow": 0.2394170568561873, + "curvature_packet": 0.639965719063545, + "curvature_total": 0.27565618729096986, + "direction_drift_flow": 0.4551408026755853, + "direction_drift_packet_max": 0.5631857859531773, + "direction_drift_packet_mean": 0.5922775919732441, + "direction_drift_packet_median": 0.5879698996655518, + "direction_drift_packet_trimmed10_mean": 0.5998, + "direction_drift_total": 0.4931812709030101, + "flow_consistency": 0.6734695652173913, + "jacobian_flow": 0.5067478260869566, + "jacobian_packet": 0.6899461538461538, + "jacobian_total": 0.6248867892976588, + "kappa2_speed2norm_packet_mean": 0.43383528428093643, + "kappa2_speed2norm_packet_median": 0.4363548494983278, + "kappa2_speed2norm_packet_trimmed10_mean": 0.4445585284280936, + "kinetic_energy": 0.7230438127090302, + "kinetic_flow": 0.528709364548495, + "kinetic_packet": 0.7515575250836121, + "packet_consistency": 0.5316635451505016, + "pna_flow": 0.2628307692307692, + "pna_packet_max": 0.4328591973244147, + "pna_packet_mean": 0.43383528428093643, + "pna_packet_median": 0.4363548494983278, + "pna_packet_trimmed10_mean": 0.4445585284280936, + "terminal_flow": 0.7705193979933112, + "terminal_norm": 0.7929471571906355, + "terminal_packet": 0.7594207357859533, + "velocity_flow": 0.527389966555184, + "velocity_flow_t01": 0.49299331103678934, + "velocity_flow_t03": 0.4957053511705686, + "velocity_flow_t05": 0.5062113712374582, + "velocity_flow_t07": 0.5194734113712375, + "velocity_flow_t09": 0.6262078595317726, + "velocity_flow_t10": 0.6226645484949832, + "velocity_packet": 0.5314976588628763, + "velocity_packet_t01": 0.38298979933110366, + "velocity_packet_t03": 0.3953724080267559, + "velocity_packet_t05": 0.44812658862876253, + "velocity_packet_t07": 0.5258331103678929, + "velocity_packet_t09": 0.6071841137123746, + "velocity_packet_t10": 0.6104933110367893, + "velocity_total": 0.6374237458193981, + "velocity_total_t01": 0.49708846153846153, + "velocity_total_t03": 0.5047003344481605, + "velocity_total_t05": 0.5266461538461538, + "velocity_total_t07": 0.6320444816053512, + "velocity_total_t09": 0.6973150501672242, + "velocity_total_t10": 0.6990456521739131 + }, + "xss": { + "_n": 11.0, + "arc_length": 0.8130909090909091, + "causal_surprisal_flow": 0.3859272727272728, + "causal_surprisal_packet_max": 0.5031818181818182, + "causal_surprisal_packet_mean": 0.49476363636363635, + "causal_surprisal_packet_median": 0.5248727272727273, + "causal_surprisal_packet_trimmed10_mean": 0.4721090909090909, + "causal_surprisal_total": 0.3255454545454546, + "consistency_total": 0.660690909090909, + "curvature_flow": 0.13630909090909088, + "curvature_packet": 0.7491454545454546, + "curvature_total": 0.3388545454545456, + "direction_drift_flow": 0.38529090909090913, + "direction_drift_packet_max": 0.577709090909091, + "direction_drift_packet_mean": 0.4908, + "direction_drift_packet_median": 0.48529090909090905, + "direction_drift_packet_trimmed10_mean": 0.48885454545454543, + "direction_drift_total": 0.40576363636363644, + "flow_consistency": 0.6287818181818181, + "jacobian_flow": 0.4678909090909091, + "jacobian_packet": 0.47483636363636356, + "jacobian_total": 0.5057818181818182, + "kappa2_speed2norm_packet_mean": 0.5075090909090909, + "kappa2_speed2norm_packet_median": 0.4952000000000001, + "kappa2_speed2norm_packet_trimmed10_mean": 0.5152000000000001, + "kinetic_energy": 0.8081636363636364, + "kinetic_flow": 0.5981636363636363, + "kinetic_packet": 0.8900545454545454, + "packet_consistency": 0.6704181818181818, + "pna_flow": 0.19281818181818183, + "pna_packet_max": 0.5004727272727272, + "pna_packet_mean": 0.5075090909090909, + "pna_packet_median": 0.4952000000000001, + "pna_packet_trimmed10_mean": 0.5152000000000001, + "terminal_flow": 0.8206181818181818, + "terminal_norm": 0.9276727272727273, + "terminal_packet": 0.8625272727272728, + "velocity_flow": 0.6820181818181817, + "velocity_flow_t01": 0.6641454545454545, + "velocity_flow_t03": 0.6484363636363636, + "velocity_flow_t05": 0.6531636363636364, + "velocity_flow_t07": 0.6805454545454546, + "velocity_flow_t09": 0.7089636363636364, + "velocity_flow_t10": 0.6458363636363637, + "velocity_packet": 0.637090909090909, + "velocity_packet_t01": 0.5610545454545455, + "velocity_packet_t03": 0.5730727272727273, + "velocity_packet_t05": 0.5842363636363637, + "velocity_packet_t07": 0.5983636363636363, + "velocity_packet_t09": 0.7331636363636364, + "velocity_packet_t10": 0.6615818181818183, + "velocity_total": 0.7458727272727272, + "velocity_total_t01": 0.6375090909090909, + "velocity_total_t03": 0.6460545454545454, + "velocity_total_t05": 0.6825818181818182, + "velocity_total_t07": 0.7469454545454546, + "velocity_total_t09": 0.8224, + "velocity_total_t10": 0.7207636363636364 + } + }, + "classes": [ + "backdoor_malware", + "browserhijacking", + "commandinjection", + "ddos-ack_fragmentation", + "ddos-http_flood", + "ddos-icmp_flood", + "ddos-icmp_fragmentation", + "ddos-pshack_flood", + "ddos-rstfinflood", + "ddos-slowloris", + "ddos-syn_flood", + "ddos-synonymousip_flood", + "ddos-tcp_flood", + "ddos-udp_flood", + "ddos-udp_fragmentation", + "dictionarybruteforce", + "dns_spoofing", + "dos-http_flood", + "dos-syn_flood", + "dos-tcp_flood", + "dos-udp_flood", + "mirai-greeth_flood", + "mirai-greip_flood", + "mirai-udpplain", + "mitm-arpspoofing", + "recon-hostdiscovery", + "recon-osscan", + "recon-pingsweep", + "recon-portscan", + "sqlinjection", + "uploading_attack", + "vulnerabilityscan", + "xss" + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/config.yaml b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/config.yaml new file mode 100644 index 0000000..595a39e --- /dev/null +++ b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/config.yaml @@ -0,0 +1,34 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 42 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42 +seed: 42 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/history.json b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/history.json new file mode 100644 index 0000000..3f1c86c --- /dev/null +++ b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.3453861016493578, + 1.0185738587990785, + 0.817842674561036, + 0.6716240690304682, + 0.5847468177477518, + 0.5294667115578284, + 0.4960301426740793, + 0.4646051625410716, + 0.4428958419041756, + 0.42975847461284733, + 0.4069768710014148, + 0.4079588934397086, + 0.3905257605589353, + 0.37823548989418226, + 0.3606200371033106, + 0.34790722605509633, + 0.34596528838842344, + 0.3455842443001576, + 0.34004447169792956, + 0.33505640350855315, + 0.33155901309771413, + 0.31985981456744367, + 0.31471380591392517, + 0.3142473583038037, + 0.30966509611178666, + 0.3056103365543561, + 0.3059410288547858, + 0.30385619478347975, + 0.29647582884018236, + 0.2974971273006537, + 0.2940329699180065, + 0.28986206345069104, + 0.2943850243702913, + 0.28861378859250975, + 0.29319555522539675, + 0.2838875296024176, + 0.281383603429183, + 0.28157028479453844, + 0.28483708126422685, + 0.2791021714607875, + 0.2798184328354322, + 0.27748081699395793, + 0.2810215774254921, + 0.2744902108724301, + 0.2741397046125852, + 0.2772854283834115, + 0.2789883288817528, + 0.27952752166833633, + 0.2815561137902431, + 0.27390426320907396 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.2772818425, + "auroc_disc_nll_ch3": 0.864809535, + "auroc_disc_nll_ch4": 0.6118142875000001, + "auroc_disc_nll_ch5": 0.88182563, + "auroc_disc_nll_ch6": 0.4386769300000001, + "auroc_disc_nll_ch7": 0.8950903699999999, + "auroc_disc_nll_total": 0.81092567, + "auroc_terminal_flow": 0.912599485, + "auroc_terminal_norm": 0.9518424, + "auroc_terminal_packet": 0.951349035 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.3728174025, + "auroc_disc_nll_ch3": 0.8552687, + "auroc_disc_nll_ch4": 0.6326319225, + "auroc_disc_nll_ch5": 0.8033775925, + "auroc_disc_nll_ch6": 0.6543692725, + "auroc_disc_nll_ch7": 0.8993844099999999, + "auroc_disc_nll_total": 0.8506821499999999, + "auroc_terminal_flow": 0.9198812700000001, + "auroc_terminal_norm": 0.9596360625000001, + "auroc_terminal_packet": 0.9592762375 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.4562631775, + "auroc_disc_nll_ch3": 0.8835832025, + "auroc_disc_nll_ch4": 0.7661971999999999, + "auroc_disc_nll_ch5": 0.8345931325, + "auroc_disc_nll_ch6": 0.6743287275000001, + "auroc_disc_nll_ch7": 0.89111279, + "auroc_disc_nll_total": 0.888335845, + "auroc_terminal_flow": 0.91766, + "auroc_terminal_norm": 0.9599611375, + "auroc_terminal_packet": 0.96204819 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.46342690750000004, + "auroc_disc_nll_ch3": 0.8646238700000002, + "auroc_disc_nll_ch4": 0.7944144224999999, + "auroc_disc_nll_ch5": 0.784225105, + "auroc_disc_nll_ch6": 0.715705875, + "auroc_disc_nll_ch7": 0.8944349375, + "auroc_disc_nll_total": 0.89549919, + "auroc_terminal_flow": 0.9249829024999999, + "auroc_terminal_norm": 0.96309563, + "auroc_terminal_packet": 0.9660128625 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.46736415499999995, + "auroc_disc_nll_ch3": 0.859078875, + "auroc_disc_nll_ch4": 0.80484547, + "auroc_disc_nll_ch5": 0.78961214, + "auroc_disc_nll_ch6": 0.719200835, + "auroc_disc_nll_ch7": 0.89934585, + "auroc_disc_nll_total": 0.8925121675, + "auroc_terminal_flow": 0.9258674425000001, + "auroc_terminal_norm": 0.9641770024999999, + "auroc_terminal_packet": 0.9676136200000001 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/model.pt b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/model.pt new file mode 100644 index 0000000..95de76b Binary files /dev/null and b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/model.pt differ diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/phase1.log b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/phase1.log new file mode 100644 index 0000000..b3e6510 --- /dev/null +++ b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/phase1.log @@ -0,0 +1,69 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] kept 3,797,530 of 8,193,621 (min_len=2) +[data] train=77,636 val=10,000 attack=20,000 +[data] val=10,000 attack=20,000 +[eval] scoring val=5,000 atk=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.0s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] atk done 3.3s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/phase1_scores.npz b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/phase1_scores.npz new file mode 100644 index 0000000..16725d6 Binary files /dev/null and b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/phase1_summary.json b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/phase1_summary.json new file mode 100644 index 0000000..88675e9 --- /dev/null +++ b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed42/phase1_summary.json @@ -0,0 +1,462 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.46251025, + "auprc": 0.7264852645718889 + }, + "disc_nll_ch3": { + "auroc": 0.85649197, + "auprc": 0.9342562307525701 + }, + "disc_nll_ch4": { + "auroc": 0.8051460600000001, + "auprc": 0.8751179681632824 + }, + "disc_nll_ch5": { + "auroc": 0.78661433, + "auprc": 0.8908001103713774 + }, + "disc_nll_ch6": { + "auroc": 0.71958297, + "auprc": 0.828365154173216 + }, + "disc_nll_ch7": { + "auroc": 0.8967170999999999, + "auprc": 0.9536450088687509 + }, + "disc_nll_total": { + "auroc": 0.89066578, + "auprc": 0.9484733083158743 + }, + "terminal_flow": { + "auroc": 0.92726796, + "auprc": 0.9475992782679201 + }, + "terminal_norm": { + "auroc": 0.96530923, + "auprc": 0.9815215434184168 + }, + "terminal_packet": { + "auroc": 0.96730856, + "auprc": 0.9852635633621769 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 9.0, + "disc_nll_ch2": 0.5809222222222221, + "disc_nll_ch3": 0.5562777777777778, + "disc_nll_ch4": 0.5024777777777778, + "disc_nll_ch5": 0.29325555555555555, + "disc_nll_ch6": 0.6751222222222222, + "disc_nll_ch7": 0.6151888888888889, + "disc_nll_total": 0.6098333333333333, + "terminal_flow": 0.9202444444444444, + "terminal_norm": 0.9204666666666665, + "terminal_packet": 0.8533555555555555 + }, + "commandinjection": { + "_n": 11.0, + "disc_nll_ch2": 0.5048545454545454, + "disc_nll_ch3": 0.33456363636363634, + "disc_nll_ch4": 0.5145090909090909, + "disc_nll_ch5": 0.4927818181818181, + "disc_nll_ch6": 0.5822727272727273, + "disc_nll_ch7": 0.5471454545454545, + "disc_nll_total": 0.5190181818181818, + "terminal_flow": 0.7413636363636363, + "terminal_norm": 0.8729818181818181, + "terminal_packet": 0.8969818181818181 + }, + "ddos-ack_fragmentation": { + "_n": 310.0, + "disc_nll_ch2": 0.24714451612903224, + "disc_nll_ch3": 0.5279425806451613, + "disc_nll_ch4": 0.6599535483870969, + "disc_nll_ch5": 0.6988780645161291, + "disc_nll_ch6": 0.90256, + "disc_nll_ch7": 0.9658606451612903, + "disc_nll_total": 0.9229206451612905, + "terminal_flow": 0.9789412903225806, + "terminal_norm": 0.9877432258064517, + "terminal_packet": 0.9879929032258065 + }, + "ddos-http_flood": { + "_n": 918.0, + "disc_nll_ch2": 0.3740688453159042, + "disc_nll_ch3": 0.9423435729847494, + "disc_nll_ch4": 0.9134392156862745, + "disc_nll_ch5": 0.8704588235294118, + "disc_nll_ch6": 0.860914596949891, + "disc_nll_ch7": 0.9504605664488017, + "disc_nll_total": 0.966957734204793, + "terminal_flow": 0.9317934640522876, + "terminal_norm": 0.9860727668845315, + "terminal_packet": 0.9934803921568628 + }, + "ddos-icmp_flood": { + "_n": 24.0, + "disc_nll_ch2": 0.6375833333333334, + "disc_nll_ch3": 0.3863833333333333, + "disc_nll_ch4": 0.5055166666666666, + "disc_nll_ch5": 0.39867499999999995, + "disc_nll_ch6": 0.54145, + "disc_nll_ch7": 0.5654833333333333, + "disc_nll_total": 0.6518916666666666, + "terminal_flow": 0.6146333333333333, + "terminal_norm": 0.7276999999999999, + "terminal_packet": 0.7096416666666667 + }, + "ddos-icmp_fragmentation": { + "_n": 37.0, + "disc_nll_ch2": 0.5960972972972974, + "disc_nll_ch3": 0.4553243243243243, + "disc_nll_ch4": 0.5646810810810811, + "disc_nll_ch5": 0.3960702702702703, + "disc_nll_ch6": 0.6560702702702703, + "disc_nll_ch7": 0.6891027027027027, + "disc_nll_total": 0.6819405405405405, + "terminal_flow": 0.7864324324324324, + "terminal_norm": 0.8599837837837838, + "terminal_packet": 0.8681891891891893 + }, + "ddos-pshack_flood": { + "_n": 1030.0, + "disc_nll_ch2": 0.5480326213592234, + "disc_nll_ch3": 0.9884487378640777, + "disc_nll_ch4": 0.9796299029126214, + "disc_nll_ch5": 0.9241623300970874, + "disc_nll_ch6": 0.998466213592233, + "disc_nll_ch7": 0.9956588349514564, + "disc_nll_total": 0.9990225242718447, + "terminal_flow": 0.9626919417475729, + "terminal_norm": 0.9897627184466019, + "terminal_packet": 0.9958666019417476 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "disc_nll_ch2": 0.9812000000000001, + "disc_nll_ch3": 0.6275999999999999, + "disc_nll_ch4": 0.9472, + "disc_nll_ch5": 0.5579000000000001, + "disc_nll_ch6": 0.9488, + "disc_nll_ch7": 0.388, + "disc_nll_total": 0.9568000000000001, + "terminal_flow": 0.9544999999999999, + "terminal_norm": 0.8989, + "terminal_packet": 0.9618 + }, + "ddos-slowloris": { + "_n": 304.0, + "disc_nll_ch2": 0.8417598684210527, + "disc_nll_ch3": 0.807953947368421, + "disc_nll_ch4": 0.8504519736842104, + "disc_nll_ch5": 0.8470927631578948, + "disc_nll_ch6": 0.9040500000000001, + "disc_nll_ch7": 0.8320440789473684, + "disc_nll_total": 0.9426500000000001, + "terminal_flow": 0.898654605263158, + "terminal_norm": 0.9491894736842106, + "terminal_packet": 0.9727967105263158 + }, + "ddos-syn_flood": { + "_n": 1195.0, + "disc_nll_ch2": 0.11369037656903766, + "disc_nll_ch3": 0.9715092887029289, + "disc_nll_ch4": 0.8263261924686192, + "disc_nll_ch5": 0.7278933891213389, + "disc_nll_ch6": 0.5988726359832636, + "disc_nll_ch7": 0.816829958158996, + "disc_nll_total": 0.7559061087866109, + "terminal_flow": 0.9770369874476987, + "terminal_norm": 0.9967394142259415, + "terminal_packet": 0.9976992468619248 + }, + "ddos-synonymousip_flood": { + "_n": 164.0, + "disc_nll_ch2": 0.9016524390243902, + "disc_nll_ch3": 0.9998243902439026, + "disc_nll_ch4": 0.6331012195121951, + "disc_nll_ch5": 0.500590243902439, + "disc_nll_ch6": 0.5672219512195122, + "disc_nll_ch7": 0.9655634146341463, + "disc_nll_total": 0.9809646341463414, + "terminal_flow": 0.9999731707317073, + "terminal_norm": 0.9999951219512196, + "terminal_packet": 0.9995317073170731 + }, + "ddos-tcp_flood": { + "_n": 1255.0, + "disc_nll_ch2": 0.2083436653386454, + "disc_nll_ch3": 0.986913625498008, + "disc_nll_ch4": 0.9560618326693228, + "disc_nll_ch5": 0.681777529880478, + "disc_nll_ch6": 0.8121104382470119, + "disc_nll_ch7": 0.9970889243027888, + "disc_nll_total": 0.9681915537848607, + "terminal_flow": 0.9625067729083665, + "terminal_norm": 0.9924634262948208, + "terminal_packet": 0.9980347410358565 + }, + "ddos-udp_flood": { + "_n": 15.0, + "disc_nll_ch2": 0.36290666666666666, + "disc_nll_ch3": 0.6645333333333334, + "disc_nll_ch4": 0.25182666666666664, + "disc_nll_ch5": 0.14945333333333333, + "disc_nll_ch6": 0.3503733333333333, + "disc_nll_ch7": 0.6181866666666667, + "disc_nll_total": 0.3383066666666667, + "terminal_flow": 0.9334666666666667, + "terminal_norm": 0.9758533333333334, + "terminal_packet": 0.9890666666666666 + }, + "ddos-udp_fragmentation": { + "_n": 21.0, + "disc_nll_ch2": 0.5241714285714285, + "disc_nll_ch3": 0.5214952380952381, + "disc_nll_ch4": 0.3347809523809524, + "disc_nll_ch5": 0.36597619047619045, + "disc_nll_ch6": 0.4452761904761905, + "disc_nll_ch7": 0.44794285714285714, + "disc_nll_total": 0.5603904761904762, + "terminal_flow": 0.7595904761904763, + "terminal_norm": 0.8586761904761905, + "terminal_packet": 0.8814380952380952 + }, + "dictionarybruteforce": { + "_n": 21.0, + "disc_nll_ch2": 0.7225047619047619, + "disc_nll_ch3": 0.6308857142857143, + "disc_nll_ch4": 0.7388380952380953, + "disc_nll_ch5": 0.4591333333333333, + "disc_nll_ch6": 0.6794285714285714, + "disc_nll_ch7": 0.5842285714285714, + "disc_nll_total": 0.8136666666666665, + "terminal_flow": 0.8789428571428571, + "terminal_norm": 0.8861904761904762, + "terminal_packet": 0.8699809523809523 + }, + "dns_spoofing": { + "_n": 165.0, + "disc_nll_ch2": 0.37262181818181817, + "disc_nll_ch3": 0.5383248484848485, + "disc_nll_ch4": 0.4898551515151516, + "disc_nll_ch5": 0.3777975757575758, + "disc_nll_ch6": 0.5553927272727273, + "disc_nll_ch7": 0.5611163636363636, + "disc_nll_total": 0.5300351515151516, + "terminal_flow": 0.7695927272727273, + "terminal_norm": 0.8071103030303031, + "terminal_packet": 0.7831636363636364 + }, + "dos-http_flood": { + "_n": 716.0, + "disc_nll_ch2": 0.25876787709497207, + "disc_nll_ch3": 0.9105720670391062, + "disc_nll_ch4": 0.896395251396648, + "disc_nll_ch5": 0.9351308659217876, + "disc_nll_ch6": 0.9272864525139665, + "disc_nll_ch7": 0.9624972067039106, + "disc_nll_total": 0.9710184357541901, + "terminal_flow": 0.9238290502793296, + "terminal_norm": 0.9786346368715082, + "terminal_packet": 0.9813793296089386 + }, + "dos-syn_flood": { + "_n": 844.0, + "disc_nll_ch2": 0.8180824644549763, + "disc_nll_ch3": 0.9788573459715639, + "disc_nll_ch4": 0.7308986966824645, + "disc_nll_ch5": 0.9465592417061612, + "disc_nll_ch6": 0.4956962085308056, + "disc_nll_ch7": 0.9635182464454977, + "disc_nll_total": 0.9464478672985782, + "terminal_flow": 0.9656452606635071, + "terminal_norm": 0.9917594786729858, + "terminal_packet": 0.9961841232227487 + }, + "dos-tcp_flood": { + "_n": 1098.0, + "disc_nll_ch2": 0.7621846994535518, + "disc_nll_ch3": 0.8045517304189436, + "disc_nll_ch4": 0.7559393442622951, + "disc_nll_ch5": 0.9636338797814208, + "disc_nll_ch6": 0.6139825136612023, + "disc_nll_ch7": 0.9963475409836067, + "disc_nll_total": 0.9797817850637524, + "terminal_flow": 0.9585715846994536, + "terminal_norm": 0.9923466302367943, + "terminal_packet": 0.9974131147540984 + }, + "dos-udp_flood": { + "_n": 177.0, + "disc_nll_ch2": 0.9148011299435029, + "disc_nll_ch3": 0.07741581920903955, + "disc_nll_ch4": 0.523787570621469, + "disc_nll_ch5": 0.03956271186440679, + "disc_nll_ch6": 0.11735254237288137, + "disc_nll_ch7": 0.5631525423728814, + "disc_nll_total": 0.6310723163841808, + "terminal_flow": 0.9863627118644068, + "terminal_norm": 0.9976316384180791, + "terminal_packet": 0.9996327683615819 + }, + "mirai-greeth_flood": { + "_n": 8.0, + "disc_nll_ch2": 0.6093999999999999, + "disc_nll_ch3": 0.4436, + "disc_nll_ch4": 0.364, + "disc_nll_ch5": 0.43122499999999997, + "disc_nll_ch6": 0.46909999999999996, + "disc_nll_ch7": 0.430275, + "disc_nll_total": 0.5640750000000001, + "terminal_flow": 0.613875, + "terminal_norm": 0.674475, + "terminal_packet": 0.7206250000000001 + }, + "mirai-greip_flood": { + "_n": 29.0, + "disc_nll_ch2": 0.6665931034482758, + "disc_nll_ch3": 0.463351724137931, + "disc_nll_ch4": 0.6401586206896552, + "disc_nll_ch5": 0.5190068965517242, + "disc_nll_ch6": 0.6731655172413793, + "disc_nll_ch7": 0.7114827586206898, + "disc_nll_total": 0.7207655172413793, + "terminal_flow": 0.8894344827586207, + "terminal_norm": 0.9524068965517241, + "terminal_packet": 0.9605172413793105 + }, + "mirai-udpplain": { + "_n": 9.0, + "disc_nll_ch2": 0.6874666666666667, + "disc_nll_ch3": 0.6134888888888889, + "disc_nll_ch4": 0.5163111111111112, + "disc_nll_ch5": 0.5909333333333333, + "disc_nll_ch6": 0.6330666666666667, + "disc_nll_ch7": 0.5436222222222222, + "disc_nll_total": 0.8083777777777778, + "terminal_flow": 0.8317333333333333, + "terminal_norm": 0.8659333333333333, + "terminal_packet": 0.8960666666666666 + }, + "mitm-arpspoofing": { + "_n": 135.0, + "disc_nll_ch2": 0.6099911111111112, + "disc_nll_ch3": 0.3615385185185185, + "disc_nll_ch4": 0.5511192592592593, + "disc_nll_ch5": 0.3794037037037037, + "disc_nll_ch6": 0.5668814814814815, + "disc_nll_ch7": 0.573285925925926, + "disc_nll_total": 0.5965392592592591, + "terminal_flow": 0.7747644444444444, + "terminal_norm": 0.8584651851851852, + "terminal_packet": 0.8402785185185184 + }, + "recon-hostdiscovery": { + "_n": 165.0, + "disc_nll_ch2": 0.49030545454545454, + "disc_nll_ch3": 0.7130084848484848, + "disc_nll_ch4": 0.6711618181818181, + "disc_nll_ch5": 0.7182951515151514, + "disc_nll_ch6": 0.5687030303030303, + "disc_nll_ch7": 0.6807460606060607, + "disc_nll_total": 0.7129624242424243, + "terminal_flow": 0.8180951515151514, + "terminal_norm": 0.8655781818181819, + "terminal_packet": 0.80996 + }, + "recon-osscan": { + "_n": 368.0, + "disc_nll_ch2": 0.4357260869565217, + "disc_nll_ch3": 0.8308744565217391, + "disc_nll_ch4": 0.7082589673913043, + "disc_nll_ch5": 0.8181760869565218, + "disc_nll_ch6": 0.6376375, + "disc_nll_ch7": 0.8450309782608696, + "disc_nll_total": 0.8579266304347826, + "terminal_flow": 0.8769978260869565, + "terminal_norm": 0.9376002717391304, + "terminal_packet": 0.92885 + }, + "recon-pingsweep": { + "_n": 8.0, + "disc_nll_ch2": 0.6732499999999999, + "disc_nll_ch3": 0.350175, + "disc_nll_ch4": 0.5085500000000001, + "disc_nll_ch5": 0.398475, + "disc_nll_ch6": 0.4666, + "disc_nll_ch7": 0.5376, + "disc_nll_total": 0.6291250000000002, + "terminal_flow": 0.81345, + "terminal_norm": 0.940675, + "terminal_packet": 0.9215000000000001 + }, + "recon-portscan": { + "_n": 370.0, + "disc_nll_ch2": 0.45434648648648646, + "disc_nll_ch3": 0.8604937837837837, + "disc_nll_ch4": 0.7340172972972974, + "disc_nll_ch5": 0.8424097297297297, + "disc_nll_ch6": 0.6803518918918918, + "disc_nll_ch7": 0.8970202702702702, + "disc_nll_total": 0.8980064864864865, + "terminal_flow": 0.888855135135135, + "terminal_norm": 0.9307564864864863, + "terminal_packet": 0.9257194594594595 + }, + "sqlinjection": { + "_n": 11.0, + "disc_nll_ch2": 0.3856181818181818, + "disc_nll_ch3": 0.4423818181818182, + "disc_nll_ch4": 0.4993363636363637, + "disc_nll_ch5": 0.4204, + "disc_nll_ch6": 0.569490909090909, + "disc_nll_ch7": 0.5710727272727273, + "disc_nll_total": 0.4491454545454545, + "terminal_flow": 0.7286, + "terminal_norm": 0.8036363636363637, + "terminal_packet": 0.7466363636363635 + }, + "uploading_attack": { + "_n": 3.0, + "disc_nll_ch2": 0.6922, + "disc_nll_ch3": 0.03573333333333332, + "disc_nll_ch4": 0.3646, + "disc_nll_ch5": 0.2978666666666666, + "disc_nll_ch6": 0.4140666666666667, + "disc_nll_ch7": 0.5223333333333333, + "disc_nll_total": 0.6491333333333333, + "terminal_flow": 0.8649333333333333, + "terminal_norm": 0.9638666666666668, + "terminal_packet": 0.9885333333333333 + }, + "vulnerabilityscan": { + "_n": 568.0, + "disc_nll_ch2": 0.49938186619718306, + "disc_nll_ch3": 0.6133640845070423, + "disc_nll_ch4": 0.6276241197183099, + "disc_nll_ch5": 0.6420823943661972, + "disc_nll_ch6": 0.6034547535211268, + "disc_nll_ch7": 0.6696375000000001, + "disc_nll_total": 0.6771068661971831, + "terminal_flow": 0.7272049295774647, + "terminal_norm": 0.8077455985915494, + "terminal_packet": 0.8098369718309859 + }, + "xss": { + "_n": 10.0, + "disc_nll_ch2": 0.4324, + "disc_nll_ch3": 0.54136, + "disc_nll_ch4": 0.53176, + "disc_nll_ch5": 0.48732, + "disc_nll_ch6": 0.54784, + "disc_nll_ch7": 0.59362, + "disc_nll_total": 0.57756, + "terminal_flow": 0.88534, + "terminal_norm": 0.8681, + "terminal_packet": 0.79716 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/config.yaml b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/config.yaml new file mode 100644 index 0000000..01c08ed --- /dev/null +++ b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/config.yaml @@ -0,0 +1,34 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 43 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43 +seed: 43 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/history.json b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/history.json new file mode 100644 index 0000000..a0f4139 --- /dev/null +++ b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.3529853148338122, + 1.0243830191783416, + 0.8156614532837501, + 0.6867593267025092, + 0.601761309000162, + 0.5437260514650589, + 0.508475626890476, + 0.47988979327373016, + 0.4591925037212861, + 0.43705710768699646, + 0.4260031810173622, + 0.4025966723759969, + 0.3967203551378006, + 0.37767478059499693, + 0.37547202446521855, + 0.37039539294365126, + 0.35953183739613265, + 0.35427774221469194, + 0.34631694356600445, + 0.34186754471216446, + 0.33395597644341296, + 0.33460203806559247, + 0.3291240028845958, + 0.3203444121739803, + 0.31975913964785063, + 0.3235005614085075, + 0.31639890945874727, + 0.30626677931883395, + 0.30588787412032103, + 0.3001810805155681, + 0.2968691235933548, + 0.3044140415313916, + 0.29888626780265415, + 0.29433643970734036, + 0.2950186664477373, + 0.2955104616972116, + 0.2921721977301133, + 0.28991155326366425, + 0.29010525269386095, + 0.28594416227096164, + 0.29147133995325136, + 0.29348101829871154, + 0.28833328875211567, + 0.28949315502093387, + 0.2882140786984028, + 0.2870016759022688, + 0.28119308062088794, + 0.28855361464696055, + 0.2880656463213456, + 0.2831712957376089 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.292442675, + "auroc_disc_nll_ch3": 0.890569385, + "auroc_disc_nll_ch4": 0.64624423, + "auroc_disc_nll_ch5": 0.9109426475, + "auroc_disc_nll_ch6": 0.5260294225000001, + "auroc_disc_nll_ch7": 0.8655634699999999, + "auroc_disc_nll_total": 0.8475631750000001, + "auroc_terminal_flow": 0.9130514925, + "auroc_terminal_norm": 0.9371819050000001, + "auroc_terminal_packet": 0.9287332250000001 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.44002891499999996, + "auroc_disc_nll_ch3": 0.8711213550000001, + "auroc_disc_nll_ch4": 0.6340878275, + "auroc_disc_nll_ch5": 0.8055283775, + "auroc_disc_nll_ch6": 0.6138962125, + "auroc_disc_nll_ch7": 0.9050473524999999, + "auroc_disc_nll_total": 0.8747753175, + "auroc_terminal_flow": 0.9190915025, + "auroc_terminal_norm": 0.9550455575, + "auroc_terminal_packet": 0.949216925 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.40457181999999997, + "auroc_disc_nll_ch3": 0.87851927, + "auroc_disc_nll_ch4": 0.7821584875, + "auroc_disc_nll_ch5": 0.76875179, + "auroc_disc_nll_ch6": 0.6341356425, + "auroc_disc_nll_ch7": 0.9025240425000001, + "auroc_disc_nll_total": 0.885393595, + "auroc_terminal_flow": 0.9206975975, + "auroc_terminal_norm": 0.9490137775, + "auroc_terminal_packet": 0.957975975 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.38584719, + "auroc_disc_nll_ch3": 0.8783971024999999, + "auroc_disc_nll_ch4": 0.8179119125000001, + "auroc_disc_nll_ch5": 0.78526561, + "auroc_disc_nll_ch6": 0.6694424800000001, + "auroc_disc_nll_ch7": 0.904170285, + "auroc_disc_nll_total": 0.89593651, + "auroc_terminal_flow": 0.92174628, + "auroc_terminal_norm": 0.9588931, + "auroc_terminal_packet": 0.9638194899999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.3867477425, + "auroc_disc_nll_ch3": 0.876830145, + "auroc_disc_nll_ch4": 0.8157578349999999, + "auroc_disc_nll_ch5": 0.7801211775, + "auroc_disc_nll_ch6": 0.6726010699999999, + "auroc_disc_nll_ch7": 0.899462335, + "auroc_disc_nll_total": 0.890158845, + "auroc_terminal_flow": 0.922692505, + "auroc_terminal_norm": 0.9601319575, + "auroc_terminal_packet": 0.9664993675000001 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/model.pt b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/model.pt new file mode 100644 index 0000000..69f32cb Binary files /dev/null and b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/model.pt differ diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/phase1.log b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/phase1.log new file mode 100644 index 0000000..b5aa0a3 --- /dev/null +++ b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/phase1.log @@ -0,0 +1,69 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] kept 3,797,530 of 8,193,621 (min_len=2) +[data] train=77,636 val=10,000 attack=20,000 +[data] val=10,000 attack=20,000 +[eval] scoring val=5,000 atk=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.0s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] atk done 3.4s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/phase1_scores.npz b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/phase1_scores.npz new file mode 100644 index 0000000..b350627 Binary files /dev/null and b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/phase1_summary.json b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/phase1_summary.json new file mode 100644 index 0000000..bef53a8 --- /dev/null +++ b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed43/phase1_summary.json @@ -0,0 +1,475 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.38341548000000003, + "auprc": 0.6847358036548847 + }, + "disc_nll_ch3": { + "auroc": 0.87780359, + "auprc": 0.9441486788204795 + }, + "disc_nll_ch4": { + "auroc": 0.8189088700000001, + "auprc": 0.8778066769664612 + }, + "disc_nll_ch5": { + "auroc": 0.7819043999999999, + "auprc": 0.8907388587012792 + }, + "disc_nll_ch6": { + "auroc": 0.67649205, + "auprc": 0.8027051231924418 + }, + "disc_nll_ch7": { + "auroc": 0.89901213, + "auprc": 0.9578393281837503 + }, + "disc_nll_total": { + "auroc": 0.8902412, + "auprc": 0.9510527277220822 + }, + "terminal_flow": { + "auroc": 0.9237655100000002, + "auprc": 0.9417302651361564 + }, + "terminal_norm": { + "auroc": 0.96342223, + "auprc": 0.981220413546964 + }, + "terminal_packet": { + "auroc": 0.96749982, + "auprc": 0.9851151320107767 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 9.0, + "disc_nll_ch2": 0.6919777777777778, + "disc_nll_ch3": 0.26784444444444444, + "disc_nll_ch4": 0.34928888888888887, + "disc_nll_ch5": 0.22211111111111112, + "disc_nll_ch6": 0.5358888888888889, + "disc_nll_ch7": 0.4164888888888889, + "disc_nll_total": 0.6480222222222222, + "terminal_flow": 0.8182, + "terminal_norm": 0.9331555555555555, + "terminal_packet": 0.9632222222222222 + }, + "browserhijacking": { + "_n": 3.0, + "disc_nll_ch2": 0.31486666666666663, + "disc_nll_ch3": 0.3586, + "disc_nll_ch4": 0.4251333333333333, + "disc_nll_ch5": 0.43126666666666663, + "disc_nll_ch6": 0.2755333333333333, + "disc_nll_ch7": 0.32919999999999994, + "disc_nll_total": 0.5038, + "terminal_flow": 0.8238666666666666, + "terminal_norm": 0.8767999999999999, + "terminal_packet": 0.7282 + }, + "commandinjection": { + "_n": 13.0, + "disc_nll_ch2": 0.6559923076923077, + "disc_nll_ch3": 0.45459230769230763, + "disc_nll_ch4": 0.42686153846153846, + "disc_nll_ch5": 0.3349, + "disc_nll_ch6": 0.4611461538461539, + "disc_nll_ch7": 0.3346846153846154, + "disc_nll_total": 0.6668538461538461, + "terminal_flow": 0.8585, + "terminal_norm": 0.8562384615384615, + "terminal_packet": 0.8296999999999999 + }, + "ddos-ack_fragmentation": { + "_n": 316.0, + "disc_nll_ch2": 0.10862784810126583, + "disc_nll_ch3": 0.5974310126582278, + "disc_nll_ch4": 0.7393335443037974, + "disc_nll_ch5": 0.7824917721518987, + "disc_nll_ch6": 0.9394177215189874, + "disc_nll_ch7": 0.9423746835443038, + "disc_nll_total": 0.9389487341772151, + "terminal_flow": 0.9855373417721519, + "terminal_norm": 0.9919272151898735, + "terminal_packet": 0.9903462025316455 + }, + "ddos-http_flood": { + "_n": 915.0, + "disc_nll_ch2": 0.35639300546448094, + "disc_nll_ch3": 0.9443713661202187, + "disc_nll_ch4": 0.8813781420765027, + "disc_nll_ch5": 0.8659884153005465, + "disc_nll_ch6": 0.7177377049180329, + "disc_nll_ch7": 0.9539409836065573, + "disc_nll_total": 0.9643790163934427, + "terminal_flow": 0.9474537704918033, + "terminal_norm": 0.9888217486338798, + "terminal_packet": 0.9943903825136612 + }, + "ddos-icmp_flood": { + "_n": 20.0, + "disc_nll_ch2": 0.5625899999999999, + "disc_nll_ch3": 0.3819100000000001, + "disc_nll_ch4": 0.5079199999999999, + "disc_nll_ch5": 0.51221, + "disc_nll_ch6": 0.61357, + "disc_nll_ch7": 0.6384700000000001, + "disc_nll_total": 0.62042, + "terminal_flow": 0.6338999999999999, + "terminal_norm": 0.76536, + "terminal_packet": 0.7819100000000001 + }, + "ddos-icmp_fragmentation": { + "_n": 38.0, + "disc_nll_ch2": 0.6300473684210526, + "disc_nll_ch3": 0.2995368421052631, + "disc_nll_ch4": 0.39303157894736845, + "disc_nll_ch5": 0.32304736842105264, + "disc_nll_ch6": 0.4953421052631579, + "disc_nll_ch7": 0.5290421052631578, + "disc_nll_total": 0.5609421052631579, + "terminal_flow": 0.711042105263158, + "terminal_norm": 0.8458157894736843, + "terminal_packet": 0.8729473684210527 + }, + "ddos-pshack_flood": { + "_n": 1046.0, + "disc_nll_ch2": 0.06705717017208412, + "disc_nll_ch3": 0.9966602294455067, + "disc_nll_ch4": 0.9234485659655831, + "disc_nll_ch5": 0.6539544933078395, + "disc_nll_ch6": 0.9998391969407265, + "disc_nll_ch7": 0.9960246653919694, + "disc_nll_total": 0.9998472275334608, + "terminal_flow": 0.9551791586998087, + "terminal_norm": 0.9822544933078394, + "terminal_packet": 0.9892789674952199 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "disc_nll_ch2": 0.06419999999999998, + "disc_nll_ch3": 0.5376000000000001, + "disc_nll_ch4": 0.4484, + "disc_nll_ch5": 0.6397, + "disc_nll_ch6": 0.5563, + "disc_nll_ch7": 0.3621, + "disc_nll_total": 0.41559999999999997, + "terminal_flow": 0.2591, + "terminal_norm": 0.5236, + "terminal_packet": 0.6313 + }, + "ddos-slowloris": { + "_n": 314.0, + "disc_nll_ch2": 0.8480089171974522, + "disc_nll_ch3": 0.801359872611465, + "disc_nll_ch4": 0.8452528662420381, + "disc_nll_ch5": 0.8201980891719747, + "disc_nll_ch6": 0.8982917197452229, + "disc_nll_ch7": 0.8322092356687898, + "disc_nll_total": 0.9201891719745223, + "terminal_flow": 0.8933808917197453, + "terminal_norm": 0.9364929936305733, + "terminal_packet": 0.9639426751592356 + }, + "ddos-syn_flood": { + "_n": 1141.0, + "disc_nll_ch2": 0.12468851884312006, + "disc_nll_ch3": 0.937791235758107, + "disc_nll_ch4": 0.8895772129710778, + "disc_nll_ch5": 0.9334671340929009, + "disc_nll_ch6": 0.6010532865907099, + "disc_nll_ch7": 0.9620652059596846, + "disc_nll_total": 0.8405251533742332, + "terminal_flow": 0.9712012269938649, + "terminal_norm": 0.9979302366345312, + "terminal_packet": 0.9989659947414549 + }, + "ddos-synonymousip_flood": { + "_n": 182.0, + "disc_nll_ch2": 0.9082164835164834, + "disc_nll_ch3": 0.9811362637362637, + "disc_nll_ch4": 0.6321285714285715, + "disc_nll_ch5": 0.6400604395604396, + "disc_nll_ch6": 0.6454989010989011, + "disc_nll_ch7": 0.9721912087912088, + "disc_nll_total": 0.8921406593406593, + "terminal_flow": 0.9987626373626375, + "terminal_norm": 0.9984318681318681, + "terminal_packet": 0.9976318681318682 + }, + "ddos-tcp_flood": { + "_n": 1224.0, + "disc_nll_ch2": 0.02231568627450979, + "disc_nll_ch3": 0.9983735294117647, + "disc_nll_ch4": 0.9651285947712419, + "disc_nll_ch5": 0.694957679738562, + "disc_nll_ch6": 0.6515336601307189, + "disc_nll_ch7": 0.9970602941176471, + "disc_nll_total": 0.9888191176470588, + "terminal_flow": 0.9514199346405228, + "terminal_norm": 0.985017320261438, + "terminal_packet": 0.9912624183006535 + }, + "ddos-udp_flood": { + "_n": 10.0, + "disc_nll_ch2": 0.70286, + "disc_nll_ch3": 0.63884, + "disc_nll_ch4": 0.30089999999999995, + "disc_nll_ch5": 0.11348000000000001, + "disc_nll_ch6": 0.31732000000000005, + "disc_nll_ch7": 0.68858, + "disc_nll_total": 0.51926, + "terminal_flow": 0.95444, + "terminal_norm": 0.98352, + "terminal_packet": 0.9941199999999999 + }, + "ddos-udp_fragmentation": { + "_n": 26.0, + "disc_nll_ch2": 0.43673076923076914, + "disc_nll_ch3": 0.49770000000000003, + "disc_nll_ch4": 0.3202153846153846, + "disc_nll_ch5": 0.29346923076923076, + "disc_nll_ch6": 0.28626153846153846, + "disc_nll_ch7": 0.3927615384615384, + "disc_nll_total": 0.48506153846153843, + "terminal_flow": 0.8037846153846154, + "terminal_norm": 0.842223076923077, + "terminal_packet": 0.8123076923076923 + }, + "dictionarybruteforce": { + "_n": 19.0, + "disc_nll_ch2": 0.5302736842105262, + "disc_nll_ch3": 0.4414, + "disc_nll_ch4": 0.4359578947368421, + "disc_nll_ch5": 0.25829473684210524, + "disc_nll_ch6": 0.43593684210526307, + "disc_nll_ch7": 0.4375578947368421, + "disc_nll_total": 0.5623789473684211, + "terminal_flow": 0.8075263157894738, + "terminal_norm": 0.8531157894736843, + "terminal_packet": 0.8198842105263158 + }, + "dns_spoofing": { + "_n": 185.0, + "disc_nll_ch2": 0.44560378378378374, + "disc_nll_ch3": 0.5470043243243244, + "disc_nll_ch4": 0.5247302702702703, + "disc_nll_ch5": 0.3716670270270271, + "disc_nll_ch6": 0.4865048648648649, + "disc_nll_ch7": 0.4048724324324324, + "disc_nll_total": 0.5379735135135135, + "terminal_flow": 0.7680324324324325, + "terminal_norm": 0.8132940540540541, + "terminal_packet": 0.7697924324324326 + }, + "dos-http_flood": { + "_n": 704.0, + "disc_nll_ch2": 0.2512681818181818, + "disc_nll_ch3": 0.9168071022727273, + "disc_nll_ch4": 0.8877605113636363, + "disc_nll_ch5": 0.9475545454545454, + "disc_nll_ch6": 0.9114616477272726, + "disc_nll_ch7": 0.9536491477272728, + "disc_nll_total": 0.9760454545454545, + "terminal_flow": 0.955525, + "terminal_norm": 0.9870985795454547, + "terminal_packet": 0.9879184659090908 + }, + "dos-syn_flood": { + "_n": 874.0, + "disc_nll_ch2": 0.8238068649885583, + "disc_nll_ch3": 0.9587970251716248, + "disc_nll_ch4": 0.8156189931350114, + "disc_nll_ch5": 0.9671201372997712, + "disc_nll_ch6": 0.3808540045766591, + "disc_nll_ch7": 0.9810432494279175, + "disc_nll_total": 0.9509723112128147, + "terminal_flow": 0.9542850114416475, + "terminal_norm": 0.9966164759725401, + "terminal_packet": 0.9989368421052631 + }, + "dos-tcp_flood": { + "_n": 1076.0, + "disc_nll_ch2": 0.7645583643122675, + "disc_nll_ch3": 0.9488330855018587, + "disc_nll_ch4": 0.9095637546468403, + "disc_nll_ch5": 0.958599442379182, + "disc_nll_ch6": 0.6123808550185874, + "disc_nll_ch7": 0.9978695167286245, + "disc_nll_total": 0.9881455390334573, + "terminal_flow": 0.9475003717472118, + "terminal_norm": 0.990085687732342, + "terminal_packet": 0.9966631970260222 + }, + "dos-udp_flood": { + "_n": 201.0, + "disc_nll_ch2": 0.47871044776119404, + "disc_nll_ch3": 0.6359422885572139, + "disc_nll_ch4": 0.368252736318408, + "disc_nll_ch5": 0.07556218905472635, + "disc_nll_ch6": 0.08928358208955225, + "disc_nll_ch7": 0.08807960199004976, + "disc_nll_total": 0.031069651741293502, + "terminal_flow": 0.9664019900497511, + "terminal_norm": 0.9603273631840796, + "terminal_packet": 0.9888845771144279 + }, + "mirai-greeth_flood": { + "_n": 16.0, + "disc_nll_ch2": 0.5583625, + "disc_nll_ch3": 0.38431249999999995, + "disc_nll_ch4": 0.367125, + "disc_nll_ch5": 0.37895, + "disc_nll_ch6": 0.393625, + "disc_nll_ch7": 0.29235, + "disc_nll_total": 0.5045625, + "terminal_flow": 0.53285625, + "terminal_norm": 0.5953874999999998, + "terminal_packet": 0.6292875 + }, + "mirai-greip_flood": { + "_n": 25.0, + "disc_nll_ch2": 0.631664, + "disc_nll_ch3": 0.45157600000000003, + "disc_nll_ch4": 0.45322400000000007, + "disc_nll_ch5": 0.43733600000000006, + "disc_nll_ch6": 0.551216, + "disc_nll_ch7": 0.560816, + "disc_nll_total": 0.7046400000000002, + "terminal_flow": 0.8432160000000001, + "terminal_norm": 0.92416, + "terminal_packet": 0.9437039999999999 + }, + "mirai-udpplain": { + "_n": 8.0, + "disc_nll_ch2": 0.54975, + "disc_nll_ch3": 0.5178, + "disc_nll_ch4": 0.55105, + "disc_nll_ch5": 0.548775, + "disc_nll_ch6": 0.6066750000000001, + "disc_nll_ch7": 0.659375, + "disc_nll_total": 0.85145, + "terminal_flow": 0.8617750000000001, + "terminal_norm": 0.9181250000000001, + "terminal_packet": 0.9092500000000001 + }, + "mitm-arpspoofing": { + "_n": 137.0, + "disc_nll_ch2": 0.5837773722627738, + "disc_nll_ch3": 0.3720430656934307, + "disc_nll_ch4": 0.4354664233576643, + "disc_nll_ch5": 0.26524087591240875, + "disc_nll_ch6": 0.5673978102189781, + "disc_nll_ch7": 0.5532350364963504, + "disc_nll_total": 0.6006569343065693, + "terminal_flow": 0.7770576642335768, + "terminal_norm": 0.8663051094890512, + "terminal_packet": 0.8559649635036495 + }, + "recon-hostdiscovery": { + "_n": 163.0, + "disc_nll_ch2": 0.45460122699386496, + "disc_nll_ch3": 0.6961288343558283, + "disc_nll_ch4": 0.6406288343558282, + "disc_nll_ch5": 0.7140466257668712, + "disc_nll_ch6": 0.6219386503067486, + "disc_nll_ch7": 0.6825392638036809, + "disc_nll_total": 0.7314361963190184, + "terminal_flow": 0.7584852760736197, + "terminal_norm": 0.8288809815950919, + "terminal_packet": 0.7872398773006135 + }, + "recon-osscan": { + "_n": 352.0, + "disc_nll_ch2": 0.44637471590909095, + "disc_nll_ch3": 0.8308582386363637, + "disc_nll_ch4": 0.6970446022727272, + "disc_nll_ch5": 0.7840014204545455, + "disc_nll_ch6": 0.6437142045454545, + "disc_nll_ch7": 0.8376073863636364, + "disc_nll_total": 0.8591204545454545, + "terminal_flow": 0.8826073863636363, + "terminal_norm": 0.9445102272727274, + "terminal_packet": 0.9442755681818182 + }, + "recon-pingsweep": { + "_n": 4.0, + "disc_nll_ch2": 0.6647500000000001, + "disc_nll_ch3": 0.6015, + "disc_nll_ch4": 0.6738000000000001, + "disc_nll_ch5": 0.5675, + "disc_nll_ch6": 0.7281, + "disc_nll_ch7": 0.63495, + "disc_nll_total": 0.6743, + "terminal_flow": 0.7671500000000001, + "terminal_norm": 0.96385, + "terminal_packet": 0.99395 + }, + "recon-portscan": { + "_n": 385.0, + "disc_nll_ch2": 0.44380363636363634, + "disc_nll_ch3": 0.859554025974026, + "disc_nll_ch4": 0.7069883116883117, + "disc_nll_ch5": 0.8399568831168831, + "disc_nll_ch6": 0.6742898701298701, + "disc_nll_ch7": 0.8898280519480519, + "disc_nll_total": 0.9004883116883117, + "terminal_flow": 0.8983062337662338, + "terminal_norm": 0.9518358441558442, + "terminal_packet": 0.9585932467532469 + }, + "sqlinjection": { + "_n": 11.0, + "disc_nll_ch2": 0.7870909090909091, + "disc_nll_ch3": 0.5295818181818182, + "disc_nll_ch4": 0.6368727272727273, + "disc_nll_ch5": 0.4183454545454546, + "disc_nll_ch6": 0.7506545454545455, + "disc_nll_ch7": 0.5447818181818183, + "disc_nll_total": 0.7336545454545454, + "terminal_flow": 0.7154, + "terminal_norm": 0.8415818181818183, + "terminal_packet": 0.8927454545454546 + }, + "uploading_attack": { + "_n": 2.0, + "disc_nll_ch2": 0.4875, + "disc_nll_ch3": 0.6504, + "disc_nll_ch4": 0.5304, + "disc_nll_ch5": 0.2108, + "disc_nll_ch6": 0.7387, + "disc_nll_ch7": 0.5986, + "disc_nll_total": 0.4743, + "terminal_flow": 0.9552999999999999, + "terminal_norm": 0.8849, + "terminal_packet": 0.8254 + }, + "vulnerabilityscan": { + "_n": 567.0, + "disc_nll_ch2": 0.5189996472663139, + "disc_nll_ch3": 0.610121164021164, + "disc_nll_ch4": 0.6072927689594356, + "disc_nll_ch5": 0.6164481481481481, + "disc_nll_ch6": 0.6500954144620811, + "disc_nll_ch7": 0.693794356261023, + "disc_nll_total": 0.6870495590828924, + "terminal_flow": 0.723262962962963, + "terminal_norm": 0.8061063492063492, + "terminal_packet": 0.8212070546737213 + }, + "xss": { + "_n": 12.0, + "disc_nll_ch2": 0.5812833333333334, + "disc_nll_ch3": 0.4120833333333334, + "disc_nll_ch4": 0.3960666666666667, + "disc_nll_ch5": 0.20569166666666666, + "disc_nll_ch6": 0.58675, + "disc_nll_ch7": 0.5417166666666667, + "disc_nll_total": 0.5041833333333334, + "terminal_flow": 0.79855, + "terminal_norm": 0.8732666666666666, + "terminal_packet": 0.8735333333333333 + } + } +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/config.yaml b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/config.yaml new file mode 100644 index 0000000..7647a15 --- /dev/null +++ b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/config.yaml @@ -0,0 +1,34 @@ +T: 64 +attack_cap: 20000 +batch_size: 256 +benign_label: normal +d_model: 128 +data_seed: 44 +device: auto +epochs: 50 +eval_batch_size: 512 +eval_every: 10 +eval_n: 20000 +eval_n_steps: 8 +flow_features_align: auto +flow_features_path: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/flow_features.parquet +flows_parquet: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet +grad_clip: 1.0 +lambda_disc: 1.0 +lr: 0.0003 +min_len: 2 +mlp_ratio: 4.0 +n_heads: 4 +n_layers: 4 +n_train: 10000 +num_workers: 0 +save_dir: /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44 +seed: 44 +sigma: 0.1 +source_store: /home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +time_dim: 64 +token_dim: null +train_ratio: 0.8 +use_ot: true +val_cap: 10000 +weight_decay: 0.01 diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/history.json b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/history.json new file mode 100644 index 0000000..5fe0d8c --- /dev/null +++ b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/history.json @@ -0,0 +1,213 @@ +{ + "epoch": [ + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 49, + 50 + ], + "loss": [ + 1.3570655859433687, + 1.0216891521062605, + 0.8214074847025749, + 0.6899559436700283, + 0.5990307575617081, + 0.540643186141283, + 0.5072793593773475, + 0.4798747186477368, + 0.45895149998175794, + 0.4340557945080293, + 0.4239514531233372, + 0.4045257621850723, + 0.4008154578697987, + 0.39067582900707537, + 0.37529076139132184, + 0.37319996341680867, + 0.36139559516539943, + 0.35596729547549516, + 0.3498165469903212, + 0.3383242373283093, + 0.34044957619446975, + 0.3330478523022089, + 0.32971480794442004, + 0.3290783044619438, + 0.3232526259544568, + 0.31600920664958465, + 0.3146598851069426, + 0.3153374240948604, + 0.3031086375315984, + 0.3036183485618004, + 0.30658450417029554, + 0.307016875117253, + 0.2984646062056224, + 0.2989320858166768, + 0.29126364298355883, + 0.2923388790625792, + 0.2951461932598016, + 0.2955377499262492, + 0.2909684781080637, + 0.2906965781480838, + 0.28478026466491896, + 0.28514549671075284, + 0.2836846323349537, + 0.29102446406315535, + 0.29136889217755735, + 0.28287185919590485, + 0.28574894827145797, + 0.2878103332641797, + 0.28830762131091875, + 0.2865547205393131 + ], + "eval": [ + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.2984102425, + "auroc_disc_nll_ch3": 0.7985552250000001, + "auroc_disc_nll_ch4": 0.6210864575000001, + "auroc_disc_nll_ch5": 0.8808441550000001, + "auroc_disc_nll_ch6": 0.600991925, + "auroc_disc_nll_ch7": 0.8721486274999999, + "auroc_disc_nll_total": 0.8449822075, + "auroc_terminal_flow": 0.8962870025, + "auroc_terminal_norm": 0.9356241999999999, + "auroc_terminal_packet": 0.9313577574999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.3923669425, + "auroc_disc_nll_ch3": 0.8648452200000001, + "auroc_disc_nll_ch4": 0.58381567, + "auroc_disc_nll_ch5": 0.647636705, + "auroc_disc_nll_ch6": 0.6438143574999999, + "auroc_disc_nll_ch7": 0.8679283624999999, + "auroc_disc_nll_total": 0.846874715, + "auroc_terminal_flow": 0.9181020275, + "auroc_terminal_norm": 0.9525839625, + "auroc_terminal_packet": 0.9616808124999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.4032068275, + "auroc_disc_nll_ch3": 0.8793614949999999, + "auroc_disc_nll_ch4": 0.7121029449999999, + "auroc_disc_nll_ch5": 0.7913129175, + "auroc_disc_nll_ch6": 0.6977496049999999, + "auroc_disc_nll_ch7": 0.8426869625000001, + "auroc_disc_nll_total": 0.8613177974999999, + "auroc_terminal_flow": 0.9119212074999999, + "auroc_terminal_norm": 0.954336085, + "auroc_terminal_packet": 0.9627499524999998 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.44072770250000004, + "auroc_disc_nll_ch3": 0.8707405675, + "auroc_disc_nll_ch4": 0.7994842249999999, + "auroc_disc_nll_ch5": 0.8004600575, + "auroc_disc_nll_ch6": 0.718409875, + "auroc_disc_nll_ch7": 0.8550576625, + "auroc_disc_nll_total": 0.8743178924999999, + "auroc_terminal_flow": 0.91206158, + "auroc_terminal_norm": 0.9576820100000001, + "auroc_terminal_packet": 0.9666986599999999 + }, + null, + null, + null, + null, + null, + null, + null, + null, + null, + { + "auroc_disc_nll_ch2": 0.4426730375, + "auroc_disc_nll_ch3": 0.8702319624999999, + "auroc_disc_nll_ch4": 0.80200322, + "auroc_disc_nll_ch5": 0.80327937, + "auroc_disc_nll_ch6": 0.718836465, + "auroc_disc_nll_ch7": 0.852267095, + "auroc_disc_nll_total": 0.8774636949999999, + "auroc_terminal_flow": 0.9164881125000001, + "auroc_terminal_norm": 0.9581631125000001, + "auroc_terminal_packet": 0.9659071075000001 + } + ] +} \ No newline at end of file diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/model.pt b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/model.pt new file mode 100644 index 0000000..97acab1 Binary files /dev/null and b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/model.pt differ diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/phase1.log b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/phase1.log new file mode 100644 index 0000000..55c0ece --- /dev/null +++ b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/phase1.log @@ -0,0 +1,69 @@ +[model] T=64 flow_dim=20 +[data] flows=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store/flows.parquet packets=/home/chy/mambafortrafficmodeling/datasets/ciciot2023/processed/full_store +[data] kept 3,797,530 of 8,193,621 (min_len=2) +[data] train=77,636 val=10,000 attack=20,000 +[data] val=10,000 attack=20,000 +[eval] scoring val=5,000 atk=10,000 +[score] 256/5,000 +[score] 512/5,000 +[score] 768/5,000 +[score] 1,024/5,000 +[score] 1,280/5,000 +[score] 1,536/5,000 +[score] 1,792/5,000 +[score] 2,048/5,000 +[score] 2,304/5,000 +[score] 2,560/5,000 +[score] 2,816/5,000 +[score] 3,072/5,000 +[score] 3,328/5,000 +[score] 3,584/5,000 +[score] 3,840/5,000 +[score] 4,096/5,000 +[score] 4,352/5,000 +[score] 4,608/5,000 +[score] 4,864/5,000 +[score] 5,000/5,000 +[eval] val done 2.0s +[score] 256/10,000 +[score] 512/10,000 +[score] 768/10,000 +[score] 1,024/10,000 +[score] 1,280/10,000 +[score] 1,536/10,000 +[score] 1,792/10,000 +[score] 2,048/10,000 +[score] 2,304/10,000 +[score] 2,560/10,000 +[score] 2,816/10,000 +[score] 3,072/10,000 +[score] 3,328/10,000 +[score] 3,584/10,000 +[score] 3,840/10,000 +[score] 4,096/10,000 +[score] 4,352/10,000 +[score] 4,608/10,000 +[score] 4,864/10,000 +[score] 5,120/10,000 +[score] 5,376/10,000 +[score] 5,632/10,000 +[score] 5,888/10,000 +[score] 6,144/10,000 +[score] 6,400/10,000 +[score] 6,656/10,000 +[score] 6,912/10,000 +[score] 7,168/10,000 +[score] 7,424/10,000 +[score] 7,680/10,000 +[score] 7,936/10,000 +[score] 8,192/10,000 +[score] 8,448/10,000 +[score] 8,704/10,000 +[score] 8,960/10,000 +[score] 9,216/10,000 +[score] 9,472/10,000 +[score] 9,728/10,000 +[score] 9,984/10,000 +[score] 10,000/10,000 +[eval] atk done 3.4s +[wrote] /home/chy/mambafortrafficmodeling/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/phase1_summary.json keys=10 diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/phase1_scores.npz b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/phase1_scores.npz new file mode 100644 index 0000000..b0fd86c Binary files /dev/null and b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/phase1_scores.npz differ diff --git a/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/phase1_summary.json b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/phase1_summary.json new file mode 100644 index 0000000..4289a87 --- /dev/null +++ b/artifacts/route_comparison/route_c_mixed_ciciot2023_seed44/phase1_summary.json @@ -0,0 +1,475 @@ +{ + "overall": { + "disc_nll_ch2": { + "auroc": 0.44199253, + "auprc": 0.7059012014198583 + }, + "disc_nll_ch3": { + "auroc": 0.87007191, + "auprc": 0.9378467025284201 + }, + "disc_nll_ch4": { + "auroc": 0.80043804, + "auprc": 0.8548528100206685 + }, + "disc_nll_ch5": { + "auroc": 0.80055111, + "auprc": 0.8974478549488849 + }, + "disc_nll_ch6": { + "auroc": 0.71648278, + "auprc": 0.8251198215584312 + }, + "disc_nll_ch7": { + "auroc": 0.84980943, + "auprc": 0.932885436962573 + }, + "disc_nll_total": { + "auroc": 0.8748700899999999, + "auprc": 0.9403738513358806 + }, + "terminal_flow": { + "auroc": 0.9172153499999999, + "auprc": 0.9398807081650811 + }, + "terminal_norm": { + "auroc": 0.9586512300000001, + "auprc": 0.9767595740561783 + }, + "terminal_packet": { + "auroc": 0.96539244, + "auprc": 0.9833966653731828 + } + }, + "per_class": { + "backdoor_malware": { + "_n": 7.0, + "disc_nll_ch2": 0.6239714285714285, + "disc_nll_ch3": 0.4213714285714285, + "disc_nll_ch4": 0.4735714285714286, + "disc_nll_ch5": 0.3798571428571429, + "disc_nll_ch6": 0.40205714285714284, + "disc_nll_ch7": 0.41445714285714286, + "disc_nll_total": 0.5634571428571428, + "terminal_flow": 0.7775714285714285, + "terminal_norm": 0.9395428571428572, + "terminal_packet": 0.8533999999999999 + }, + "browserhijacking": { + "_n": 9.0, + "disc_nll_ch2": 0.6549555555555555, + "disc_nll_ch3": 0.5916888888888889, + "disc_nll_ch4": 0.608411111111111, + "disc_nll_ch5": 0.35235555555555553, + "disc_nll_ch6": 0.6137444444444444, + "disc_nll_ch7": 0.47359999999999997, + "disc_nll_total": 0.6685555555555557, + "terminal_flow": 0.7109777777777778, + "terminal_norm": 0.7289777777777778, + "terminal_packet": 0.7308222222222222 + }, + "commandinjection": { + "_n": 11.0, + "disc_nll_ch2": 0.5624181818181818, + "disc_nll_ch3": 0.4935636363636363, + "disc_nll_ch4": 0.44687272727272725, + "disc_nll_ch5": 0.3466181818181818, + "disc_nll_ch6": 0.6137999999999999, + "disc_nll_ch7": 0.4774909090909091, + "disc_nll_total": 0.5846, + "terminal_flow": 0.8611454545454545, + "terminal_norm": 0.9146545454545454, + "terminal_packet": 0.9309818181818181 + }, + "ddos-ack_fragmentation": { + "_n": 340.0, + "disc_nll_ch2": 0.4739870588235294, + "disc_nll_ch3": 0.7075523529411766, + "disc_nll_ch4": 0.6305688235294118, + "disc_nll_ch5": 0.8339811764705882, + "disc_nll_ch6": 0.9535926470588235, + "disc_nll_ch7": 0.9664976470588235, + "disc_nll_total": 0.9654299999999999, + "terminal_flow": 0.9773655882352941, + "terminal_norm": 0.9861758823529411, + "terminal_packet": 0.9826958823529411 + }, + "ddos-http_flood": { + "_n": 893.0, + "disc_nll_ch2": 0.4127979843225084, + "disc_nll_ch3": 0.957395744680851, + "disc_nll_ch4": 0.8757292273236281, + "disc_nll_ch5": 0.9013334826427772, + "disc_nll_ch6": 0.859972228443449, + "disc_nll_ch7": 0.9357384098544231, + "disc_nll_total": 0.9731688689809631, + "terminal_flow": 0.9211151175811869, + "terminal_norm": 0.9835399776035835, + "terminal_packet": 0.994752967525196 + }, + "ddos-icmp_flood": { + "_n": 20.0, + "disc_nll_ch2": 0.51642, + "disc_nll_ch3": 0.56091, + "disc_nll_ch4": 0.49918, + "disc_nll_ch5": 0.51061, + "disc_nll_ch6": 0.54466, + "disc_nll_ch7": 0.5421600000000001, + "disc_nll_total": 0.56865, + "terminal_flow": 0.68172, + "terminal_norm": 0.7443, + "terminal_packet": 0.76749 + }, + "ddos-icmp_fragmentation": { + "_n": 35.0, + "disc_nll_ch2": 0.6678571428571428, + "disc_nll_ch3": 0.3856342857142857, + "disc_nll_ch4": 0.45959999999999995, + "disc_nll_ch5": 0.4110114285714286, + "disc_nll_ch6": 0.5168857142857144, + "disc_nll_ch7": 0.5125371428571429, + "disc_nll_total": 0.6002628571428572, + "terminal_flow": 0.7667228571428572, + "terminal_norm": 0.8984628571428572, + "terminal_packet": 0.92072 + }, + "ddos-pshack_flood": { + "_n": 1065.0, + "disc_nll_ch2": 0.452021220657277, + "disc_nll_ch3": 0.9948967136150234, + "disc_nll_ch4": 0.9549055399061034, + "disc_nll_ch5": 0.7093769014084508, + "disc_nll_ch6": 0.9999590610328639, + "disc_nll_ch7": 0.9942514553990611, + "disc_nll_total": 0.998556807511737, + "terminal_flow": 0.9527566197183098, + "terminal_norm": 0.9825665727699532, + "terminal_packet": 0.994032676056338 + }, + "ddos-rstfinflood": { + "_n": 2.0, + "disc_nll_ch2": 0.6572, + "disc_nll_ch3": 0.495, + "disc_nll_ch4": 0.5938, + "disc_nll_ch5": 0.5302, + "disc_nll_ch6": 0.612, + "disc_nll_ch7": 0.4669, + "disc_nll_total": 0.6547, + "terminal_flow": 0.5597000000000001, + "terminal_norm": 0.7378, + "terminal_packet": 0.8066 + }, + "ddos-slowloris": { + "_n": 336.0, + "disc_nll_ch2": 0.8308422619047618, + "disc_nll_ch3": 0.8438964285714285, + "disc_nll_ch4": 0.8401059523809522, + "disc_nll_ch5": 0.8023523809523809, + "disc_nll_ch6": 0.894485119047619, + "disc_nll_ch7": 0.7380258928571429, + "disc_nll_total": 0.9169613095238095, + "terminal_flow": 0.8954321428571428, + "terminal_norm": 0.9302565476190476, + "terminal_packet": 0.9577059523809524 + }, + "ddos-syn_flood": { + "_n": 1089.0, + "disc_nll_ch2": 0.1497485766758494, + "disc_nll_ch3": 0.9329917355371903, + "disc_nll_ch4": 0.8755946740128558, + "disc_nll_ch5": 0.9648182736455464, + "disc_nll_ch6": 0.626021854912764, + "disc_nll_ch7": 0.6877186409550046, + "disc_nll_total": 0.7121900826446281, + "terminal_flow": 0.9765472910927456, + "terminal_norm": 0.9957247015610653, + "terminal_packet": 0.99738971533517 + }, + "ddos-synonymousip_flood": { + "_n": 191.0, + "disc_nll_ch2": 0.9312502617801047, + "disc_nll_ch3": 0.9939581151832461, + "disc_nll_ch4": 0.6343047120418848, + "disc_nll_ch5": 0.6678282722513089, + "disc_nll_ch6": 0.6116764397905761, + "disc_nll_ch7": 0.6554858638743455, + "disc_nll_total": 0.9741319371727748, + "terminal_flow": 0.9989465968586387, + "terminal_norm": 0.9991738219895289, + "terminal_packet": 0.9970376963350785 + }, + "ddos-tcp_flood": { + "_n": 1198.0, + "disc_nll_ch2": 0.088950918196995, + "disc_nll_ch3": 0.9881647746243739, + "disc_nll_ch4": 0.9405500834724541, + "disc_nll_ch5": 0.6917105175292153, + "disc_nll_ch6": 0.6701984974958264, + "disc_nll_ch7": 0.995861101836394, + "disc_nll_total": 0.9483866444073455, + "terminal_flow": 0.9512789649415693, + "terminal_norm": 0.9859791318864775, + "terminal_packet": 0.9955487479131886 + }, + "ddos-udp_flood": { + "_n": 9.0, + "disc_nll_ch2": 0.5451333333333334, + "disc_nll_ch3": 0.3923111111111111, + "disc_nll_ch4": 0.13937777777777777, + "disc_nll_ch5": 0.18917777777777778, + "disc_nll_ch6": 0.1287333333333333, + "disc_nll_ch7": 0.106, + "disc_nll_total": 0.5074888888888889, + "terminal_flow": 0.8560888888888888, + "terminal_norm": 0.9705555555555555, + "terminal_packet": 0.9895333333333334 + }, + "ddos-udp_fragmentation": { + "_n": 22.0, + "disc_nll_ch2": 0.6504727272727273, + "disc_nll_ch3": 0.5185454545454545, + "disc_nll_ch4": 0.37255454545454547, + "disc_nll_ch5": 0.4199818181818182, + "disc_nll_ch6": 0.513090909090909, + "disc_nll_ch7": 0.5275363636363637, + "disc_nll_total": 0.6209818181818182, + "terminal_flow": 0.7500818181818182, + "terminal_norm": 0.8224727272727272, + "terminal_packet": 0.8358727272727272 + }, + "dictionarybruteforce": { + "_n": 20.0, + "disc_nll_ch2": 0.64332, + "disc_nll_ch3": 0.50081, + "disc_nll_ch4": 0.6110749999999999, + "disc_nll_ch5": 0.32993, + "disc_nll_ch6": 0.6092150000000001, + "disc_nll_ch7": 0.34487, + "disc_nll_total": 0.62337, + "terminal_flow": 0.76133, + "terminal_norm": 0.8058, + "terminal_packet": 0.82726 + }, + "dns_spoofing": { + "_n": 163.0, + "disc_nll_ch2": 0.39222822085889575, + "disc_nll_ch3": 0.578322699386503, + "disc_nll_ch4": 0.4811920245398773, + "disc_nll_ch5": 0.4245460122699386, + "disc_nll_ch6": 0.5483932515337423, + "disc_nll_ch7": 0.4042036809815951, + "disc_nll_total": 0.5209901840490797, + "terminal_flow": 0.7591116564417179, + "terminal_norm": 0.7971779141104295, + "terminal_packet": 0.7930871165644171 + }, + "dos-http_flood": { + "_n": 714.0, + "disc_nll_ch2": 0.2704366946778711, + "disc_nll_ch3": 0.9270495798319327, + "disc_nll_ch4": 0.8578344537815126, + "disc_nll_ch5": 0.9495266106442577, + "disc_nll_ch6": 0.923113725490196, + "disc_nll_ch7": 0.92700756302521, + "disc_nll_total": 0.972121848739496, + "terminal_flow": 0.9384663865546219, + "terminal_norm": 0.9820955182072829, + "terminal_packet": 0.9890705882352943 + }, + "dos-syn_flood": { + "_n": 836.0, + "disc_nll_ch2": 0.8294607655502392, + "disc_nll_ch3": 0.968809090909091, + "disc_nll_ch4": 0.7927940191387559, + "disc_nll_ch5": 0.9822466507177033, + "disc_nll_ch6": 0.5840082535885167, + "disc_nll_ch7": 0.9393733253588517, + "disc_nll_total": 0.9409626794258372, + "terminal_flow": 0.9552629186602871, + "terminal_norm": 0.9918337320574162, + "terminal_packet": 0.9974777511961723 + }, + "dos-tcp_flood": { + "_n": 1084.0, + "disc_nll_ch2": 0.735549815498155, + "disc_nll_ch3": 0.8101918819188191, + "disc_nll_ch4": 0.811371033210332, + "disc_nll_ch5": 0.9606243542435426, + "disc_nll_ch6": 0.583040590405904, + "disc_nll_ch7": 0.9905450184501845, + "disc_nll_total": 0.9742300738007379, + "terminal_flow": 0.9446706642066421, + "terminal_norm": 0.9844742619926199, + "terminal_packet": 0.9963322878228782 + }, + "dos-udp_flood": { + "_n": 201.0, + "disc_nll_ch2": 0.08905273631840793, + "disc_nll_ch3": 0.6679771144278607, + "disc_nll_ch4": 0.18894726368159206, + "disc_nll_ch5": 0.0857134328358209, + "disc_nll_ch6": 0.051025870646766155, + "disc_nll_ch7": 0.009204975124378139, + "disc_nll_total": 0.20328457711442788, + "terminal_flow": 0.9668955223880598, + "terminal_norm": 0.9756746268656716, + "terminal_packet": 0.9963980099502487 + }, + "mirai-greeth_flood": { + "_n": 12.0, + "disc_nll_ch2": 0.4700333333333333, + "disc_nll_ch3": 0.4753833333333333, + "disc_nll_ch4": 0.3857666666666667, + "disc_nll_ch5": 0.3575833333333333, + "disc_nll_ch6": 0.46553333333333335, + "disc_nll_ch7": 0.43820000000000003, + "disc_nll_total": 0.43633333333333335, + "terminal_flow": 0.5227166666666667, + "terminal_norm": 0.6725333333333333, + "terminal_packet": 0.7221500000000001 + }, + "mirai-greip_flood": { + "_n": 18.0, + "disc_nll_ch2": 0.7518777777777779, + "disc_nll_ch3": 0.4658111111111112, + "disc_nll_ch4": 0.5505166666666667, + "disc_nll_ch5": 0.3894666666666666, + "disc_nll_ch6": 0.5773999999999999, + "disc_nll_ch7": 0.5810888888888889, + "disc_nll_total": 0.6731222222222222, + "terminal_flow": 0.779711111111111, + "terminal_norm": 0.8651555555555556, + "terminal_packet": 0.8488777777777777 + }, + "mirai-udpplain": { + "_n": 9.0, + "disc_nll_ch2": 0.4124444444444444, + "disc_nll_ch3": 0.6112222222222221, + "disc_nll_ch4": 0.4318222222222221, + "disc_nll_ch5": 0.524, + "disc_nll_ch6": 0.5693555555555556, + "disc_nll_ch7": 0.4743777777777777, + "disc_nll_total": 0.44051111111111113, + "terminal_flow": 0.5981333333333333, + "terminal_norm": 0.7498888888888889, + "terminal_packet": 0.7318222222222222 + }, + "mitm-arpspoofing": { + "_n": 134.0, + "disc_nll_ch2": 0.5985865671641791, + "disc_nll_ch3": 0.35728059701492537, + "disc_nll_ch4": 0.5458850746268656, + "disc_nll_ch5": 0.3216, + "disc_nll_ch6": 0.5710992537313433, + "disc_nll_ch7": 0.529641791044776, + "disc_nll_total": 0.5821761194029851, + "terminal_flow": 0.7169477611940297, + "terminal_norm": 0.8191253731343284, + "terminal_packet": 0.8326895522388059 + }, + "recon-hostdiscovery": { + "_n": 179.0, + "disc_nll_ch2": 0.40303687150837986, + "disc_nll_ch3": 0.7237871508379887, + "disc_nll_ch4": 0.6430726256983239, + "disc_nll_ch5": 0.719891061452514, + "disc_nll_ch6": 0.612704469273743, + "disc_nll_ch7": 0.6564111731843576, + "disc_nll_total": 0.6751173184357542, + "terminal_flow": 0.7751497206703911, + "terminal_norm": 0.8430033519553073, + "terminal_packet": 0.7828424581005586 + }, + "recon-osscan": { + "_n": 371.0, + "disc_nll_ch2": 0.44944851752021564, + "disc_nll_ch3": 0.8161606469002696, + "disc_nll_ch4": 0.7103059299191374, + "disc_nll_ch5": 0.7893822102425876, + "disc_nll_ch6": 0.6850967654986523, + "disc_nll_ch7": 0.8441566037735849, + "disc_nll_total": 0.8658911051212939, + "terminal_flow": 0.8804086253369272, + "terminal_norm": 0.9409045822102424, + "terminal_packet": 0.948154716981132 + }, + "recon-pingsweep": { + "_n": 6.0, + "disc_nll_ch2": 0.7158666666666667, + "disc_nll_ch3": 0.8464, + "disc_nll_ch4": 0.7784, + "disc_nll_ch5": 0.46236666666666665, + "disc_nll_ch6": 0.8670666666666667, + "disc_nll_ch7": 0.7687333333333334, + "disc_nll_total": 0.8046333333333334, + "terminal_flow": 0.8902666666666667, + "terminal_norm": 0.9304333333333333, + "terminal_packet": 0.9621333333333334 + }, + "recon-portscan": { + "_n": 397.0, + "disc_nll_ch2": 0.42885944584382873, + "disc_nll_ch3": 0.873168765743073, + "disc_nll_ch4": 0.7376267002518891, + "disc_nll_ch5": 0.8528594458438288, + "disc_nll_ch6": 0.7335073047858942, + "disc_nll_ch7": 0.8835352644836272, + "disc_nll_total": 0.8905942065491185, + "terminal_flow": 0.8856629722921915, + "terminal_norm": 0.9219037783375315, + "terminal_packet": 0.9236564231738035 + }, + "sqlinjection": { + "_n": 15.0, + "disc_nll_ch2": 0.5561066666666667, + "disc_nll_ch3": 0.39229333333333327, + "disc_nll_ch4": 0.6066133333333333, + "disc_nll_ch5": 0.3969866666666666, + "disc_nll_ch6": 0.6380133333333333, + "disc_nll_ch7": 0.59328, + "disc_nll_total": 0.6008133333333333, + "terminal_flow": 0.6652066666666667, + "terminal_norm": 0.8419866666666668, + "terminal_packet": 0.8662266666666667 + }, + "uploading_attack": { + "_n": 5.0, + "disc_nll_ch2": 0.36160000000000003, + "disc_nll_ch3": 0.43616, + "disc_nll_ch4": 0.51984, + "disc_nll_ch5": 0.44932000000000005, + "disc_nll_ch6": 0.29492, + "disc_nll_ch7": 0.3896, + "disc_nll_total": 0.46199999999999997, + "terminal_flow": 0.79888, + "terminal_norm": 0.8585999999999999, + "terminal_packet": 0.5738800000000002 + }, + "vulnerabilityscan": { + "_n": 598.0, + "disc_nll_ch2": 0.5039677257525084, + "disc_nll_ch3": 0.6088086956521739, + "disc_nll_ch4": 0.6502966555183947, + "disc_nll_ch5": 0.620079431438127, + "disc_nll_ch6": 0.6390090301003344, + "disc_nll_ch7": 0.6979814381270903, + "disc_nll_total": 0.705189966555184, + "terminal_flow": 0.714570568561873, + "terminal_norm": 0.8051183946488294, + "terminal_packet": 0.8118488294314381 + }, + "xss": { + "_n": 11.0, + "disc_nll_ch2": 0.43338181818181815, + "disc_nll_ch3": 0.5207818181818182, + "disc_nll_ch4": 0.4656272727272727, + "disc_nll_ch5": 0.37898181818181814, + "disc_nll_ch6": 0.5186727272727273, + "disc_nll_ch7": 0.39285454545454546, + "disc_nll_total": 0.5313999999999999, + "terminal_flow": 0.8513818181818181, + "terminal_norm": 0.8972909090909091, + "terminal_packet": 0.7726727272727274 + } + } +} \ No newline at end of file