Repository navigation
results: publicar auditoria real dos PCAPs para ataques 17, 26 e 36 - #14
Merged
Merged
Conversation
…ral discrepancies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contexto
O PR #13 já foi integrado à
main, adicionando 15 intervalos candidate de Haag (2007) e o pipeline de investigação. Após a execução real do GitHub Actions #41147956979, esta PR separada publica os relatórios derivados dos PCAPs INSIDE originais, verificados via SHA-256.Resultado empírico
Os resultados verificam fluxo e assinaturas TCP SYN coerentes com a atividade documentada; não validam duração completa, autoria inequívoca de cada pacote ou benignidade de períodos de fundo.
Discrepâncias temporais
ID17 apresenta 11 SYN fora do candidato; ID26 1.019; ID36 37 (todos dentro da margem de ±2min examinada). Portanto, não converter os limites da dissertação em ground truth definitivo. A origem do mapeamento de marx para IP é secundária. Os relatórios mantêm o status
candidate_pcap_correlatede 0 rótulos de ataques/benignos automaticamente promovidos.Arquivos
reports/week2-1999/ground-truth-candidates/pcap_syn_candidates.csvreports/week2-1999/ground-truth-candidates/summary.jsonreports/week2-1999/ground-truth-candidates/README.mdExecução reprodutível: https://github.com/dreyvinixz/Anomaly_Detection/actions/runs/41147956979
Artefato original: https://github.com/dreyvinixz/Anomaly_Detection/actions/runs/41147956979/artifacts/13021653283
Referência institucional: https://scholar.afit.edu/etd/3111/
A matriz de confusão global continua indisponível enquanto não houver intervalos binários validados em todas as janelas pontuadas da Week 2.