Open-source ML network-flow detector that turns CICFlowMeter-compatible traffic into deterministic analyst-facing security incidents.
v0.1.0 — usable research/evaluation release. Not production-ready.
Security Anomaly ML takes unlabeled CICFlowMeter flow records, builds causal temporal context, scores them with a frozen Random Forest detector, groups repeated alerts into incidents, and emits deterministic incident-v1
JSONL.
Docker is the recommended path. The published image includes the exact verified frozen model, so no separate model download is needed.
docker pull ghcr.io/ibondarenko1/security-anomaly-ml:0.1.0
docker run --rm --network none \
-v "$PWD:/data" \
ghcr.io/ibondarenko1/security-anomaly-ml:0.1.0 \
analyze /data/flows.csv \
--output /data/incidents.jsonl
The mounted directory must be writable by the container's non-root UID/GID 10001
. Normal inference works with networking disabled. Validation, Windows PowerShell, and source-build examples are in docs/DOCKER.md.
The output is newline-delimited incident-v1
JSON. Each object contains a deterministic incident ID, first/last timestamps, endpoints, destination port, protocols, flow count, aggregate attack scores, and frozen version metadata.
{
"schema_version": "incident-v1",
"incident_id": "inc_e05487e368f9e26a2a6939c7be622de508056478d3876c344c77a53ba4214872",
"first_seen": "2026-08-20T13:00:00",
"last_seen": "2026-08-20T13:00:05",
"src_ip": "192.0.2.10",
"dst_ip": "198.51.100.20",
"dst_port": 445,
"protocols": [6, 17],
"flow_count": 3,
"max_attack_score": 0.432590909091,
"mean_attack_score": 0.418368686869,
"promoted": true,
"product_version": "0.1.0",
"model_version": "context-rf-v2",
"feature_contract": "cicflow-v2-128"
}
The public interface emits promoted incidents rather than individual ML predictions, reducing repeated flow alerts into deterministic analyst-facing objects.
The synthetic regression fixture at tests/fixtures/product-v01/flows.csv deterministically produces:
- 12 processed flows;
- 9 flow alerts;
- 5 aggregated incidents;
- 2 promoted incidents.
These numbers test runtime stability; they are not an accuracy benchmark and contain no copied research-dataset rows.
The v0.1 pipeline was frozen before evaluation on the February 18 temporal holdout. No thresholds, features, model parameters, aggregation rules, promotion rules, suppression, or whitelisting were changed after opening it.
| Metric | Locked holdout |
|---|---|
| Flow recall | 98.3686% |
| Flow precision | 67.5499% |
| Flow FPR | 2.1190% |
| PR-AUC | 0.898915 |
| Aggregated incident recall | 99.9917% |
| Promoted incident recall | 99.9339% |
| Promoted incident precision | 93.46% |
| Flow-alert to incident reduction | 83.80% |
| FP-object reduction | 96.74% |
Verdict: acceptable but operationally noisy. This is one future capture day with overlapping hosts/environment from the same dataset and network family. It is not evidence of generalization across arbitrary networks, and the remaining workload is too high for normal Tier-1 production use.
The holdout was evaluated once after all model, feature, threshold, aggregation, and promotion decisions were frozen.
One input row represents one network flow. The product validates the label-free CSV, builds tie-safe causal context, scores each flow, groups flow alerts into deterministic five-minute incidents, and emits only promoted incidents.
flowchart LR
A["CICFlowMeter flows"] --> B["Input validation"]
B --> C["128 causal features"]
C --> D["context-rf-v2 attack score"]
D --> E["Flow alert: score >= 0.10"]
E --> F["Policy B: src IP + dst IP + dst port / 5 min"]
F --> G["Promotion: max score >= 0.25"]
G --> H["incident-v1 JSONL"]
The frozen feature contract is:
76 CICFlowMeter flow features
+ 9 static port/protocol behavioral features
+ 43 causal temporal-context features
= 128 model features
Raw IP addresses and timestamps provide temporal and incident context but are not model identity features. Same-timestamp flows are processed as one peer group: all peers are featurized before that timestamp updates state.
Input must be a UTF-8 CICFlowMeter-compatible CSV containing:
Src IP
,Src Port
,Dst IP
,Dst Port
,Protocol
, andTimestamp
;- all 76 baseline numeric fields defined by
;cicflow-v2-128
- optional
Flow ID
.
Label
, label
, and attack_cat
are not required and are removed if present. Validation rejects missing or duplicate columns, reserved derived fields, malformed timestamps, invalid ports/protocols, and non-numeric or non-finite model inputs. Source timestamps are timezone-naive; v0.1 does not invent a timezone.
Use validate
before analysis when integrating a new exporter:
security-anomaly validate flows.csv
The immutable release tag is:
ghcr.io/ibondarenko1/security-anomaly-ml:0.1.0
It includes Python 3.13, the installed package, contracts, pinned runtime dependencies, and the verified model. It runs as non-root and requires no network during inference. Build and operational details are in docs/DOCKER.md.
No mutable latest
tag is published for v0.1.0.
Download the wheel from the v0.1.0 GitHub Release, then install it into Python 3.13:
python3.13 -m venv .venv
source .venv/bin/activate
python -m pip install security_anomaly_ml-0.1.0-py3-none-any.whl
security-anomaly version
The Python wheel intentionally does not embed the model. Obtain the existing artifact from the model-context-rf-v2 release, or from a source checkout run:
python tools/fetch_frozen_model.py \
--tag model-context-rf-v2 \
--destination models/context-rf-v2.joblib
security-anomaly model-info --model models/context-rf-v2.joblib
security-anomaly analyze flows.csv \
--model models/context-rf-v2.joblib \
--output incidents.jsonl
The down verifies the frozen SHA-256 before success and never silently replaces a different file. Full CLI behavior and exit codes are documented in docs/CLI.md.
Public CI runs on every pull request and push to main
and requires only a clean checkout plus the public frozen-model release. It verifies:
- unit and frozen-contract tests;
- pinned runtime dependency vulnerability audit;
- clean wheel/sdist build and outside-checkout installation;
- public model download and SHA verification;
- real-model end-to-end golden regression;
- non-root offline Docker build and byte-identical golden output;
- exclusion of datasets and research artifacts from the runtime image.
Goldens are never rewritten automatically. Details are in docs/CI.md.
| Field | Frozen value |
|---|---|
| Model version | context-rf-v2 |
| Release tag | |
model-context-rf-v2 |
context-rf-v2.joblib
4730a06506d8c5f2af93679c492e1544b3c2b11acd16fe74120d64d4dbfc5c72
3.13.7
causal-temporal-v2
cicflow-v2-128
>= 0.10
> 300s
max_attack_score >= 0.25
Scores are ranking signals, not calibrated real-world probabilities. The model is excluded from Git history and is never reserialized by the product build.
Security Anomaly ML processes sensitive network-flow metadata locally. Normal inference performs no telemetry, cloud upload, hidden download, or other outbound network call; the Docker path is tested with --network none
.
-
Vulnerability reporting:
SECURITY.md -
Data handling and privacy:
docs/PRIVACY.md
Do not attach real packet captures, raw flow exports, internal IP inventories, or unredacted incidents to public issues.
- Research/evaluation grade; not production-ready and not a SOC replacement.
- Batch CSV processing only; no streaming, API, dashboard, or persistent state service.
- CICFlowMeter-compatible input only.
- Frozen Python 3.13 serialization/runtime compatibility.
- Input timestamps have source-defined, timezone-naive semantics and one-second granularity.
- Validation covers one future day from an overlapping network/dataset family, not arbitrary networks.
- Flow-level weaknesses remain concentrated in Fuzzers and Analysis traffic.
- The score is not calibrated as a real-world attack probability.
- Alert workload remains too high for normal Tier-1 production operations.
The production-facing v0.1 pipeline was selected using chronological capture days:
2015-01-22 -> training
2015-02-17 -> validation
2015-02-18 -> locked temporal holdout
Temporal context resets at split and batch boundaries. February 18 was not used for training, feature selection, threshold selection, aggregation selection, or promotion selection. Research scripts remain available for audit, but datasets and generated evaluation artifacts are not redistributed.
The research uses UNSW-NB15 and CIC-UNSW-NB15 under their publishers' terms. Third-party dataset terms are not covered by this repository's Apache-2.0 license.
security-anomaly-ml/
├── src/security_anomaly/ # label-free product runtime
├── src/*.py # research and reproduction tooling
├── contracts/ # versioned feature/model/incident contracts
├── tests/
│ └── fixtures/product-v01/ # deterministic public regression fixture
├── docs/ # CLI, Docker, CI, privacy, and design docs
├── tools/ # artifact and parity verification helpers
├── data/ # ignored external datasets and derived data
├── models/ # ignored external model/evaluation artifacts
├── Dockerfile
├── pyproject.toml
├── requirements-runtime.txt
└── README.md
Python 3.13 is required for the frozen product runtime.
python3.13 -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements.txt
python -m pytest -q
Some research-reproduction tests require non-redistributed datasets or generated artifacts and skip explicitly in a clean public checkout. Product CI is fully reproducible from public inputs.
Original source code is licensed under the Apache License 2.0. Dataset licenses and terms remain with their original publishers.