Network-flow ML that outputs security incidents

Security Anomaly ML, an open-source network-flow detector from developer I. Bondarenko, released v0.1.0, a research/evaluation version that converts CICFlowMeter-compatible traffic into deterministic analyst-facing security incidents. The tool, which uses a frozen Random Forest model (context-rf-v2) and emits incident-v1 JSONL, achieved 98.3686% flow recall, 99.9339% promoted incident recall, and 93.46% promoted incident precision on a February 18 temporal holdout, but the developer warns it is not production-ready due to operational noise.

Open-source ML network-flow detector that turns CICFlowMeter-compatible traffic into deterministic analyst-facing security incidents. v0.1.0 — usable research/evaluation release. Not production-ready. Security Anomaly ML takes unlabeled CICFlowMeter flow records, builds causal temporal context, scores them with a frozen Random Forest detector, groups repeated alerts into incidents, and emits deterministic incident-v1 JSONL. Docker is the recommended path. The published image includes the exact verified frozen model, so no separate model download is needed. docker pull ghcr.io/ibondarenko1/security-anomaly-ml:0.1.0 docker run --rm --network none \ -v "$PWD:/data" \ ghcr.io/ibondarenko1/security-anomaly-ml:0.1.0 \ analyze /data/flows.csv \ --output /data/incidents.jsonl The mounted directory must be writable by the container's non-root UID/GID 10001 . Normal inference works with networking disabled. Validation, Windows PowerShell, and source-build examples are in docs/DOCKER.md /ibondarenko1/security-anomaly-ml/blob/main/docs/DOCKER.md . The output is newline-delimited incident-v1 JSON. Each object contains a deterministic incident ID, first/last timestamps, endpoints, destination port, protocols, flow count, aggregate attack scores, and frozen version metadata. { "schema version": "incident-v1", "incident id": "inc e05487e368f9e26a2a6939c7be622de508056478d3876c344c77a53ba4214872", "first seen": "2026-08-20T13:00:00", "last seen": "2026-08-20T13:00:05", "src ip": "192.0.2.10", "dst ip": "198.51.100.20", "dst port": 445, "protocols": 6, 17 , "flow count": 3, "max attack score": 0.432590909091, "mean attack score": 0.418368686869, "promoted": true, "product version": "0.1.0", "model version": "context-rf-v2", "feature contract": "cicflow-v2-128" } The public interface emits promoted incidents rather than individual ML predictions, reducing repeated flow alerts into deterministic analyst-facing objects. The synthetic regression fixture at tests/fixtures/product-v01/flows.csv /ibondarenko1/security-anomaly-ml/blob/main/tests/fixtures/product-v01/flows.csv deterministically produces: - 12 processed flows; - 9 flow alerts; - 5 aggregated incidents; - 2 promoted incidents. These numbers test runtime stability; they are not an accuracy benchmark and contain no copied research-dataset rows. The v0.1 pipeline was frozen before evaluation on the February 18 temporal holdout. No thresholds, features, model parameters, aggregation rules, promotion rules, suppression, or whitelisting were changed after opening it. | Metric | Locked holdout | |---|---| | Flow recall | 98.3686% | | Flow precision | 67.5499% | | Flow FPR | 2.1190% | | PR-AUC | 0.898915 | | Aggregated incident recall | 99.9917% | | Promoted incident recall | 99.9339% | | Promoted incident precision | 93.46% | | Flow-alert to incident reduction | 83.80% | | FP-object reduction | 96.74% | Verdict: acceptable but operationally noisy. This is one future capture day with overlapping hosts/environment from the same dataset and network family. It is not evidence of generalization across arbitrary networks, and the remaining workload is too high for normal Tier-1 production use. The holdout was evaluated once after all model, feature, threshold, aggregation, and promotion decisions were frozen. One input row represents one network flow. The product validates the label-free CSV, builds tie-safe causal context, scores each flow, groups flow alerts into deterministic five-minute incidents, and emits only promoted incidents. php flowchart LR A "CICFlowMeter flows" -- B "Input validation" B -- C "128 causal features" C -- D "context-rf-v2 attack score" D -- E "Flow alert: score = 0.10" E -- F "Policy B: src IP + dst IP + dst port / 5 min" F -- G "Promotion: max score = 0.25" G -- H "incident-v1 JSONL" The frozen feature contract is: 76 CICFlowMeter flow features + 9 static port/protocol behavioral features + 43 causal temporal-context features = 128 model features Raw IP addresses and timestamps provide temporal and incident context but are not model identity features. Same-timestamp flows are processed as one peer group: all peers are featurized before that timestamp updates state. Input must be a UTF-8 CICFlowMeter-compatible CSV containing: Src IP , Src Port , Dst IP , Dst Port , Protocol , and Timestamp ;- all 76 baseline numeric fields defined by ; cicflow-v2-128 - optional Flow ID . Label , label , and attack cat are not required and are removed if present. Validation rejects missing or duplicate columns, reserved derived fields, malformed timestamps, invalid ports/protocols, and non-numeric or non-finite model inputs. Source timestamps are timezone-naive; v0.1 does not invent a timezone. Use validate before analysis when integrating a new exporter: security-anomaly validate flows.csv The immutable release tag is: ghcr.io/ibondarenko1/security-anomaly-ml:0.1.0 It includes Python 3.13, the installed package, contracts, pinned runtime dependencies, and the verified model. It runs as non-root and requires no network during inference. Build and operational details are in docs/DOCKER.md /ibondarenko1/security-anomaly-ml/blob/main/docs/DOCKER.md . No mutable latest tag is published for v0.1.0. Download the wheel from the v0.1.0 GitHub Release https://github.com/ibondarenko1/security-anomaly-ml/releases/tag/v0.1.0 , then install it into Python 3.13: python3.13 -m venv .venv source .venv/bin/activate python -m pip install security anomaly ml-0.1.0-py3-none-any.whl security-anomaly version The Python wheel intentionally does not embed the model. Obtain the existing artifact from the model-context-rf-v2 release https://github.com/ibondarenko1/security-anomaly-ml/releases/tag/model-context-rf-v2 , or from a source checkout run: python tools/fetch frozen model.py \ --tag model-context-rf-v2 \ --destination models/context-rf-v2.joblib security-anomaly model-info --model models/context-rf-v2.joblib security-anomaly analyze flows.csv \ --model models/context-rf-v2.joblib \ --output incidents.jsonl The downloader verifies the frozen SHA-256 before success and never silently replaces a different file. Full CLI behavior and exit codes are documented in docs/CLI.md /ibondarenko1/security-anomaly-ml/blob/main/docs/CLI.md . Public CI runs on every pull request and push to main and requires only a clean checkout plus the public frozen-model release. It verifies: - unit and frozen-contract tests; - pinned runtime dependency vulnerability audit; - clean wheel/sdist build and outside-checkout installation; - public model download and SHA verification; - real-model end-to-end golden regression; - non-root offline Docker build and byte-identical golden output; - exclusion of datasets and research artifacts from the runtime image. Goldens are never rewritten automatically. Details are in docs/CI.md /ibondarenko1/security-anomaly-ml/blob/main/docs/CI.md . | Field | Frozen value | |---|---| | Model version | context-rf-v2 | | Release tag | model-context-rf-v2 | context-rf-v2.joblib 4730a06506d8c5f2af93679c492e1544b3c2b11acd16fe74120d64d4dbfc5c72 3.13.7 causal-temporal-v2 cicflow-v2-128 = 0.10 300s max attack score = 0.25 Scores are ranking signals, not calibrated real-world probabilities. The model is excluded from Git history and is never reserialized by the product build. Security Anomaly ML processes sensitive network-flow metadata locally. Normal inference performs no telemetry, cloud upload, hidden download, or other outbound network call; the Docker path is tested with --network none . - Vulnerability reporting: SECURITY.md - Data handling and privacy: docs/PRIVACY.md Do not attach real packet captures, raw flow exports, internal IP inventories, or unredacted incidents to public issues. - Research/evaluation grade; not production-ready and not a SOC replacement. - Batch CSV processing only; no streaming, API, dashboard, or persistent state service. - CICFlowMeter-compatible input only. - Frozen Python 3.13 serialization/runtime compatibility. - Input timestamps have source-defined, timezone-naive semantics and one-second granularity. - Validation covers one future day from an overlapping network/dataset family, not arbitrary networks. - Flow-level weaknesses remain concentrated in Fuzzers and Analysis traffic. - The score is not calibrated as a real-world attack probability. - Alert workload remains too high for normal Tier-1 production operations. The production-facing v0.1 pipeline was selected using chronological capture days: php 2015-01-22 - training 2015-02-17 - validation 2015-02-18 - locked temporal holdout Temporal context resets at split and batch boundaries. February 18 was not used for training, feature selection, threshold selection, aggregation selection, or promotion selection. Research scripts remain available for audit, but datasets and generated evaluation artifacts are not redistributed. The research uses UNSW-NB15 and CIC-UNSW-NB15 under their publishers' terms. Third-party dataset terms are not covered by this repository's Apache-2.0 license. security-anomaly-ml/ ├── src/security anomaly/ label-free product runtime ├── src/ .py research and reproduction tooling ├── contracts/ versioned feature/model/incident contracts ├── tests/ │ └── fixtures/product-v01/ deterministic public regression fixture ├── docs/ CLI, Docker, CI, privacy, and design docs ├── tools/ artifact and parity verification helpers ├── data/ ignored external datasets and derived data ├── models/ ignored external model/evaluation artifacts ├── Dockerfile ├── pyproject.toml ├── requirements-runtime.txt └── README.md Python 3.13 is required for the frozen product runtime. python3.13 -m venv .venv source .venv/bin/activate python -m pip install -r requirements.txt python -m pytest -q Some research-reproduction tests require non-redistributed datasets or generated artifacts and skip explicitly in a clean public checkout. Product CI is fully reproducible from public inputs. Original source code is licensed under the Apache License 2.0 /ibondarenko1/security-anomaly-ml/blob/main/LICENSE . Dataset licenses and terms remain with their original publishers.