anti/DECNET
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(clustering): full-bound passes through production campaign clusterer

Browse Source 
Runs the chained identity + campaign clustering pipeline against all
seven fixtures via from_synthetic / from_synthetic_identity adapters
and ratchets every YAML floor to 1.0 — the production clusterer
(and the reference clusterers used in the per-fixture tests) all
score perfectly across ARI / homogeneity / completeness /
singleton_recall on each fixture.

Three substrate fixes surfaced by the ratchet:

- Tuning: shared_infra now Jaccards payload+C2 only; decky_set moved
  into cohort_weight to prevent fleet-scarcity false-merges (F1's
  shared_wordlist failure mode). Tier weight raised to 1.0 so
  shared payload+C2 alone crosses threshold (F5's intended pass).
- Adapter: from_synthetic_identity now reads SyntheticSession
  started_at + duration_s for session_windows and per-decky
  timestamps (the production-row adapter still uses start_ts/end_ts
  when available).
- Fixture data: paused_campaign.yaml's JA3 collided exactly with
  vpn_hopping.yaml's (same TLS extension list). The collision
  fused two unrelated campaigns under the chained identity layer
  in the noise_floor composite. Made paused's JA3 distinct.

Also wires Campaign / CampaignsResponse into models/__init__.py's
__all__ that was missed in the schema commit.
This commit is contained in:
anti
2026-04-26 09:13:59 -04:00
parent 6936a1426c
commit 75af00c9c8
13 changed files with 404 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
tests/fixtures/campaigns/lone_wolf.expected.yaml vendored
View File

@@ -8,10 +8,10 @@
# algorithm matures. Loosening any bound to make CI pass requires
# justification in the PR description (per CAMPAIGN_CLUSTERING.md §2).
adjusted_rand_index:
min: 0.85
min: 1.0
homogeneity:
min: 0.90
min: 1.0
completeness:
min: 0.80
min: 1.0
singleton_recall:
min: 0.95
min: 1.0

8
tests/fixtures/campaigns/multi_operator.expected.yaml vendored
View File

@@ -16,10 +16,10 @@
#
# Bounds are loose at v1; tighten as the algorithm matures.
adjusted_rand_index:
min: 0.85
min: 1.0
homogeneity:
min: 0.90
min: 1.0
completeness:
min: 0.80
min: 1.0
singleton_recall:
min: 0.95
min: 1.0

8
tests/fixtures/campaigns/noise_floor.expected.yaml vendored
View File

@@ -15,10 +15,10 @@
#
# Bounds are loose at v1; tighten as the algorithm matures.
adjusted_rand_index:
min: 0.85
min: 1.0
homogeneity:
min: 0.90
min: 1.0
completeness:
min: 0.80
min: 1.0
singleton_recall:
min: 0.95
min: 1.0

8
tests/fixtures/campaigns/paused_campaign.expected.yaml vendored
View File

@@ -15,10 +15,10 @@
#
# Bounds are loose at v1; tighten as the algorithm matures.
adjusted_rand_index:
min: 0.85
min: 1.0
homogeneity:
min: 0.90
min: 1.0
completeness:
min: 0.80
min: 1.0
singleton_recall:
min: 0.95
min: 1.0

4
tests/fixtures/campaigns/paused_campaign.yaml vendored
View File

@@ -41,7 +41,7 @@ campaign:
- id: ops-sprint-1
asn: 64520
ip_pool: sticky
ja3: "771,4865-4866-4867-49195-49199-49196-49200,0-23-65281-10-11-35-16-5-13-18-51-45-43-27,29-23-24,0"
ja3: "771,4865-4867-49195-49199-49196-49200-157,0-23-65281-10-11-35-16-5-13-18-51-45-43-27,29-24,0"
hassh: "paused-op-dddddddd-dddddddd-dddddddd"
hours_active_utc: [9, 10, 11, 12, 13, 14, 15, 16]
jitter_seconds: 60
@@ -49,7 +49,7 @@ campaign:
- id: ops-sprint-2
asn: 64520 # same ASN — operator stays on same egress
ip_pool: sticky
ja3: "771,4865-4866-4867-49195-49199-49196-49200,0-23-65281-10-11-35-16-5-13-18-51-45-43-27,29-23-24,0"
ja3: "771,4865-4867-49195-49199-49196-49200-157,0-23-65281-10-11-35-16-5-13-18-51-45-43-27,29-24,0"
hassh: "paused-op-dddddddd-dddddddd-dddddddd"
hours_active_utc: [9, 10, 11, 12, 13, 14, 15, 16]
jitter_seconds: 60

8
tests/fixtures/campaigns/shared_wordlist.expected.yaml vendored
View File

@@ -12,10 +12,10 @@
# any bound to make CI pass requires PR-comment justification (per
# CAMPAIGN_CLUSTERING.md §2).
adjusted_rand_index:
min: 0.85
min: 1.0
homogeneity:
min: 0.90
min: 1.0
completeness:
min: 0.80
min: 1.0
singleton_recall:
min: 0.95
min: 1.0

8
tests/fixtures/campaigns/slow_burn.expected.yaml vendored
View File

@@ -15,10 +15,10 @@
#
# Bounds are loose at v1; tighten as the algorithm matures.
adjusted_rand_index:
min: 0.85
min: 1.0
homogeneity:
min: 0.90
min: 1.0
completeness:
min: 0.80
min: 1.0
singleton_recall:
min: 0.95
min: 1.0

8
tests/fixtures/campaigns/vpn_hopping.expected.yaml vendored
View File

@@ -16,10 +16,10 @@
# any bound to make CI pass requires PR-comment justification (per
# CAMPAIGN_CLUSTERING.md §2).
adjusted_rand_index:
min: 0.85
min: 1.0
homogeneity:
min: 0.90
min: 1.0
completeness:
min: 0.80
min: 1.0
singleton_recall:
min: 0.95
min: 1.0