anti
75af00c9c8
Runs the chained identity + campaign clustering pipeline against all seven fixtures via from_synthetic / from_synthetic_identity adapters and ratchets every YAML floor to 1.0 — the production clusterer (and the reference clusterers used in the per-fixture tests) all score perfectly across ARI / homogeneity / completeness / singleton_recall on each fixture. Three substrate fixes surfaced by the ratchet: - Tuning: shared_infra now Jaccards payload+C2 only; decky_set moved into cohort_weight to prevent fleet-scarcity false-merges (F1's shared_wordlist failure mode). Tier weight raised to 1.0 so shared payload+C2 alone crosses threshold (F5's intended pass). - Adapter: from_synthetic_identity now reads SyntheticSession started_at + duration_s for session_windows and per-decky timestamps (the production-row adapter still uses start_ts/end_ts when available). - Fixture data: paused_campaign.yaml's JA3 collided exactly with vpn_hopping.yaml's (same TLS extension list). The collision fused two unrelated campaigns under the chained identity layer in the noise_floor composite. Made paused's JA3 distinct. Also wires Campaign / CampaignsResponse into models/__init__.py's __all__ that was missed in the schema commit.
26 lines
939 B
YAML
26 lines
939 B
YAML
# Bounds for fixture 2 (vpn_hopping).
|
|
#
|
|
# Ground truth at campaign-level: 1 campaign of 5 observation rows.
|
|
# Ground truth at identity-level: 1 identity of 5 observation rows.
|
|
# A correct algorithm scores 1.0 across every metric on this fixture.
|
|
#
|
|
# Completeness is the load-bearing metric: a clusterer that fragments
|
|
# the campaign by IP/ASN tanks completeness (the one true class is
|
|
# split across many predicted clusters). The adversarial asn_clusterer
|
|
# in the test file demonstrates this and the bound below rejects it.
|
|
#
|
|
# No true singletons in this fixture — singleton_recall is trivially
|
|
# 1.0 (the metric returns 1.0 when truth has no singletons).
|
|
#
|
|
# Bounds are loose at v1; tighten as the algorithm matures. Loosening
|
|
# any bound to make CI pass requires PR-comment justification (per
|
|
# CAMPAIGN_CLUSTERING.md §2).
|
|
adjusted_rand_index:
|
|
min: 1.0
|
|
homogeneity:
|
|
min: 1.0
|
|
completeness:
|
|
min: 1.0
|
|
singleton_recall:
|
|
min: 1.0
|