anti
7021fda0e6
Bundles all five prior fixtures' campaigns into one corpus alongside 10 fresh Delivery-only noise scanners (on top of lone_wolf's 8 inherited). The fixture covers cross-corpus interference — signal collisions across fixtures' JA3/HASSH/C2 strings, factory ID re-use, clusterer ambiguity that only manifests when multiple campaigns score together. Each constituent fixture already ships its own in-fixture adversarial test; this one is the control for the class of failures that single-corpus fixtures cannot catch. Composition is declared via a fixture-6-specific include_fixtures block in noise_floor.yaml. The test file's loader expands it into a full corpus.campaigns spec at runtime so the factory itself stays unaware — no factory primitive added for what only this fixture needs. The 8 noise scanners declared by lone_wolf flow through naturally; the extra_noise_scanners count adds 10 more. composite_signals_clusterer (added in the fixture-5 commit) is the pass clusterer — union-find combining (ja3, hassh) match OR overlapping C2 callback. Approximates the planned similarity graph well enough that every campaign resolves and every singleton stays singleton in the merged corpus. Three tests: corpus integrity (every campaign id present, 12 campaign-driven attackers + 18 noise = 30 total), pipeline pass against the global bounds, and an explicit singleton-recall assertion (21 truth-singletons — 1 lone wolf, 18 noise, 2 shared_wordlist actors whose campaigns are size 1 — all kept singleton by the composite clusterer). Singleton recall is the load-bearing metric here: noise absorption is the failure mode that makes campaign attribution useless in practice.
35 lines
1.5 KiB
YAML
35 lines
1.5 KiB
YAML
# Fixture 6 (noise_floor) — see development/CAMPAIGN_CLUSTERING.md §2.
|
|
#
|
|
# Composite of all five prior fixtures plus N additional Delivery-only
|
|
# noise scanners. Tests that the clusterer holds every campaign
|
|
# together AND keeps every noise observation as its own singleton
|
|
# in the presence of cross-fixture interference.
|
|
#
|
|
# This is a CONTROL fixture: if any of the five constituent fixtures
|
|
# regresses inside the combined corpus but passes individually, the
|
|
# regression is in cross-corpus interaction (signal collisions,
|
|
# clusterer ambiguity, factory ID re-use, …). Catches a class of bugs
|
|
# that single-corpus fixtures cannot.
|
|
#
|
|
# Composition is expressed by listing the constituent fixtures here;
|
|
# the test file's loader expands this into a full `corpus.campaigns`
|
|
# spec at load time so the factory itself stays unaware. This format
|
|
# is fixture-6-specific — no other fixture uses ``include_fixtures``.
|
|
#
|
|
# Pass condition: ``composite_signals_clusterer`` (fingerprint OR C2
|
|
# union-find — see fixture_harness.py) resolves every campaign and
|
|
# leaves every noise scanner singleton. The bounds in
|
|
# ``noise_floor.expected.yaml`` are global across the merged corpus.
|
|
#
|
|
# No standalone adversarial test for fixture 6 — each constituent
|
|
# fixture already ships its own. What this fixture catches is
|
|
# CROSS-fixture interference, which is a different failure mode from
|
|
# the in-fixture adversarial cases.
|
|
include_fixtures:
|
|
- shared_wordlist.yaml
|
|
- vpn_hopping.yaml
|
|
- lone_wolf.yaml
|
|
- paused_campaign.yaml
|
|
- multi_operator.yaml
|
|
extra_noise_scanners: 10
|