anti
7021fda0e6
Bundles all five prior fixtures' campaigns into one corpus alongside 10 fresh Delivery-only noise scanners (on top of lone_wolf's 8 inherited). The fixture covers cross-corpus interference — signal collisions across fixtures' JA3/HASSH/C2 strings, factory ID re-use, clusterer ambiguity that only manifests when multiple campaigns score together. Each constituent fixture already ships its own in-fixture adversarial test; this one is the control for the class of failures that single-corpus fixtures cannot catch. Composition is declared via a fixture-6-specific include_fixtures block in noise_floor.yaml. The test file's loader expands it into a full corpus.campaigns spec at runtime so the factory itself stays unaware — no factory primitive added for what only this fixture needs. The 8 noise scanners declared by lone_wolf flow through naturally; the extra_noise_scanners count adds 10 more. composite_signals_clusterer (added in the fixture-5 commit) is the pass clusterer — union-find combining (ja3, hassh) match OR overlapping C2 callback. Approximates the planned similarity graph well enough that every campaign resolves and every singleton stays singleton in the merged corpus. Three tests: corpus integrity (every campaign id present, 12 campaign-driven attackers + 18 noise = 30 total), pipeline pass against the global bounds, and an explicit singleton-recall assertion (21 truth-singletons — 1 lone wolf, 18 noise, 2 shared_wordlist actors whose campaigns are size 1 — all kept singleton by the composite clusterer). Singleton recall is the load-bearing metric here: noise absorption is the failure mode that makes campaign attribution useless in practice.
25 lines
842 B
YAML
25 lines
842 B
YAML
# Bounds for fixture 6 (noise_floor).
|
|
#
|
|
# Composite corpus: ~14 campaign-driven attackers (across 5 prior
|
|
# fixtures' actors / rotations) + 18 truth-singleton noise rows
|
|
# (8 inherited from lone_wolf + 10 added by this fixture).
|
|
#
|
|
# A correct algorithm groups every campaign correctly and leaves
|
|
# every singleton singleton — score 1.0 across every metric.
|
|
#
|
|
# Singleton recall is the load-bearing metric here: noise
|
|
# absorption is the failure mode that makes campaign attribution
|
|
# useless in practice (a clusterer that pulls noise into real
|
|
# campaigns dilutes attribution to nothing). The bound floor on
|
|
# singleton_recall is what would catch that regression.
|
|
#
|
|
# Bounds are loose at v1; tighten as the algorithm matures.
|
|
adjusted_rand_index:
|
|
min: 0.85
|
|
homogeneity:
|
|
min: 0.90
|
|
completeness:
|
|
min: 0.80
|
|
singleton_recall:
|
|
min: 0.95
|