Retrain anomaly_detection on public labelled data (2026-10-13)

anomaly_detection/best_model.pkl

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:fd344a6fd3265cd720a0b99e6d711cfcaf48ba550ce65fd667216e5c85879e07
-size 4334057
+oid sha256:ae7303ba1a3d2d451eccf33a2a30f75bb43c2393d3b1f61bb1d3563255b4e556
+size 381516

anomaly_detection/metadata.json

@@ -1,23 +1,155 @@
 {
-  "name": "anomaly_detection",
-  "trained_at": "2026-05-09T17:11:51.748003",
-  "samples": 3600,
-  "threat_rate": 0.16666666666666666,
-  "accuracy": 0.9027777777777778,
-  "f1": 0.7666666666666667,
+  "model_type": "IsolationForest",
   "feature_names": [
-    "url_length",
-    "hostname_length",
-    "path_length",
-    "is_https",
-    "has_ip_address",
-    "has_suspicious_tld",
-    "subdomain_count",
-    "has_port",
-    "query_params_count",
-    "has_at_symbol",
-    "has_double_slash",
-    "special_char_count"
+    "bare_length",
+    "host_length",
+    "bare_path_length",
+    "query_length",
+    "host_dots",
+    "host_subdomains",
+    "host_hyphens",
+    "host_digits",
+    "host_digit_ratio",
+    "host_entropy",
+    "host_longest_label",
+    "host_vowel_ratio",
+    "host_is_ip",
+    "host_has_port",
+    "host_suspicious_tld",
+    "tld_length",
+    "has_punycode",
+    "path_depth",
+    "path_digits",
+    "path_entropy",
+    "path_longest_token",
+    "query_params",
+    "query_longest_value",
+    "bare_at_symbol",
+    "path_double_slash",
+    "count_percent",
+    "count_equals",
+    "count_underscore",
+    "count_hyphen_path",
+    "count_tilde",
+    "bare_special_chars",
+    "has_executable_extension",
+    "has_script_extension",
+    "has_archive_extension",
+    "credential_words",
+    "is_shortener",
+    "has_embedded_url",
+    "domain_popularity",
+    "is_user_content_host"
   ],
-  "model_type": "IsolationForest"
+  "uses_scaler": false,
+  "training": {
+    "rows": 172511,
+    "seconds": 1.8,
+    "contamination": 0.02
+  },
+  "holdout": {
+    "benign_urls": 43949,
+    "benign_flagged": 0.0178,
+    "benign_margin_percentiles": {
+      "1": -0.0536,
+      "5": 0.0815,
+      "25": 0.1471,
+      "50": 0.1852,
+      "75": 0.2061,
+      "95": 0.2188
+    },
+    "malicious_urls": 20000,
+    "malicious_flagged": 0.1343,
+    "note": "the model never saw malicious URLs; these are how often it calls each kind unusual"
+  },
+  "known_legitimate": {
+    "checked": 24,
+    "flagged": [
+      {
+        "url": "https://accounts.google.com/signin/v2/identifier?continue=https%3A%2F%2Fmail.google.com&service=mail&flowName=GlifWebSignIn",
+        "margin": -0.0487
+      },
+      {
+        "url": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&response_type=code&scope=openid",
+        "margin": -0.0263
+      }
+    ]
+  },
+  "gate": {
+    "rules": {
+      "max_benign_flagged": 0.05,
+      "min_malicious_flagged": 0.1,
+      "min_ratio": 3.0
+    },
+    "passed": true,
+    "reasons": []
+  },
+  "name": "anomaly_detection",
+  "trained_at": "2026-10-13T22:50:22.856319Z",
+  "settings": {
+    "benign_sample": 120000,
+    "collection_benign_sample": 40000,
+    "popular_sample": 60000,
+    "phishing_sample": 120000,
+    "malware_sample": 30000,
+    "attack_benign_sample": 40000,
+    "test_fraction": 0.2,
+    "max_iter": 300,
+    "learning_rate": 0.1,
+    "max_leaf_nodes": 31,
+    "min_samples_leaf": 20,
+    "l2_regularization": 0.0,
+    "anomaly_contamination": 0.02,
+    "popular_domains": 300000,
+    "target_false_positive_rate": 0.02,
+    "seed": 42,
+    "drop_features": []
+  },
+  "sources": {
+    "domain popularity": {
+      "source": "https://tranco-list.eu/download/PYGVJ/1000000",
+      "domains": 300000
+    },
+    "Mitake/PhishingURLsANDBenignURLs": {
+      "revision": "1f939bad78f95b470c5d058dfb23c7fce35275b7",
+      "rows": {
+        "benign": 592095,
+        "phishing": 253199
+      }
+    },
+    "bgspaditya/byt-malicious-url-treatment": {
+      "revision": "82af40f1d701d03269f777aee09ceed80bb96b1c",
+      "rows": {
+        "benign": 341830,
+        "malware": 18900
+      }
+    },
+    "pirocheto/phishing-url": {
+      "revision": "1375d450d4540205ac11781b807249c9509739cd",
+      "rows": {
+        "train": {
+          "legitimate": 3828,
+          "phishing": 3735
+        },
+        "test": {
+          "legitimate": 1886,
+          "phishing": 1872
+        }
+      }
+    },
+    "phl-ldm/tranco_top_million": {
+      "revision": "37974646d7107b8789afb486461be81ba719a08a",
+      "rows": {
+        "landing pages": 149995
+      }
+    },
+    "shengqin/web-attacks": {
+      "revision": "631e4ca957612c34d09176ef6ee2e0284b18955f",
+      "rows": {
+        "attack": 19511,
+        "normal": 4785
+      }
+    }
+  },
+  "feature_set": "url_features.py, scheme-free and without a leading www."
 }

anomaly_detection/model.pkl

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:d10d6bc1da4a579239ea1485d858b1f6e16331aa5ac8c18391328629d39d75df
-size 513929

anomaly_detection/package_info.json

@@ -1,23 +0,0 @@
-{
-  "name": "anomaly_detection",
-  "type": "random_forest",
-  "version": "1.0.0",
-  "accuracy": 0.999,
-  "f1_score": 0.9989986620975891,
-  "inference_time_ms": 0.00655989646911621,
-  "files": {
-    "model": {
-      "path": "anomaly_detection/model.pkl",
-      "checksum": "833a0b8d0d785bdc4ab163b2f2e4a7b9",
-      "size_bytes": 513929
-    },
-    "scaler": {
-      "path": "anomaly_detection/scaler.pkl",
-      "checksum": "50935889b0c4b5813f2691c7f63bfa4a"
-    },
-    "metadata": {
-      "path": "anomaly_detection/metadata.json"
-    }
-  },
-  "packaged_at": "2026-03-14 21:51:56"
-}

anomaly_detection/scaler.pkl

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:b82efc104e16d3b4998b597f8c264e69644b551ab6096e145a7456ee1665e76e
-size 1319