Retrain web_attack_detection on public labelled data (2026-10-13)

web_attack_detection/best_model.pkl

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:f3bc69c2e0063713cc89692913b494dc81f61441a9f354f13d1b60c59020c01c
-size 107913
+oid sha256:9c1fdc278c8c6a556ee80b61399d5b84335a254a193500779e226529a7a87e44
+size 456344

web_attack_detection/metadata.json

@@ -1,23 +1,254 @@
 {
-  "name": "web_attack_detection",
-  "trained_at": "2026-05-09T17:11:51.392325",
-  "samples": 4000,
-  "threat_rate": 0.5,
-  "accuracy": 1.0,
-  "f1": 1.0,
+  "model_type": "HistGradientBoostingClassifier",
   "feature_names": [
-    "url_length",
-    "hostname_length",
-    "path_length",
-    "is_https",
-    "has_ip_address",
-    "has_suspicious_tld",
-    "subdomain_count",
-    "has_port",
-    "query_params_count",
-    "has_at_symbol",
-    "has_double_slash",
-    "special_char_count"
+    "payload_length",
+    "payload_quotes",
+    "payload_angle_brackets",
+    "payload_parentheses",
+    "payload_semicolons",
+    "payload_spaces",
+    "payload_sql_keywords",
+    "payload_script_tokens",
+    "payload_comment_markers",
+    "payload_traversal",
+    "payload_pipes_backticks",
+    "payload_encoded_specials",
+    "payload_special_ratio",
+    "payload_longest_run_specials",
+    "payload_equals_in_value",
+    "payload_null_bytes",
+    "bare_path_length",
+    "query_length",
+    "query_params",
+    "count_percent",
+    "path_depth",
+    "query_longest_value"
+  ],
+  "uses_scaler": false,
+  "decision_threshold": 0.5,
+  "decision_point": {
+    "target_false_positive_rate": 0.02,
+    "validation_urls": 21178,
+    "validation_benign": 18249,
+    "note": "raw scores are rescaled so that this threshold reads as 0.5"
+  },
+  "training": {
+    "rows": 207592,
+    "positives": 28114,
+    "sites": 99916,
+    "seconds": 4.9,
+    "iterations": 300,
+    "rows_by_source": {
+      "benign URLs with a query": 21038,
+      "normal strings placed like payloads": 3835,
+      "older collection, benign": 26045,
+      "payloads placed on benign sites": 31043,
+      "phishing collection, benign": 95655,
+      "popular sites": 48034,
+      "reference, legitimate": 3120
+    },
+    "dropped_as_listed_on_both_sides": 0,
+    "note": "attack rows are real SQL-injection and XSS payloads placed as a query value or path segment on benign sites"
+  },
+  "holdout": {
+    "samples": 57173,
+    "positives": 7979,
+    "true_positives": 7940,
+    "false_positives": 71,
+    "false_negatives": 39,
+    "true_negatives": 49123,
+    "precision": 0.9911,
+    "recall": 0.9951,
+    "f1": 0.9931,
+    "false_positive_rate": 0.0014,
+    "auc": 0.9998,
+    "average_precision": 0.9995,
+    "at_raw_0.5": {
+      "precision": 0.9911,
+      "recall": 0.9951,
+      "false_positive_rate": 0.0014
+    },
+    "sites": 24980,
+    "by_source": {
+      "benign URLs with a query": {
+        "urls": 4638,
+        "kind": "negative",
+        "false_positive_rate": 0.0028
+      },
+      "normal strings placed like payloads": {
+        "urls": 950,
+        "kind": "negative",
+        "false_positive_rate": 0.0432
+      },
+      "older collection, benign": {
+        "urls": 6721,
+        "kind": "negative",
+        "false_positive_rate": 0.0009
+      },
+      "payloads placed on benign sites": {
+        "urls": 7979,
+        "kind": "positive",
+        "recall": 0.9951
+      },
+      "phishing collection, benign": {
+        "urls": 24341,
+        "kind": "negative",
+        "false_positive_rate": 0.0004
+      },
+      "popular sites": {
+        "urls": 11874,
+        "kind": "negative",
+        "false_positive_rate": 0.0
+      },
+      "reference, legitimate": {
+        "urls": 670,
+        "kind": "negative",
+        "false_positive_rate": 0.0015
+      }
+    },
+    "note": "URLs from sites that were not in the training rows"
+  },
+  "other_datasets": {},
+  "known_legitimate": {
+    "checked": 24,
+    "flagged": [],
+    "highest": [
+      {
+        "url": "https://www.bbc.co.uk/news",
+        "score": 0.0111
+      },
+      {
+        "url": "https://www.amazon.com/dp/B08N5WRWNW?ref=abc&th=1",
+        "score": 0.0007
+      },
+      {
+        "url": "https://www.google.com/search?q=cybersecurity",
+        "score": 0.0003
+      },
+      {
+        "url": "https://github.com/",
+        "score": 0.0003
+      },
+      {
+        "url": "https://github.com/login",
+        "score": 0.0003
+      }
+    ]
+  },
+  "known_hostile": [
+    {
+      "url": "https://shop.example.com/item.php?id=1%27%20UNION%20SELECT%20username,password%20FROM%20users--",
+      "score": 1.0
+    },
+    {
+      "url": "https://example.com/search?q=<script>alert(document.cookie)</script>",
+      "score": 1.0
+    },
+    {
+      "url": "https://example.com/download?file=../../../../etc/passwd",
+      "score": 0.001
+    }
   ],
-  "model_type": "GradientBoostingClassifier"
+  "feature_importances": {
+    "payload_special_ratio": 0.02071,
+    "payload_spaces": 0.00105,
+    "payload_equals_in_value": 0.00074,
+    "count_percent": 0.00031,
+    "payload_angle_brackets": 0.0003,
+    "payload_parentheses": 0.00026,
+    "payload_semicolons": 0.00021,
+    "payload_script_tokens": 0.00016,
+    "payload_sql_keywords": 8e-05,
+    "bare_path_length": 5e-05,
+    "query_longest_value": 4e-05,
+    "payload_encoded_specials": 4e-05,
+    "payload_length": 2e-05,
+    "payload_quotes": 1e-05,
+    "path_depth": 1e-05,
+    "payload_comment_markers": 1e-05,
+    "query_length": 1e-05,
+    "query_params": 1e-05,
+    "payload_longest_run_specials": 0.0,
+    "payload_pipes_backticks": 0.0,
+    "payload_traversal": 0.0,
+    "payload_null_bytes": 0.0
+  },
+  "gate": {
+    "rules": {
+      "min_auc": 0.9,
+      "max_false_positive_rate": 0.05,
+      "max_known_legitimate_flagged": 0
+    },
+    "passed": true,
+    "reasons": [],
+    "failed_rules": []
+  },
+  "name": "web_attack_detection",
+  "trained_at": "2026-10-13T22:50:22.856319Z",
+  "settings": {
+    "benign_sample": 120000,
+    "collection_benign_sample": 40000,
+    "popular_sample": 60000,
+    "phishing_sample": 120000,
+    "malware_sample": 30000,
+    "attack_benign_sample": 40000,
+    "test_fraction": 0.2,
+    "max_iter": 300,
+    "learning_rate": 0.1,
+    "max_leaf_nodes": 31,
+    "min_samples_leaf": 20,
+    "l2_regularization": 0.0,
+    "anomaly_contamination": 0.02,
+    "popular_domains": 300000,
+    "target_false_positive_rate": 0.02,
+    "seed": 42,
+    "drop_features": []
+  },
+  "sources": {
+    "domain popularity": {
+      "source": "https://tranco-list.eu/download/PYGVJ/1000000",
+      "domains": 300000
+    },
+    "Mitake/PhishingURLsANDBenignURLs": {
+      "revision": "1f939bad78f95b470c5d058dfb23c7fce35275b7",
+      "rows": {
+        "benign": 592095,
+        "phishing": 253199
+      }
+    },
+    "bgspaditya/byt-malicious-url-treatment": {
+      "revision": "82af40f1d701d03269f777aee09ceed80bb96b1c",
+      "rows": {
+        "benign": 341830,
+        "malware": 18900
+      }
+    },
+    "pirocheto/phishing-url": {
+      "revision": "1375d450d4540205ac11781b807249c9509739cd",
+      "rows": {
+        "train": {
+          "legitimate": 3828,
+          "phishing": 3735
+        },
+        "test": {
+          "legitimate": 1886,
+          "phishing": 1872
+        }
+      }
+    },
+    "phl-ldm/tranco_top_million": {
+      "revision": "37974646d7107b8789afb486461be81ba719a08a",
+      "rows": {
+        "landing pages": 149995
+      }
+    },
+    "shengqin/web-attacks": {
+      "revision": "631e4ca957612c34d09176ef6ee2e0284b18955f",
+      "rows": {
+        "attack": 19511,
+        "normal": 4785
+      }
+    }
+  },
+  "feature_set": "url_features.py, scheme-free and without a leading www."
 }

web_attack_detection/model.pkl

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:f774d2935861a272513a885cc3d091c1d44dbc067e739590e8600bc335b127aa
-size 285769

web_attack_detection/package_info.json

@@ -1,23 +0,0 @@
-{
-  "name": "web_attack_detection",
-  "type": "random_forest",
-  "version": "1.0.0",
-  "accuracy": 1.0,
-  "f1_score": 1.0,
-  "inference_time_ms": 0.029021159858460637,
-  "files": {
-    "model": {
-      "path": "web_attack_detection/model.pkl",
-      "checksum": "3071f634875fa3a54b389667634b1afe",
-      "size_bytes": 285769
-    },
-    "scaler": {
-      "path": "web_attack_detection/scaler.pkl",
-      "checksum": "a511f6f966d0e45f2515732533dec192"
-    },
-    "metadata": {
-      "path": "web_attack_detection/metadata.json"
-    }
-  },
-  "packaged_at": "2026-03-14 21:51:56"
-}

web_attack_detection/scaler.pkl

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:b39b981c87b0d9fb323facd4f000ec5d69de83cf692ac7de21e6ae57d069d1f6
-size 1319