File size: 1,602 Bytes
215671c ec8e321 215671c ec8e321 215671c | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 | #!/usr/bin/env python3
"""nr-network-known-class-detector — inference example (Apache-2.0).
Runs real `network-v1` feature vectors (captured from the lab corpus and shipped in
`example_records.json`) through the detector:
1. a Bitcoin Core P2P attack (real CVE) -> should FIRE
2. a Solana TPU-QUIC attack (Neodyme Firedancer audit) -> should FIRE
3. a benign Bitcoin peer (same message types, normal rate) -> benign
4. an out-of-domain record (no network signal) -> scoreable=False
The exact primitive behind each record is in `example_records.json` and is printed as its
label at runtime (source of truth), so this list stays correct across corpus regenerations.
Run from the model repo dir: python inference_example.py
"""
import json
from predict import load, predict
model = load("model.joblib")
records = json.load(open("example_records.json"))
# add an out-of-domain record (no pcap.*/resp.* signal) to show the scoreability gate
records.append({"label": "out-of-domain (economic bundle)", "expect": "unscoreable",
"feat": {"econ.gov_weight_held_blocks": 0.0}})
results = predict(model, [r["feat"] for r in records])
for r, out in zip(records, results):
if out["scoreable"]:
flag = "✓" if out["verdict"] == r["expect"] else "✗"
print(f"{flag} {r['label']:<42} score={out['score']:<7} verdict={out['verdict']} "
f"(expect {r['expect']}, threshold {out['threshold']})")
else:
print(f" {r['label']:<42} UNSCOREABLE (no network signal — out of domain)")
|