Honeypot Command Embedder
TF-IDF command similarity embedder with Isolation Forest anomaly detector and Logistic Regression attack stage classifier.
Model Description
- Developed by: Aria AI Security Engineering Team
- Model type: TF-IDF feature extraction + Isolation Forest + Logistic Regression
- License: MIT
Intended Uses
- Command sequence similarity for honeypot session clustering
- Campaign detection via HDBSCAN on session embeddings
- Behavioral anomaly scoring on session features
- Attack stage classification (reconnaissance → impact)
Evaluation (Synthetic Benchmark)
| Metric | Value |
|---|---|
| Technique Coverage | 100% (synthetic holdout) |
| Baseline Improvement | +50pp vs keyword-only |
| Campaign Detection | 4/4 expected |
| Anomaly Rate | 60% (contamination=0.15) |
Limitations
- Synthetic data only — real-world generalization not validated
- TF-IDF less semantic than transformer embeddings
- Keyword-based ATT&CK mapping, not fine-tuned classifier
Privacy Notes
- IPs: SHA-256 hash + /16 prefix
- Passwords: pattern only, never raw values
- Timestamps: +72h shift on all events
- Downloads last month
- -