luping123 commited on
Commit
8dd30d8
·
verified ·
1 Parent(s): 045e337

docs: expand arm names, drop stale version strings (README.md)

Browse files
Files changed (1) hide show
  1. README.md +1 -4
README.md CHANGED
@@ -20,9 +20,8 @@ metrics:
20
 
21
  # GDNet
22
 
23
- GDNet identifies security products and services from the first five packets of a network flow. It reports a product label, a type, a tier, and an open-set distance. Flows that do not match a known product are rejected as unknown.
24
 
25
- This repository contains the weights and configuration. Code is at [github.com/lupingQAQ/gdnet](https://github.com/lupingQAQ/gdnet). The technical report is at [paper/GDNet.pdf](https://github.com/lupingQAQ/gdnet/blob/main/paper/GDNet.pdf) in English and [paper/GDNet-zh.pdf](https://github.com/lupingQAQ/gdnet/blob/main/paper/GDNet-zh.pdf) in Chinese. A project page with the abstract and the audit table is at https://lupingQAQ.github.io/gdnet/.
26
 
27
  ## Model details
28
 
@@ -73,7 +72,6 @@ The product labels are:
73
  Additional results:
74
 
75
  - Unknown rejection: 100% on 18 unknown-product bins.
76
- - Malicious macro-F1: 0.9702 on deduplicated USTC-TFC2016 (n=1242).
77
  - Acceptance: 8/10 products without timing rescue; 9/10 with the internal timing rule, which is not included in v0.1.0.
78
  - Throughput: 253 flows/s for the ensemble, 1,017 flows/s for one arm, on an RTX 4090.
79
 
@@ -86,7 +84,6 @@ The test split is a flow-level half of the validation set, not a session-level h
86
  - CPU inference is not supported. The GDN backbone uses Triton kernels and requires CUDA.
87
  - The model was trained on lab traffic. Production performance with different software versions, proxies, or NAT is unknown.
88
  - The malicious head is a secondary output and is not calibrated for production alerting.
89
- - Public benchmark splits contain about 80% train/test overlap (Tor 0%). Absolute benchmark numbers are not evidence of generalization.
90
 
91
  ## Ethical and legal considerations
92
 
 
20
 
21
  # GDNet
22
 
23
+ GDNet names what produced a flow from its first five packets: a security appliance, an endpoint security agent, or a piece of common software. It reports a product label, a type, a tier, and an open-set distance. Flows that do not match a known product are rejected as unknown.
24
 
 
25
 
26
  ## Model details
27
 
 
72
  Additional results:
73
 
74
  - Unknown rejection: 100% on 18 unknown-product bins.
 
75
  - Acceptance: 8/10 products without timing rescue; 9/10 with the internal timing rule, which is not included in v0.1.0.
76
  - Throughput: 253 flows/s for the ensemble, 1,017 flows/s for one arm, on an RTX 4090.
77
 
 
84
  - CPU inference is not supported. The GDN backbone uses Triton kernels and requires CUDA.
85
  - The model was trained on lab traffic. Production performance with different software versions, proxies, or NAT is unknown.
86
  - The malicious head is a secondary output and is not calibrated for production alerting.
 
87
 
88
  ## Ethical and legal considerations
89