docs: expand arm names, drop stale version strings (README.md)
Browse files
README.md
CHANGED
|
@@ -20,9 +20,8 @@ metrics:
|
|
| 20 |
|
| 21 |
# GDNet
|
| 22 |
|
| 23 |
-
GDNet
|
| 24 |
|
| 25 |
-
This repository contains the weights and configuration. Code is at [github.com/lupingQAQ/gdnet](https://github.com/lupingQAQ/gdnet). The technical report is at [paper/GDNet.pdf](https://github.com/lupingQAQ/gdnet/blob/main/paper/GDNet.pdf) in English and [paper/GDNet-zh.pdf](https://github.com/lupingQAQ/gdnet/blob/main/paper/GDNet-zh.pdf) in Chinese. A project page with the abstract and the audit table is at https://lupingQAQ.github.io/gdnet/.
|
| 26 |
|
| 27 |
## Model details
|
| 28 |
|
|
@@ -73,7 +72,6 @@ The product labels are:
|
|
| 73 |
Additional results:
|
| 74 |
|
| 75 |
- Unknown rejection: 100% on 18 unknown-product bins.
|
| 76 |
-
- Malicious macro-F1: 0.9702 on deduplicated USTC-TFC2016 (n=1242).
|
| 77 |
- Acceptance: 8/10 products without timing rescue; 9/10 with the internal timing rule, which is not included in v0.1.0.
|
| 78 |
- Throughput: 253 flows/s for the ensemble, 1,017 flows/s for one arm, on an RTX 4090.
|
| 79 |
|
|
@@ -86,7 +84,6 @@ The test split is a flow-level half of the validation set, not a session-level h
|
|
| 86 |
- CPU inference is not supported. The GDN backbone uses Triton kernels and requires CUDA.
|
| 87 |
- The model was trained on lab traffic. Production performance with different software versions, proxies, or NAT is unknown.
|
| 88 |
- The malicious head is a secondary output and is not calibrated for production alerting.
|
| 89 |
-
- Public benchmark splits contain about 80% train/test overlap (Tor 0%). Absolute benchmark numbers are not evidence of generalization.
|
| 90 |
|
| 91 |
## Ethical and legal considerations
|
| 92 |
|
|
|
|
| 20 |
|
| 21 |
# GDNet
|
| 22 |
|
| 23 |
+
GDNet names what produced a flow from its first five packets: a security appliance, an endpoint security agent, or a piece of common software. It reports a product label, a type, a tier, and an open-set distance. Flows that do not match a known product are rejected as unknown.
|
| 24 |
|
|
|
|
| 25 |
|
| 26 |
## Model details
|
| 27 |
|
|
|
|
| 72 |
Additional results:
|
| 73 |
|
| 74 |
- Unknown rejection: 100% on 18 unknown-product bins.
|
|
|
|
| 75 |
- Acceptance: 8/10 products without timing rescue; 9/10 with the internal timing rule, which is not included in v0.1.0.
|
| 76 |
- Throughput: 253 flows/s for the ensemble, 1,017 flows/s for one arm, on an RTX 4090.
|
| 77 |
|
|
|
|
| 84 |
- CPU inference is not supported. The GDN backbone uses Triton kernels and requires CUDA.
|
| 85 |
- The model was trained on lab traffic. Production performance with different software versions, proxies, or NAT is unknown.
|
| 86 |
- The malicious head is a secondary output and is not calibrated for production alerting.
|
|
|
|
| 87 |
|
| 88 |
## Ethical and legal considerations
|
| 89 |
|