Fix: eng.update=False before detect; m3.drain.clusters; rarity signal added to BGL axis

drain4/eval_temporal.py

@@ -14,7 +14,7 @@ Axis 1 — injected anomalies on a real log stream:
   counts only (what naive alerting gets from stock Drain3).
 
 Axis 2 — real labels (BGL):
-  Rank BGL 2k lines by novelty+entropy signals; report AUC against the
+  Rank BGL 2k lines by novelty/entropy signals; report AUC against the
   machine-generated alert labels (Label column, "-" = normal).
 
 Usage: python eval_temporal.py [--skip-zookeeper] [--skip-bgl]
@@ -36,7 +36,6 @@ from drain4.parser import TemplateMiner
 from drain4.temporal import SpatioTemporalEngine, SUSPICIOUS_PATTERNS, robust_stats
 
 LOGHUB = "https://raw.githubusercontent.com/logpai/loghub/master/"
-ZOOKEEPER_2K = LOGHUB + "Zookeeper/Zookeeper_2k.log_structured.csv"
 ZOOKEEPER_PARQUET = (
     "https://huggingface.co/datasets/bolu61/loghub_2/resolve/refs%2Fconvert%2Fparquet/"
     "default/partial-test/0000.parquet"
@@ -66,7 +65,7 @@ def fetch(url: str, timeout: int = 900) -> bytes:
 
 
 def load_zookeeper():
-    """Full Zookeeper stream (ts, content), chronological. HF parquet first."""
+    """Full Zookeeper stream (ts, content), chronological. HF parquet."""
     raw = fetch(ZOOKEEPER_PARQUET, timeout=300)
     import pandas as pd
 
@@ -145,6 +144,10 @@ def axis1() -> dict:
             eng.process(ts, tid, template=tmpl, raw=content)
             eng.record_entropy(tid, content)
             continue
+        if not eng.update:
+            pass
+        else:
+            eng.update = False  # freeze baselines at the split
         w = wof(ts)
         if w in (w_silence, w_silence2) and tid == silence_tid:
             continue  # silence: remove the template's lines for these windows
@@ -210,7 +213,7 @@ def axis1() -> dict:
     res = {
         "n_lines": len(lines),
         "n_templates_ours": len(tids),
-        "n_templates_drain3": len(m3.clusters),
+        "n_templates_drain3": len(m3.drain.clusters),
         "injected_windows": labels,
         "ours_observability": metrics(flagged_obs, labels),
         "ours_security": metrics(flagged_sec, labels),
@@ -235,14 +238,16 @@ def axis2() -> dict:
         return {"skipped": "no positive labels"}
 
     miner = TemplateMiner(similarity="lcs")
-    novelty_scores, entropy_scores, combined = [], [], []
+    novelty_scores, rarity_scores, entropy_scores, combined = [], [], [], []
     seen: set = set()
+    counts: Counter = Counter()
     ent_hist: dict = {}
     for content in contents:
         cluster, _ = miner.add_log_message(content)
         tid = cluster.template_id
-        nov = 1.0 if tid not in seen else 0.0
-        seen.add(tid)
+        counts[tid] += 1
+        nov = 1.0 if counts[tid] == 1 else 0.0
+        rarity = 1.0 / counts[tid]  # decays as the template repeats
         if any(p.search(content) for p in SUSPICIOUS):
             ent = 1.0
         else:
@@ -257,8 +262,9 @@ def axis2() -> dict:
         else:
             ent_score = 0.0
         novelty_scores.append(nov)
+        rarity_scores.append(rarity)
         entropy_scores.append(ent_score)
-        combined.append(max(nov, ent_score))
+        combined.append(max(nov, rarity, ent_score))
 
     def auc(scores):
         pairs = sorted(zip(scores, labels), key=lambda x: x[0])
@@ -283,6 +289,7 @@ def axis2() -> dict:
         "n_lines": len(contents),
         "n_alert_lines": n_pos,
         "auc_novelty": round(auc(novelty_scores), 3),
+        "auc_rarity": round(auc(rarity_scores), 3),
         "auc_entropy": round(auc(entropy_scores), 3),
         "auc_combined": round(auc(combined), 3),
     }