EXFILSENSE

Behaviour-driven detection · two independent branches

Draw the system before you trust it

Every box below exists on disk or is marked as a contract that was never executed. The distinction is the point of this documentation.

Random Forest DNS dns_v1: trained, framework source Random Forest DNS dns_v1 XGBoost DNS dns_v1: trained XGBoost DNS dns_v1 DNS INPUT: features · 7 DNS INPUT features · 7 LSTM HOST host_v1: trained LSTM HOST host_v1 Random Forest HOST host_v1: trained Random Forest HOST host_v1 XGBoost HOST host_v1: trained, framework source XGBoost HOST host_v1 HOST INPUT: entity features · 50 · 1 398 HOST INPUT entity features · 50 · 1 398 SHAP attribution: implemented. 4 of 5 versions carry a shap manifest SHAP 4 of 5 versions carry a shap manifest Cross-branch simulation sim_v2: simulation. measurement: false · combination: false SIM sim_v2 measurement: false · combination: false Late fusion: specified. contract defined; the entry point exits with code 11 LATE FUSION contract defined; the entry point exits with code 11

Solid outline: executed. Dashed: a contract that was never run. Cyan: named by the simulation manifest as a framework source. Amber: the simulation, and the contract behind it. Framework pair: random-forest dns_v1 + xgboost host_v1.

ComponentStatusEvidence
LSTM HOST host_v1 implemented threshold frozen on VALIDATION
Random Forest DNS dns_v1 implemented threshold frozen on VALIDATION
Random Forest HOST host_v1 implemented threshold frozen on VALIDATION
XGBoost DNS dns_v1 implemented threshold frozen on VALIDATION
XGBoost HOST host_v1 implemented threshold frozen on VALIDATION
SHAP attribution implemented 4 of 5 versions carry a shap manifest
Per-record explanations implemented random-forest dns_v1
Cross-branch simulation sim_v2 simulation measurement: false · combination: false
Logistic Regression late fusion specified contract defined; the entry point exits with code 11
Prediction alignment specified contract defined, never executed
MITRE ATT&CK mapping implemented curated table at training_model/attack_map/attack_map.yml

Probed from disk on every request. Specified means the contract exists in the repository and was never executed — a different statement from either working or absent.