EXFILSENSE
02 / DOCUMENTATION

The set, by what you are doing

Index loads on first keystroke.

learning by doing

DocumentCovers
01 — From raw logs to a training matrix The assembled training matrix on disk
02 — Train, evaluate, explain A trained version with a report

task by task

DocumentCovers
retrain-a-version Re-run a version end to end
freeze-a-threshold Select and freeze an operating point
compute-attributions Produce the SHAP artefacts a report requires
read-a-per-record-explanation Read one record's decomposition
build-lstm-sequences Build the sequence dataset and train on it
run-a-fusion-simulation Build, read and remove `sim_v2`
add-a-dataset Register a new corpus
choose-an-environment Pick the right conda environment
delete-a-version-or-report Remove artefacts and catalog rows
browse-results-in-the-web-ui Read the artefacts in a browser

the facts

DocumentCovers
conventions Shared flags, exit codes, version naming
cli-data-pipeline `data-normalization`, `feature-preparation`
model-ready-cli `model-ready`, its execution policy and audit
cli-training-model `training-model` in full
configuration `config.py` constants, `.env` paths
data-layers Storage layout and per-file schemas
datasets Corpora, volumes, selection funnel
models Five versions: hyperparameters, thresholds, metrics
attribution-artifacts Manifest fields, local values, additivity evidence
feature-vocabulary Feature dictionary, syscall table, ABI
environment Environments, library versions, hardware
modules Package layout of the four stages

why it is built this way

DocumentCovers
branch-architecture Why two branches; why DNS counts events and HOST counts entities
model-selection Why Random Forest, XGBoost and an LSTM
attribution-methods Which explainer each model gets, and why TreeSHAP cannot explain the LSTM
attribution-on-test Why attributions read TEST, and why a flag is still required
late-fusion-not-executed Why the stacking layer was never trained
fusion-simulation What `sim_v2` shows and what it does not
mitre-not-implemented Why there is no ATT&CK mapping
DocumentScope
Sections That Depend on Artifacts Which parts of this documentation restate a value read from disk, and therefore go stale when a run is repeated.
Documentation Release Checklist What to verify before publishing a new model version, so the documentation and the artefacts agree.