Simulation under a stated coupling assumption. The score distributions are empirical, taken from the trained models on the TEST split, but the co-occurrence of the two channels is modelled rather than observed: the two branches were trained on unrelated corpora and share no key that would say which DNS record and which host entity belong to one incident. These numbers are not a measurement of a fused detector on paired data.
Read from simulation_manifest.json · split TEST
| Branch | Model | Threshold | Rows | Positives | Checksum |
|---|---|---|---|---|---|
| dns | random-forest dns_v1 | 0.4 | 26 245 | 7 874 | 3d456e55dfac6b53… |
| host | xgboost host_v1 | 0.79492521286 | 1 548 | 128 | a9dcbb2332e47535… |
Variants
The framework pair, and a robustness check that swaps the DNS source. Both are reported so the effect can be seen not to depend on one model choice.
| Variant | DNS | HOST | Estimable | FN reduction | Positive everywhere |
|---|---|---|---|---|---|
| framework | random-forest dns_v1 | xgboost host_v1 | 36 | 12.61 % – 80.37 % | yes |
| dns-xgboost-check | xgboost dns_v1 | xgboost host_v1 | 36 | 12.71 % – 80.27 % | yes |
What was taken from the data and what was assumed. The score distributions are empirical — they are the two trained models' outputs on the TEST split. The co-occurrence of the two channels is not: the branches were trained on unrelated corpora and share no key, so no record on one side can be said to belong to the same incident as a record on the other. That relationship is treated as unknown and swept over the grid below, and at each point a decision threshold is searched.
Run
One cell per point of the grid. Colour is magnitude on a single hue; the number is printed in every cell, so nothing depends on reading a shade. The nine cells the manifest excludes are hatched and marked — they are shown rather than dropped, because which cells could not be estimated is part of the result.
| manifestation \ ρ | -0.3 | -0.15 | 0.0 | 0.15 | 0.3 | 0.45 | 0.6 | 0.75 | 0.9 |
|---|---|---|---|---|---|---|---|---|---|
| 0.5 | 48.95 | 46.31 | 42.92 | 37.7 | 33.86 | 29.63 | 25.02 | 18.95 | 12.61 |
| 0.65 | 64.05 | 58.91 | 53.79 | 49.51 | 44.39 | 38.11 | 32.76 | 25.34 | 16.6 |
| 0.8 | 75.25 | 71.93 | 65.71 | 61.66 | 57.11 | 48.65 | 42.88 | 31.67 | 21.37 |
| 0.9 | 80.37 | 76.78 | 75.23 | 69.66 | 65.08 | 61.47 | 48.78 | 40.72 | 29.76 |
| 1.0 | not estimable, 6 FN | not estimable, 3 FN | not estimable, 1 FN | not estimable, 2 FN | not estimable, 8 FN | not estimable, 6 FN | not estimable, 1 FN | not estimable, 5 FN | not estimable, 4 FN |
36 of 45 cells estimable. Hover or focus a cell for its detail.
The nine excluded cells and the count that excluded each one. Every value below is under 100, which is the rule quoted above doing its work rather than being asserted.
| Manifestation | ρ requested | Best single branch FN |
|---|---|---|
| 1.0 | -0.3 | 6 |
| 1.0 | -0.15 | 3 |
| 1.0 | 0.0 | 1 |
| 1.0 | 0.15 | 2 |
| 1.0 | 0.3 | 8 |
| 1.0 | 0.45 | 6 |
| 1.0 | 0.6 | 1 |
| 1.0 | 0.75 | 5 |
| 1.0 | 0.9 | 4 |
This is a range over a swept assumption, not an interval around a measurement. No fused detector was evaluated on paired data, so no precision or recall may be quoted for the pair.
In plain language
deterministicWhat this model is reacting to. This is a simulation over random-forest dns_v1 + xgboost host_v1. The score distributions are empirical, taken from the TEST split; the co-occurrence of the two channels is modelled, because the branches were trained on unrelated corpora and share no key.
Where to stop. Simulation under a stated coupling assumption. The score distributions are empirical, taken from the trained models on the TEST split, but the co-occurrence of the two channels is modelled rather than observed: the two branches were trained on unrelated corpora and share no key that would say which DNS record and which host entity belong to one incident. These numbers are not a measurement of a fused detector on paired data.
No curated ATT&CK row applies to these features, so no technique is named. The table is referenced, never derived — see why there is no ATT&CK mapping.
ANTHROPIC_API_KEY is not set, so the deterministic briefing
is shown. This is a supported state, not a failure. Viewing a page never
calls the API in either case — generation happens only through
python manage.py web build-explanations.
The generated fusion report, served exactly as written.
open in new tab