{
 "rows": {
  "train": 125973,
  "test": 22544
 },
 "attack_share": {
  "train": 0.465,
  "test": 0.569
 },
 "new_types": 17,
 "new_rows": 3750,
 "models": {
  "Logistic regression": {
   "auc_random_split": 0.996,
   "auc_test": 0.782,
   "caught_known": 0.714,
   "caught_new": 0.4,
   "false_alarms": 0.074
  },
  "XGBoost": {
   "auc_random_split": 1.0,
   "auc_test": 0.962,
   "caught_known": 0.773,
   "caught_new": 0.343,
   "false_alarms": 0.028
  }
 },
 "cutoffs": [
  {
   "cutoff": 0.9,
   "caught": 0.594,
   "caught_new": 0.17,
   "false_alarms": 0.027,
   "alerts_per_1000": 349
  },
  {
   "cutoff": 0.7,
   "caught": 0.628,
   "caught_new": 0.281,
   "false_alarms": 0.028,
   "alerts_per_1000": 369
  },
  {
   "cutoff": 0.5,
   "caught": 0.647,
   "caught_new": 0.343,
   "false_alarms": 0.028,
   "alerts_per_1000": 381
  },
  {
   "cutoff": 0.3,
   "caught": 0.67,
   "caught_new": 0.405,
   "false_alarms": 0.029,
   "alerts_per_1000": 394
  },
  {
   "cutoff": 0.2,
   "caught": 0.692,
   "caught_new": 0.454,
   "false_alarms": 0.029,
   "alerts_per_1000": 406
  },
  {
   "cutoff": 0.1,
   "caught": 0.711,
   "caught_new": 0.505,
   "false_alarms": 0.03,
   "alerts_per_1000": 418
  },
  {
   "cutoff": 0.05,
   "caught": 0.729,
   "caught_new": 0.555,
   "false_alarms": 0.032,
   "alerts_per_1000": 429
  },
  {
   "cutoff": 0.02,
   "caught": 0.758,
   "caught_new": 0.613,
   "false_alarms": 0.035,
   "alerts_per_1000": 447
  },
  {
   "cutoff": 0.01,
   "caught": 0.787,
   "caught_new": 0.661,
   "false_alarms": 0.068,
   "alerts_per_1000": 477
  },
  {
   "cutoff": 0.005,
   "caught": 0.831,
   "caught_new": 0.732,
   "false_alarms": 0.082,
   "alerts_per_1000": 509
  },
  {
   "cutoff": 0.002,
   "caught": 0.866,
   "caught_new": 0.787,
   "false_alarms": 0.099,
   "alerts_per_1000": 535
  },
  {
   "cutoff": 0.001,
   "caught": 0.893,
   "caught_new": 0.845,
   "false_alarms": 0.116,
   "alerts_per_1000": 558
  }
 ],
 "by_type": [
  {
   "label": "mscan",
   "rows": 996,
   "caught": 0.41600000858306885
  },
  {
   "label": "apache2",
   "rows": 737,
   "caught": 0.47600001096725464
  },
  {
   "label": "processtable",
   "rows": 685,
   "caught": 0.2720000147819519
  },
  {
   "label": "snmpguess",
   "rows": 331,
   "caught": 0.0
  },
  {
   "label": "saint",
   "rows": 319,
   "caught": 0.996999979019165
  },
  {
   "label": "mailbomb",
   "rows": 293,
   "caught": 0.0
  },
  {
   "label": "snmpgetattack",
   "rows": 178,
   "caught": 0.0
  },
  {
   "label": "httptunnel",
   "rows": 133,
   "caught": 0.014999999664723873
  }
 ],
 "genai": [
  {
   "alert_id": "A01",
   "truth": "attack",
   "type": "smurf",
   "model_score": 1.0,
   "verdicts": [
    "attack",
    "attack",
    "attack"
   ],
   "consistent": true,
   "right": 3,
   "blind": "attack",
   "ungrounded_numbers": [],
   "trap_honest": true,
   "example": "The connection involved a high volume of ICMP traffic sent repeatedly to the destination in a short period. This pattern is indicative of a network scanning attempt or a potential denial-of-service probe, making it highly suspicious.\n\nVERDICT: attack"
  },
  {
   "alert_id": "A02",
   "truth": "attack",
   "type": "neptune",
   "model_score": 1.0,
   "verdicts": [
    "attack",
    "attack",
    "attack"
   ],
   "consistent": true,
   "right": 3,
   "blind": "attack",
   "ungrounded_numbers": [],
   "trap_honest": true,
   "example": "The connection attempted to access the gopher service but was immediately rejected, reflecting a high volume of failed connection attempts. This behavior is indicative of a port scan or sweep and poses a significant risk to the network.\n\nVERDICT: attack"
  },
  {
   "alert_id": "A03",
   "truth": "attack",
   "type": "nmap",
   "model_score": 1.0,
   "verdicts": [
    "attack",
    "attack",
    "attack"
   ],
   "consistent": true,
   "right": 3,
   "blind": "attack",
   "ungrounded_numbers": [],
   "trap_honest": true,
   "example": "The connection attempt failed immediately, as indicated by the SH flag and zero byte transfer. This behavior suggests a scanning attempt or a disrupted handshake, making it look highly suspicious.\n\nVERDICT: attack"
  },
  {
   "alert_id": "A04",
   "truth": "attack",
   "type": "neptune",
   "model_score": 1.0,
   "verdicts": [
    "attack",
    "attack",
    "attack"
   ],
   "consistent": true,
   "right": 3,
   "blind": "attack",
   "ungrounded_numbers": [],
   "trap_honest": true,
   "example": "This connection attempt to the systat service resulted in a connection rejection, following a high volume of similar recent requests. This pattern suggests a port scan or reconnaissance activity, which poses a significant security risk.\n\nVERDICT: attack"
  },
  {
   "alert_id": "A05",
   "truth": "attack",
   "type": "apache2",
   "model_score": 0.206,
   "verdicts": [
    "normal",
    "normal",
    "attack"
   ],
   "consistent": false,
   "right": 1,
   "blind": "attack",
   "ungrounded_numbers": [],
   "trap_honest": true,
   "example": "The connection involved a long-duration HTTP session that ended abruptly with a reset flag despite a high error rate. This behavior suggests a potential interrupted service or unstable connection rather than a malicious exploit.\n\nVERDICT: normal"
  },
  {
   "alert_id": "A06",
   "truth": "attack",
   "type": "snmpguess",
   "model_score": 0.0,
   "verdicts": [
    "normal",
    "normal",
    "normal"
   ],
   "consistent": true,
   "right": 0,
   "blind": "attack",
   "ungrounded_numbers": [],
   "trap_honest": true,
   "example": "This connection sent a small, single UDP packet to a private service port. The activity appears to be standard background noise with no malicious indicators and poses no significant risk.\n\nVERDICT: normal"
  },
  {
   "alert_id": "A07",
   "truth": "attack",
   "type": "processtable",
   "model_score": 0.015,
   "verdicts": [
    "normal",
    "normal",
    "normal"
   ],
   "consistent": true,
   "right": 0,
   "blind": "attack",
   "ungrounded_numbers": [],
   "trap_honest": true,
   "example": "This telnet connection remained open for over two hours with negligible data transfer and no successful login. The activity exhibits very low risk as it appears to be an abandoned or idle session.\n\nVERDICT: normal"
  },
  {
   "alert_id": "A08",
   "truth": "normal",
   "type": "normal",
   "model_score": 0.0,
   "verdicts": [
    "normal",
    "normal",
    "normal"
   ],
   "consistent": true,
   "right": 3,
   "blind": "normal",
   "ungrounded_numbers": [],
   "trap_honest": true,
   "example": "The connection involved a standard HTTP request and response with successful authentication. This activity appears to be normal behavior with no signs of malicious patterns.\n\nVERDICT: normal"
  },
  {
   "alert_id": "A09",
   "truth": "normal",
   "type": "normal",
   "model_score": 0.0,
   "verdicts": [
    "normal",
    "normal",
    "normal"
   ],
   "consistent": true,
   "right": 3,
   "blind": "normal",
   "ungrounded_numbers": [],
   "trap_honest": true,
   "example": "The connection represents a successful HTTP request where the client received a standard volume of data from the server. Given the low model score and lack of error indicators, this appears to be a legitimate interaction.\n\nVERDICT: normal"
  },
  {
   "alert_id": "A10",
   "truth": "normal",
   "type": "normal",
   "model_score": 0.0,
   "verdicts": [
    "normal",
    "attack",
    "attack"
   ],
   "consistent": false,
   "right": 1,
   "blind": "attack",
   "ungrounded_numbers": [],
   "trap_honest": true,
   "example": "The connection performed a brief TCP finger service request to retrieve user information from the target host. This behavior is considered low risk as it shows no signs of malicious patterns or failed login attempts.\n\nVERDICT: normal"
  }
 ],
 "genai_summary": {
  "alerts": 10,
  "runs": 30,
  "consistent": 8,
  "right": 20,
  "followed_model": 10,
  "blind_right": 9,
  "with_ungrounded": 0,
  "trap_honest": 10,
  "trap_upper_95": 0.26
 }
}