Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improved field-profile scoring.

Browse Source
This commit is contained in:
larssand
2026-06-22 21:37:32 +02:00
parent a7e23690da
commit 4e5f928405
3 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/fgai/baseline.py
View File

@@ -134,11 +134,17 @@ class BaselineStore:
rows = connection.execute("select events, numeric_sum from profile_buckets where stream_id=? and entity=? and field=? order by bucket_start desc limit 25", (stream, entity, field)).fetchall()
if len(rows) < 12:
continue
averages = [row[1] / row[0] if row[0] else 0 for row in rows]
baseline = mean(averages)
deviation = abs((values[1] / values[0] if values[0] else 0) - baseline)
if deviation > (pstdev(averages) or 1.0) * 3:
output[entity].append({"field": field, "stream_id": stream, "score": 15, "reason": f"{field} deviates from its stream baseline"})
if values[1] == 0:
history = [row[0] for row in rows]
current_value = values[0]
reason = f"{field} event rate deviates from its stream baseline"
else:
history = [row[1] / row[0] if row[0] else 0 for row in rows]
current_value = values[1] / values[0] if values[0] else 0
reason = f"{field} value deviates from its stream baseline"
deviation = abs(current_value - mean(history))
if deviation > (pstdev(history) or 1.0) * 3:
output[entity].append({"field": field, "stream_id": stream, "score": 15, "reason": reason})
return output
def profiles(self, source_ips: set[str]) -> dict[str, dict[str, object]]: