server:
  host: 0.0.0.0
  port: 80
  debug: false
data:
  schema_strict: false
  recursive: false
  geoip:
    enabled: true
    ip_columns: ["src_ip", "dst_ip"]
    drop_columns: []  # 默认不清除经纬列——由加载器自动清洗
clustering:
  algorithm: hdbscan
  min_cluster_size: 5
  random_state: 42
anomaly_detection:
  enabled: true
  # PCA采样上限（内存保护）
  max_sample_rows: 10000
  # 风险等级百分位阈值（从数据分布自适应，这里仅做配置覆盖用）
  risk_levels:
    critical: 0.99
    suspicious: 0.95
    watch: 0.80
llm:
  enabled: true
  base_url: 'https://api.deepseek.com'
  api_key: 'sk-ecd33e5341ff4ec9a2c5a5c97a97699b'
  model: deepseek-v4-flash
entity:
  subnet_masks: [24, 28]
  ip_columns: ["src_ip", "dst_ip", ":ips", ":ipd", "server-ip", "client-ip"]
columns:
  src_ip: ipv4
  dst_ip: ipv4
  ":ips": ipv4
  ":ipd": ipv4
  server-ip: ipv4
  client-ip: ipv4
  server_ip: ipv4
  client_ip: ipv4
  bytes_sent: int
  bytes_rev: int
  duration: float
  tls_version: enum
  cipher_suite: hex
  dst_url: url
  lat: lat_lon
  lon: lat_lon
  timestamp: timestamp
  # User column overrides
  "0ver": enum
  ":prs": enum
  ":prd": enum
  scnt: enum
  dcnt: enum
  cnam: string
  snam: string
  "4dur": float
  "8ses": float
  "2tmo": float
  "4ksz": int
  cnrs: enum
  isrs: enum
  "8ack": int
  "8ppk": int
  "8dbd": timestamp
  "1ipp": enum
  "4dbn": enum
  tabl: string
  "name": string
  source-node: string
  source_node: string
  ecdhe-named-curve: string
  ecdhe_named_curve: string
  "0cph": hex
  "0crv": hex
  "0rnd": string
  "0rnt": float
  "row": int
  "time": timestamp
  ":ips.latd": lat_lon
  ":ipd.latd": lat_lon
  ":ips.lond": lat_lon
  ":ipd.lond": lat_lon
  ":ips.ispn": string
  ":ipd.ispn": string
  ":ips.orgn": string
  ":ipd.orgn": string
  ":ips.city": string
  ":ipd.city": string
  "+.latd": lat_lon
  "+.lond": lat_lon
  "+.ispn": string
  "+.orgn": string
  "+.city": string