PM-pinou
97 lines
1.9 KiB
YAML
97 lines
1.9 KiB
YAML
server:
|
|
host: 0.0.0.0
|
|
port: 80
|
|
debug: false
|
|
data:
|
|
schema_strict: false
|
|
recursive: false
|
|
geoip:
|
|
enabled: true
|
|
ip_columns: ["src_ip", "dst_ip"]
|
|
drop_columns: [] # 默认不清除经纬列——由加载器自动清洗
|
|
clustering:
|
|
algorithm: hdbscan
|
|
min_cluster_size: 5
|
|
random_state: 42
|
|
anomaly_detection:
|
|
enabled: true
|
|
# PCA采样上限（内存保护）
|
|
max_sample_rows: 10000
|
|
# 风险等级百分位阈值（从数据分布自适应，这里仅做配置覆盖用）
|
|
risk_levels:
|
|
critical: 0.99
|
|
suspicious: 0.95
|
|
watch: 0.80
|
|
llm:
|
|
enabled: true
|
|
base_url: 'https://api.deepseek.com'
|
|
api_key: 'sk-ecd33e5341ff4ec9a2c5a5c97a97699b'
|
|
model: deepseek-v4-flash
|
|
entity:
|
|
subnet_masks: [24, 28]
|
|
ip_columns: ["src_ip", "dst_ip", ":ips", ":ipd", "server-ip", "client-ip"]
|
|
columns:
|
|
src_ip: ipv4
|
|
dst_ip: ipv4
|
|
":ips": ipv4
|
|
":ipd": ipv4
|
|
server-ip: ipv4
|
|
client-ip: ipv4
|
|
server_ip: ipv4
|
|
client_ip: ipv4
|
|
bytes_sent: int
|
|
bytes_rev: int
|
|
duration: float
|
|
tls_version: enum
|
|
cipher_suite: hex
|
|
dst_url: url
|
|
lat: lat_lon
|
|
lon: lat_lon
|
|
timestamp: timestamp
|
|
# User column overrides
|
|
"0ver": enum
|
|
":prs": enum
|
|
":prd": enum
|
|
scnt: enum
|
|
dcnt: enum
|
|
cnam: string
|
|
snam: string
|
|
"4dur": float
|
|
"8ses": float
|
|
"2tmo": float
|
|
"4ksz": int
|
|
cnrs: enum
|
|
isrs: enum
|
|
"8ack": int
|
|
"8ppk": int
|
|
"8dbd": timestamp
|
|
"1ipp": enum
|
|
"4dbn": enum
|
|
tabl: string
|
|
"name": string
|
|
source-node: string
|
|
source_node: string
|
|
ecdhe-named-curve: string
|
|
ecdhe_named_curve: string
|
|
"0cph": hex
|
|
"0crv": hex
|
|
"0rnd": string
|
|
"0rnt": float
|
|
"row": int
|
|
"time": timestamp
|
|
":ips.latd": lat_lon
|
|
":ipd.latd": lat_lon
|
|
":ips.lond": lat_lon
|
|
":ipd.lond": lat_lon
|
|
":ips.ispn": string
|
|
":ipd.ispn": string
|
|
":ips.orgn": string
|
|
":ipd.orgn": string
|
|
":ips.city": string
|
|
":ipd.city": string
|
|
"+.latd": lat_lon
|
|
"+.lond": lat_lon
|
|
"+.ispn": string
|
|
"+.orgn": string
|
|
"+.city": string
|