Integrity certificate: network intrusion / netflow
Re-run against these exact files on 2026-08-30.

Every line was measured, not asserted. The checks are ordinary pandas over
the CSVs sitting beside this file, so you can re-run them yourself.

  PASS  'benign' is 80.2% of flows (declared 80.0%)
  PASS  'port_scan' is 11.7% of flows (declared 12.0%)
  PASS  'ddos' is 3.0% of flows (declared 3.0%)
  PASS  'dns_exfiltration' is 2.1% of flows (declared 2.0%)
  PASS  'brute_force' is 3.1% of flows (declared 3.0%)
  PASS  label matches attack_cat on all 20,000 flows
  PASS  port_scan carries exactly 1 packet per flow on all 2,348 such flows (a bare SYN, no reply)
  PASS  port_scan frames are 40-60 bytes on all 2,348 such flows (minimal TCP SYN, no payload)
  PASS  port_scan hosts each hit 469 distinct ports vs 9.8 for an ordinary benign host
  PASS  ddos flows converge on exactly 2 targets (T1498 fan-in signature)
  PASS  ddos flows originate from 289 distinct sources (a wide botnet, not a single attacker)
  PASS  ddos per-flow packet count stays within 1-3 on all 593 such flows
  PASS  dns_exfiltration is 100% UDP/port 53 on all 410 such flows (real DNS transport)
  PASS  dns_exfiltration averages 179 bytes/packet vs 80 for this file's own benign DNS traffic
  PASS  brute_force targets only SSH (22) or RDP (3389), all TCP, on all 610 such flows
  PASS  brute_force averages 34 flows per attacker/target pair vs 1.1 for benign traffic
  PASS  no flow implies an impossible sub-40-byte-per-packet frame, on all 20,000 flows
  PASS  flows.src_host_id and dst_host_id have zero orphans against hosts.csv
  PASS  every host_id in hosts.csv is unique across 500 hosts
  PASS  internal hosts carry RFC 1918 (10.0.0.0/8) addresses on all 160 such hosts
  PASS  external hosts carry no private/loopback-range address on all 340 such hosts
  PASS  start_time carries no sub-millisecond precision on all 20,000 flows
  PASS  no flow has a host talking to itself, on all 20,000 flows

22 checks, 22 passing.

Composition, measured from these files:
  hosts:  500 (160 internal, 340 external)
  flows:  20,000
    benign             16,039  (80.2%)
    port_scan           2,348  (11.7%)
    brute_force            610  (3.1%)
    ddos                   593  (3.0%)
    dns_exfiltration       410  (2.1%)

Sources for every named signature:
  Construction method   ID2T / UNSW-NB15 methodology (Cyber Range Lab,
                         Australian Centre for Cyber Security): protocol-
                         realistic background traffic with attacks injected
                         against documented behavior patterns.
  port_scan              MITRE ATT&CK T1595, Active Scanning.
  ddos                   MITRE ATT&CK T1498, Network Denial of Service.
  dns_exfiltration       MITRE ATT&CK T1048.003, Exfiltration Over DNS.
  brute_force            MITRE ATT&CK T1110, Brute Force.

Generated by Misata, https://www.misata.studio
