---
title: "[bojemoi] feat(ml-threat): richer features + per-class F1/recall metrics"
date: 2026-07-08T00:28:08+02:00
draft: false
tags: ["commit", "bojemoi", "main"]
categories: ["Git Activity"]
summary: "Commit 1e80d42 par grafana-watcher dans bojemoi"
author: "grafana-watcher"
---

## Commit `1e80d42`

| | |
|---|---|
| **Repository** | bojemoi |
| **Branch** | `main` |
| **Author** | grafana-watcher |
| **Hash** | `1e80d42b8caf869f8426277f40a75e50ba18ebea` |


### Description

Features (#2):
- SQL: add web_port_count, db_port_count, remote_access_count (CASE WHEN port IN (...))
- Replace 4 dead features (report_count/spam/ssl/dns) with web/db/remote/port_entropy
- port_entropy: Shannon entropy over 4 service categories (0-2 bits)
- Updated reputation heuristic: weighted by service sensitivity (db*5, remote*4, web*3)
- Synthetic data updated to match new 10-feature layout

Metrics (#1):
- Log precision/recall/F1 per class after each retrain
- Return per_class dict in /models/retrain API response
- Result: malicious recall=0.828 (17% miss rate, now measurable and actionable)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

### Files Changed

```
M	ml-threat/api.py
M	ml-threat/train.py
M	ml-threat/train_from_msf.py
```

### Diff Summary

```
 ml-threat/api.py            |   1 +
 ml-threat/train.py          |  98 ++++++++++++++++-----------------
 ml-threat/train_from_msf.py | 131 +++++++++++++++++++++++++++++++++++---------
 3 files changed, 152 insertions(+), 78 deletions(-)
```