Synthetic network beacon flows (DS-0007), version 1.0
==========================================================

Every row here was written by generate.py from a fixed seed (20261107). No row comes from a phone, a
capture or a network. Device names, hosts, sizes, times and counts are invented.

The question: is this phone's flow pattern to one destination command-and-control style beaconing,
or normal app traffic? One row summarises one destination as seen from one phone over 24 hours.

What is in it
  data/train.csv                 2075 rows from 105 phones, with a label column
  data/test.csv                  889 rows from 45 other phones, no label column
  answers/reference_answers.csv  label and family of every row in both files (open it after you have predicted)
  answers/reference_summary.json counts and the numbers quoted in the teaching guide
  DATA_DICTIONARY.md             every column: meaning, unit, how an examiner would compute it
  TEACHING_GUIDE.md              the exercise, the traps, expected results, discussion questions
  code/baseline.py               standard-library baselines (rule, logistic regression, tree, forest)
  code/baseline_sklearn.py       optional scikit-learn version
  code/evaluate.py               scores a predictions file against the reference answers
  generator/                     the script and templates that wrote everything (MIT)
  LICENCE.txt                    licences

Quick start (Python 3.8 or later, nothing to install)
  cd code
  python baseline.py --model forest --out predictions.csv
  python evaluate.py predictions.csv

Honest limits
  Synthetic data teaches the method. It is not a measure of accuracy on real phones or real networks.
  The traffic families, their overlap and the share of beaconing rows (about 11.7 percent of the training rows) are
  choices made in the generator. A flow that a model scores high is an indicator worth a closer look,
  consistent with beaconing. It does not prove command-and-control.

Check the files with SHA256SUMS.txt or manifest.json (next to this archive).
Licence: data CC BY 4.0, code MIT.
