Machine Learning Models
Gen0Sec ships small, purpose-built models rather than one general classifier. Each answers a narrow question about traffic the agent is already fingerprinting, and each runs on the host — no traffic leaves the machine to be scored.
This page is the summary. Every model has a fuller card covering training data, evaluation and limitations; read the card for any model you intend to make a policy decision on.
What ships
| Model | Question | Input → output |
|---|---|---|
| Fingerprint classifier | Is this client's JA4+ fingerprint malicious? | Fingerprint features → benign / malicious, with a probability |
| Flow classifier | Does this flow behave maliciously? | Flow features → benign / malicious, with probabilities |
| Traffic classifier | What kind of traffic is this? | Fused signals → one of seven classes |
| Severity model | How serious is this, and for how long? | Per-source context → a bounded severity score |
| JA4-JEPA embedder | What is this fingerprint near? | Fingerprint → an embedding, no verdict |
All of them are small networks or trees exported to ONNX, executed on CPU, with preprocessing baked into the graph so the agent and the training pipeline cannot drift apart on feature scaling. Models arrive with a signed integrity manifest and are hot-swapped at runtime — no restart, no dropped traffic.
The fingerprint classifier, in detail
The one you are most likely to act on. It takes the JA4+ views the agent already captures — the TLS client and server fingerprints, the TCP handshake pair, and the HTTP fingerprint — encodes them into a fixed feature vector, and returns a binary verdict with a probability.
Gradient-boosted trees are the default backend. They are the most accurate of the three tried, and the only one that handles a missing fingerprint view natively rather than imputing it to zero — which matters, because a real connection frequently presents only some views.
An alternative built on self-supervised embeddings scores within a rounding error of it on the same data, which is a useful signal that the result is a property of the problem rather than of one modelling choice.
Measured performance
On a held-out test set of 3,599 connections, split so that a given fingerprint appears in training or in test but never both:
| Metric | Value |
|---|---|
| Accuracy | 0.9964 |
| Precision (malicious) | 0.9925 |
| Recall (malicious) | 0.9936 |
| ROC-AUC | 0.9999 |
Seven false positives and six false negatives out of 3,599.
Those figures are a matched-conditions upper bound, not a prediction of live performance.
In the corpus they were measured on, benign and malicious traffic largely came from different capture pipelines. That leaves the classes partly separable by where the traffic was collected rather than by anything about the client. We know exactly how strong that effect is, because we measured it: a model given only the five bits saying which fingerprint views are present — no fingerprint content whatsoever — scores 0.9999 on one split and 0.2954 on another. Worse than chance. The shortcut even inverts between splits.
The fair split above removes that shortcut and proves the model can discriminate on fingerprint content. It does not prove it will hold up on your traffic. For that, benign and malicious samples have to be captured through the same pipeline — ideally the agent's own — so the only thing left to learn is the fingerprint.
Treat 0.996 as a ceiling measured under favourable conditions, and validate against your own traffic before setting policy on it.
How to use the output responsibly
- Not a standalone block. Use a model verdict as one signal among several — pair it with IDS context, threat reputation, or a second model. Amygdala exposes all of them as ordinary rule fields precisely so a rule can require two before acting.
- Set your own threshold. Probabilities are uncalibrated. The right cut-off depends on how common malicious traffic actually is in your environment, not on 0.5.
- Expect distribution shift. On deliberately out-of-distribution malware samples the classifier does misclassify some as benign. That is the same capture-source effect, seen from the other side.
- A fingerprint is not a person. Many legitimate clients share one. Treat it as a strong grouping signal, not proof of identity.
Where each one runs
Inference is Linux-only. Cortex compiles on other platforms so the rest of the agent builds and tests cross-platform, but the inference entry points return errors there rather than scoring traffic.
Of the five, only the fingerprint and flow classifiers can trigger enforcement directly. The traffic classifier is deliberately a parallel signal, and the severity model produces a score that the policy layer — not the model — turns into a ban duration.
See also
- Cortex — the engine that runs these models
- Threat Detection — reputation signals to combine them with
- JA4+ — the fingerprints they consume
- Amygdala — where a verdict becomes a decision