[bojemoi] feat(ml-threat): richer features + per-class F1/recall metrics

Commit 1e80d42

Description

Features (#2):

• SQL: add web_port_count, db_port_count, remote_access_count (CASE WHEN port IN (…))
• Replace 4 dead features (report_count/spam/ssl/dns) with web/db/remote/port_entropy
• port_entropy: Shannon entropy over 4 service categories (0-2 bits)
• Updated reputation heuristic: weighted by service sensitivity (db5, remote4, web*3)
• Synthetic data updated to match new 10-feature layout

Metrics (#1):

• Log precision/recall/F1 per class after each retrain
• Return per_class dict in /models/retrain API response
• Result: malicious recall=0.828 (17% miss rate, now measurable and actionable)

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

Files Changed

Diff Summary