# Evolving-Net

**Repository Path**: LiX_007/evolving-net

## Basic Information

- **Project Name**: Evolving-Net
- **Description**: No description available
- **Primary Language**: Unknown
- **License**: Not specified
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2026-03-30
- **Last Updated**: 2026-05-06

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# Evolving-Net

NetMambaPlus 多模态 IDS2018 类增量实验工程。当前启动入口只保留原菜单模式 8 的完整流程:

```text
Benign + Botnet -> Brute_Force + DDoS -> 自动按本地类别继续分组
```

旧的通用 preset、DoH/route1 选择菜单和独立任务协议已从 `scripts/run_experiment.sh` 移除；数据集预处理作为固定 IDS2018 配置下的工作流保留。

## 当前范围

- 统一入口: `scripts/run_experiment.sh`
- 固定配置: `configs/medal_dns_netmamba_plus_mm_ids2018_class_incremental.json`
- 训练入口: `scripts/main_experiment_multimodal.py`
- 模型主线: `NetMambaPlusMultimodalClassifier`
- 增量方案: Evolving-Net v2.3 prototype-routed modular CIL，固定启用

输入特征:

- `x_byte`: early-packet byte/header/payload 序列
- `x_size`: `signed_sizes_centered` 包长方向序列
- `x_iat`: log 压缩包间隔序列
- `x_burst`: Rap-style directional burst 序列

## 环境

推荐使用项目环境脚本:

```bash
bash scripts/setup_netmamba_env.sh
```

核心依赖:

- PyTorch 2.1.1 + cu121
- NetMamba 官方 `mamba-1p1p1`
- `mamba_ssm`, `causal_conv1d`, `timm`
- `dpkt`, `scapy`, `transformers`

## 运行

后台运行完整 IDS2018 类增量流程:

```bash
bash scripts/run_experiment.sh --yes
```

交互运行会询问工作流:

```text
1) 数据集预处理
2) NetMambaPlus IDS2018 类增量完整实验
```

前台运行:

```bash
bash scripts/run_experiment.sh --foreground
```

仅做数据集预处理:

```bash
bash scripts/run_experiment.sh --workflow preprocess --rebuild-cache --yes
```

只检查环境、配置和最终命令:

```bash
bash scripts/run_experiment.sh --print-only --yes
```

重建多模态缓存后运行:

```bash
bash scripts/run_experiment.sh --rebuild-cache --yes
```

快速调试前 1 个阶段:

```bash
bash scripts/run_experiment.sh --task-limit 1 --epochs 5 --device cuda --yes
```

## 启动脚本

`scripts/run_experiment.sh` 固定使用 IDS2018 类增量配置，只保留两个工作流:

- `preprocess`: 构建/复用 IDS2018 多模态缓存
- `experiment`: NetMambaPlus 训练、测试和 v2.3 路由评估

脚本不再支持:

- `--config`
- `--config-preset`
- `--doh-*`
- `--route1`
- `--rap-burst-weighted`
- `--incremental`
- `--no-incremental`

保留的参数只用于运行控制和小规模调试:

- `--workflow preprocess|experiment`
- `--mode preprocess|experiment`，兼容旧用法
- `--task-limit`, `--task-id`
- `--epochs`, `--batch-size`, `--seq-len`
- `--train-limit`, `--test-limit`
- `--device`, `--python`
- `--rebuild-cache`
- `--foreground`, `--background`
- `--print-only`, `--yes`

## 配置

唯一主配置:

- `configs/medal_dns_netmamba_plus_mm_ids2018_class_incremental.json`

关键字段:

- `incremental_schedule`: IDS2018 类增量阶段定义
- `dataset_discovery`: 每次加载配置时扫描本地 IDS2018 PCAP/PCAPNG，并按阶段大小自动重组类别
- `dataset_root`: 数据集根目录
- `backbone_checkpoint`: NetMambaPlus checkpoint
- `data.*`: byte/header/payload、流重组与缓存参数
- `multimodal.*`: `fuse3_mamba`、序列长度、方向编码、burst、LoRA 与 dynamic gate
- `training.*`: 训练、验证、采样、早停和模型选择指标
- `incremental.*`: v2.3 路由、原型、阈值与正则配置
- `tasks`: 基础协议占位；运行时会由扫描结果动态生成实际增量阶段

## 指标

最终结论以类增量累计评估和 seen-task 路由矩阵为准:

- `Final_Avg_F1`
- `Final_Avg_Recall`
- `Final_Avg_Binary_F1`
- `Final_Avg_Binary_Accuracy`
- `Final_RouteAcc`
- `BWT`
- `Forgetting_MacroF1`

`Task_Mean_*` 仍会导出，但只表示各阶段当前任务结果均值，不作为最终持续学习结论。

## 输出

每次运行输出到:

- `results/ids2018_class_incremental_multimodal_netmambaplus/netmamba_plus_mm/<run_id>/summary.json`
- `results/ids2018_class_incremental_multimodal_netmambaplus/netmamba_plus_mm/<run_id>/summary.csv`
- `results/ids2018_class_incremental_multimodal_netmambaplus/netmamba_plus_mm/<run_id>/per_class_metrics.csv`
- `results/ids2018_class_incremental_multimodal_netmambaplus/netmamba_plus_mm/<run_id>/continual_matrix.csv`
- `results/ids2018_class_incremental_multimodal_netmambaplus/netmamba_plus_mm/<run_id>/incremental_stage_summary.csv`
- `results/ids2018_class_incremental_multimodal_netmambaplus/netmamba_plus_mm/<run_id>/model_metadata.json`
- `results/ids2018_class_incremental_multimodal_netmambaplus/netmamba_plus_mm/<run_id>/model_final.pt`
- `results/ids2018_class_incremental_multimodal_netmambaplus/netmamba_plus_mm/<run_id>/experiment.log`

同步日志:

- `results/logs/ids2018_preprocess_<run_id>.log`
- `results/logs/ids2018_class_incremental_<run_id>.log`

## 项目结构

- `src/evolving_net/config.py`: 配置加载与校验
- `src/evolving_net/data/pcap_payloads.py`: PCAP 解析与流构建
- `src/evolving_net/data/task_stream_multimodal.py`: 多模态样本构建、缓存与验证划分
- `src/evolving_net/models/netmamba_plus.py`: NetMambaPlus 骨干封装
- `src/evolving_net/models/netmamba_plus_multimodal.py`: 多模态分类器、LoRA 与 dynamic gate
- `src/evolving_net/models/modular_cil_v23.py`: v2.3 原型路由
- `scripts/main_experiment_multimodal.py`: 训练、评估、增量矩阵与导出
- `scripts/run_experiment.sh`: IDS2018 类增量启动脚本
- `docs/project_full_design.md`: 当前完整设计说明

## 迁移说明

本仓库的启动入口不再维护单模态基线、MEDAL mode3、独立任务协议或 DoH/route1 preset 菜单。新的实验结论应以 IDS2018 类增量配置、严格验证划分和 seen-task 增量矩阵为准。