Contextual machine learning

Every request goes through three phases. Indicators are features. Only phase 3 produces a verdict.

Fusion

score = (0.72·supervised + 0.14·unsupervised + 0.08·(1-reputation) + 0.06·indicator)
        × false_detection × crowd
if indicator ≥ 0.93: score = max(score, 0.93)
if supervised ≥ 0.90: score = max(score, 0.78)

Critical families such as decoded JNDI cannot be talked down to allow by a young (Kindergarten) model. Unsupervised scoring mixes a per-URL baseline with an Isolation Forest on the same 32 features. Phase 2 also runs a NORM+SIG trigram pass on every decoded field, including headers.

Supervised artifact

The public basic model ships with the engine as a 32-weight logistic vector (xorappsec-supervised-v1). Production can load a replacement file without rebuilding:

xorappsec all --supervised-model /etc/xorappsec/supervised.json

Training and labeled corpora are not part of the engine. Feature names and order are a frozen contract; a file that disagrees is rejected at startup.

Learning levels

Trusted sources are not an allow-list. They accelerate the benign baseline only after minNumOfSources distinct identities agree.