DibaGuard open release
Copyright 2026 Dibachain (DibaAi)

Code (everything except models/): Apache License 2.0 -- see LICENSE.
Model files (models/): CC BY-SA 4.0 -- see LICENSE-WEIGHTS.

This release contains no HTTP request model. The HTTP model of the private build is trained on data that is not
cleared for redistribution and was left out; the HTTP edge of this release runs on signatures, SQL-context analysis,
DbNet and the behavioural session tier, none of which uses third-party training data.

Training data of the network models (models/seq_v1/*, models/entity_v1/*), as the model metadata records it:

  * RoEduNet-SIMARGL2021 -- CC BY 4.0. Mihailescu et al., "The Proposition and Evaluation of the RoEduNet-SIMARGL2021
    Network Intrusion Detection Dataset", Sensors 21(13):4319, 2021.
    Source: https://www.kaggle.com/datasets/h2020simargl/simargl2021-network-intrusion-detection-dataset
  * SIMARGL2022 -- CC BY 4.0. H2020 SIMARGL, SIMARGL2022 network traffic dataset.
    Source: https://www.kaggle.com/datasets/h2020simargl/simargl2022
  * APPRAISE H2020 real labelled NetFlow dataset -- CC BY 4.0. ITTI Sp. z o.o.
    Source: https://www.kaggle.com/datasets/ittibydgoszcz/appraise-h2020-real-labelled-netflow-dataset
  * ACI-IoT-2023 -- CC BY 4.0. Nack et al., "ACI IoT Network Traffic Dataset 2023", MILCOM 2024;
    IEEE DataPort doi:10.21227/qacj-3x32. Source (the author's release):
    https://www.kaggle.com/datasets/emilynack/aci-iot-network-traffic-dataset-2023
  * CSE-CIC-IDS2018 (Tuesday 20-02-2018, from the publisher's AWS open-data bucket) -- Canadian Institute for
    Cybersecurity grant ("you may redistribute, republish, and mirror ... in any form", citation required).
    Sharafaldin, Habibi Lashkari, Ghorbani, "Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic
    Characterization", ICISSP 2018. https://registry.opendata.aws/cse-cic-ids2018 and https://www.unb.ca/cic/datasets/ids-2018.html
  * LUFlow 2020 and 2021 -- CC BY-SA 4.0. Mills, Marnerides, Broadbent, Race, "Practical Intrusion Detection of
    Emerging Threats", IEEE Transactions on Network and Service Management, 2021, doi:10.1109/TNSM.2021.3091517.
    Source (the author's release): https://www.kaggle.com/datasets/mryanm/luflow-network-intrusion-detection-data-set

Which model saw which source:
  * seq_v1/nf_entity_mono.npz (monotone tree prior) and seq_v1/seqnet.npz (GRU SeqNet): all seven testbeds above.
  * entity_v1/nf_entity_detector.npz: SIMARGL2021, SIMARGL2022, APPRAISE, ACI-IoT-2023, CSE-CIC-IDS2018 (AWS).
  * entity_v1/lu_entity_detector.npz: LUFlow 2020 and 2021 only.
  * dbnet.npz (DbNet, database query network): a grammar-generated SQL / NoSQL corpus written for DibaGuard
    (scripts/db_corpus.py of the main repository); no third-party data.

The same attribution block is stored in each network model's own metadata (`info` -> `meta.notice` / `notice`).

Evaluation-only material (never trained on, nothing bundled): OWASP Core Rule Set regression tests (Apache-2.0,
https://github.com/coreruleset/coreruleset), SR-BH 2020 (CC0, doi:10.7910/DVN/OGOIXX), the thirty-day ModSecurity
blocked-request archive (CC BY 4.0, Lucz 2025, doi:10.5281/zenodo.17178461), libinjection (BSD-3-Clause) as the
comparison engine. The request signatures in dibaguard/shield/playbook.py were written for DibaGuard in the spirit
of the OWASP Core Rule Set; no CRS rule text is bundled.

The full licence audit of every dataset the project ever touched is docs/DATA_LICENSES.md; how the clean models
were built and how they compare with the private ones is docs/CLEAN_MODELS.md.