update README to reflect worksaround for
@@ -5,7 +5,6 @@ original machine learning model used by Poseidon to identify device types (e.g.,
"developer workstation," "SSH server," etc.). For more information on this model,
see our blog post [Using machine learning to classify devices on your network](https://blog.cyberreboot.org/using-machine-learning-to-classify-devices-on-your-network-e9bb98cbfdb6)
-
## Using Docker to evaluate, train, and test
_**Note:** we are aware of issues that currently render the RandomForest model
@@ -33,7 +32,11 @@ By default, `make run` uses the eval_onelayer script.
To use `eval`, you will supply a single PCAP from your local filesystem that can
be mapped into the Docker container at runtime. The `train` and `test` functions
require a directory of PCAP files along with a `label_assignments.json` for
-those PCAPs. Models will be mapped to `/tmp/models`.
+ those PCAPs. If the label_assignments don't line up with the ones in `config.json`
+ under the `opts` directory, be sure to add them there as well. Currently the
+ models require that the number of labels in `config.json` be exactly 21, don't
+ worry if you don't have data to train all of the labels, but note that you need
+ to keep 21 there, even if you don't use them all. Models will be mapped to `/tmp/models`.
Here's an example of implicitly calling `eval_onelayer`:
```
@@ -52,4 +55,4 @@ Use `make help` to see the possible options.
Output is currently JSON to STDOUT.
For more information on how to run the models as part of Poseidon, please refer
-to the documentation for [Poseidon](https://github.com/CyberReboot/poseidon)
+ to the documentation for [Poseidon](https://github.com/CyberReboot/poseidon).
