Roadmap: making dit the best form-detection and classification tool

Aperta
  • Qualcosa non va?
#79 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
8/100
Tipo di issue
Funzionalità
Chiarezza
Da chiarire
Stato di attività
Attiva
Stack tecnologico
go
Ambito
cli, machine-learning, security

Direzione di ricerca

This is a multi-phase roadmap, not a single task, so do not start here. Read the Phases checklist and the linked child issues (#3, #4, #5 for CLI work; #10, #11, #13 for detections), then pick one concrete child issue. Relevant code lives in crf/, classifier/ and captcha/. Done means that child issue's acceptance criteria are met, not this roadmap's checkboxes.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Where we are

dît is a Go library + CLI that classifies page types (login, error, landing, ...), form types (login, registration, search, password recovery, contact, order, ...) and individual field types (username, password, email, ...) with an in-repo CRF implementation (crf/: forward-backward, Viterbi, trainer) and linear classifiers (classifier/), with zero external ML dependencies. It ships train/evaluate/cross-validation tooling, a dit-collect data collector, a pretrained model auto-downloaded from Hugging Face (~93 MB), and an early captcha/ package. Honest caveats: the model is large for a CLI tool, there's no published accuracy comparison against prior art, CLI ergonomics are still minimal (no stdin, no batch, single output format), and three open PRs (#75, #76, #77) literally titled "PR title" need triage.

Landscape

Project Strengths Link
Formasaurus The direct prior art: Python form/field classifier (LogReg form types + CRF field types), trained on 1000+ annotated forms — but Python-only, heavy sklearn/sklearn-crfsuite deps, and effectively dormant https://github.com/scrapinghub/Formasaurus
urlscan.io Renders pages in a real browser, records DOM/network/screenshot, community verdicts — but SaaS, no structural form/field classification, rate-limited API https://urlscan.io
PhishTank Crowd-sourced phishing URL feed — reactive blocklist, zero structural analysis of unseen pages https://phishtank.org
Playwright/headless scrapers Can find forms on JS-rendered pages, but classify nothing; users hand-roll selectors https://playwright.dev

Formasaurus proved the approach (docs, PyPI) and then stalled. Nobody offers a single-binary, dependency-free form/field/page classifier usable in security pipelines — that is exactly dît's lane.

What "best" means

  1. Beat the prior art, provably: publish cross-validated accuracy vs Formasaurus on a shared/annotated corpus (target: ≥ its reported form-type accuracy, with per-class F1 in the README).
  2. Pipeline-native: cat page.html | dit run - and dit run -l urls.txt --json work, so dît composes with httpx/katana/nuclei-style toolchains (#3, #4, #5).
  3. Fast and self-contained: classify a page in <100 ms on commodity hardware after one-time model download, with no Python, no network.
  4. Detections nobody else does structurally: honeypot fields (#10), CAPTCHA presence/type (#11), and phishing-form signals (#13) as first-class outputs, benchmarked against labeled sets rather than blocklists.
  5. Model you can retrain in an afternoon: documented dit train path with custom labels (#9) and a model ≤ 25 MB (quantized/pruned) as the default download.

Phases

Phase 1 — CLI & pipeline ergonomics
  • Read HTML from stdin (#3)
  • Batch mode for multiple URLs (#4)
  • Multiple output formats: table, csv, json (#5)
  • pre-commit config (#26) and triage/rename placeholder PRs #75, #76, #77
Phase 2 — Security detections (the differentiator)
  • Honeypot field detection (#10)
  • CAPTCHA detection (#11) — build on the existing captcha/ package
  • Phishing form detection (#13)
  • Form change monitoring (#12) — turns dît from a classifier into a monitoring primitive
Phase 3 — Reach & model quality
  • Server mode with HTTP API (#6)
  • JavaScript rendering for SPA forms (#7)
  • Multi-language form support (#8) — Formasaurus is English-biased; this is an open gap
  • Custom label support for training (#9)
  • Published benchmark vs Formasaurus + model-size reduction (claims 1 and 5)

Open questions

  • Can the 93 MB model.json be quantized/pruned (or split per-task: page/form/field) without losing accuracy, so go install users aren't surprised by the download?
  • What is the licensing/provenance story for the Hugging Face training data — can we accept community-contributed annotations?
  • Should JS rendering (#7) live in core (chromedp dependency) or as a separate dit-render companion to keep the zero-dep promise?

🤖 Filed by Claude Code

Generated by Claude Code

Lingua principale
Go
Stelle
19
Fork
4
Merge medio
15m
PR unite (30g)
2

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di HappyHackingSpace/dit

Tutte le issue di HappyHackingSpace/dit

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.