Retrain module crash

[beh0ld]

Describe the bug
When running Slips in train mode with live Zeek traffic, the Flow ML Detection module repeatedly crashes during automatic retraining.

The first error happens in process_features() because the pandas DataFrame does not contain a pkts column:

AttributeError: 'DataFrame' object has no attribute 'pkts'

After that, train() fails because self.flows ends up being None and the code tries to access self.flows.label:

AttributeError: 'NoneType' object has no attribute 'label'

These two errors repeat every time the module prints:

[Flow ML Detection] Training the model with the last group of flows and labels. Total flows: 141201.0.

and the model is never successfully trained.

Used Slips command

/opt/slips/venv/bin/python /opt/slips/slips.py
-c /opt/slips/config/slips.yaml
-i ens192
-o /var/log/slips

(run as a systemd service via ExecStart)

To Reproduce

Steps to reproduce the behavior:

Go to branch master at commit 97c32c2.

Start Slips with the command above, with Flow ML Detection enabled in train mode in the config.

Let it process live Zeek traffic on interface ens192 until Flow ML Detection prints:
Training the model with the last group of flows and labels. Total flows: ...

Check the logs and see the repeated errors from process_features() and train().

errors.log

2025/12/08 09:02:10.441053 [Flow ML Detection] Training the model with the last group of flows and labels. Total flows: 141201.0.

2025/12/08 09:02:10.518894 [Flow ML Detection] Traceback (most recent call last):
File "/opt/slips/modules/flowmldetection/flowmldetection.py", line 193, in process_features
dataset.pkts,
^^^^^^^^^^^^
File "/opt/slips/venv/lib/python3.11/site-packages/pandas/core/generic.py", line 6321, in getattr
return object.getattribute(self, name)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'DataFrame' object has no attribute 'pkts'

2025/12/08 09:02:10.519232 [Flow ML Detection] Error in train()
2025/12/08 09:02:10.519667 [Flow ML Detection] Traceback (most recent call last):
File "/opt/slips/modules/flowmldetection/flowmldetection.py", line 77, in train
self.flows.label = self.flows.label.str.replace(
^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'label'

2025/12/08 09:02:44.664686 [Flow ML Detection] Traceback (most recent call last):
File "/opt/slips/modules/flowmldetection/flowmldetection.py", line 193, in process_features
dataset.pkts,
^^^^^^^^^^^^
File "/opt/slips/venv/lib/python3.11/site-packages/pandas/core/generic.py", line 6321, in getattr
return object.getattribute(self, name)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'DataFrame' object has no attribute 'pkts'

2025/12/08 09:02:44.665191 [Flow ML Detection] Error in train()
2025/12/08 09:02:44.665701 [Flow ML Detection] Traceback (most recent call last):
File "/opt/slips/modules/flowmldetection/flowmldetection.py", line 77, in train
self.flows.label = self.flows.label.str.replace(
^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'label'

2025/12/08 09:02:56.677413 [Flow ML Detection] Traceback (most recent call last):
File "/opt/slips/modules/flowmldetection/flowmldetection.py", line 193, in process_features
dataset.pkts,
^^^^^^^^^^^^
File "/opt/slips/venv/lib/python3.11/site-packages/pandas/core/generic.py", line 6321, in getattr
return object.getattribute(self, name)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'DataFrame' object has no attribute 'pkts'

2025/12/08 09:02:56.678184 [Flow ML Detection] Error in train()
2025/12/08 09:02:56.678827 [Flow ML Detection] Traceback (most recent call last):
File "/opt/slips/modules/flowmldetection/flowmldetection.py", line 77, in train
self.flows.label = self.flows.label.str.replace(
^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'label'

... (the same pair of errors continues to repeat)

Expected behavior
Flow ML Detection should not crash when the pkts column is missing in the DataFrame. It should either:

compute pkts from existing fields like spkts + dpkts, or

create the column with a default value, or

skip the problematic flows gracefully,

and in all cases train() should not end up with self.flows being None.

Before accessing self.flows.label, train() should check that self.flows is a valid DataFrame and that it actually contains a label column.

Screenshots
N/A (log-only issue).

Branch
master @ 97c32c2

Environment (please complete the following information):

OS: Debian GNU/Linux (kernel 6.1.0-41-amd64)

Version: 6.1.158-1 (2025-11-09) (from uname -a)

Python version: 3.11

SLIPS: 1.16

Are you running slips in docker or locally?: locally (no Docker)

Docker version (if running slips in docker): N/A

Commit hash: 97c32c2 (short: 97c32c2)