File size: 1,924 Bytes
b5528bb | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 | {
"schema": "secebl_rev20_l2_public_summary_v1",
"l1_release": "SecEBL-Rev20 public L1 release",
"l2_release": "SecEBL-Rev20 public L2 artifact",
"model_type": "logistic_regression_session_scorer",
"scoring_scope": "experimental fitted L2 session scorer over cached L1 semantic features",
"runtime_feature_exclusions": [
"raw_command_text",
"user_name",
"host_name",
"session_id"
],
"training_mixture": {
"sessions": 5747,
"positive_sessions": 426,
"negative_sessions": 5321,
"synthetic_pressure_positive_sessions": 60,
"reviewed_real_pressure_positive_sessions": 1,
"random_real_pressure_background_negative_sessions": 5000,
"reviewed_hard_negative_pressure_sessions": 23
},
"validation_oof": {
"folds": 5,
"accuracy": 0.9939098660170523,
"attack_precision": 0.9643705463182898,
"attack_recall": 0.9530516431924883,
"normal_recall": 0.9971809810186055,
"tp": 406,
"fn": 20,
"fp": 15,
"tn": 5306
},
"withheld_session_benchmark_fit_check": {
"sessions": 663,
"rows_seen": 12594,
"attack_sessions": 365,
"normal_sessions": 298,
"accuracy": 1.0,
"attack_precision": 1.0,
"attack_recall": 1.0,
"normal_recall": 1.0,
"tp": 365,
"fn": 0,
"fp": 0,
"tn": 298
},
"pressure_stream_fit_check": {
"rows_seen": 6286568,
"sessions": 102117,
"alert_sessions": 61,
"reviewed_real_alert_sessions": 1,
"synthetic_alert_sessions": 60,
"raw_rows_redistributed": false,
"real_session_identifiers_redistributed": false
},
"thresholds": {
"score_threshold": 0.5,
"model_probability_threshold": 0.9,
"score_transform": "threshold_margin",
"score_transform_scale": 2.0
},
"caveat": "This is an experimental fitted L2 artifact for reproducible SecEBL-Rev20 session experiments, not an independent claim of general production IDS accuracy."
}
|