avernaut/cyber-action-risk-classifier

Cyber Action Risk Classifier

A small baseline classifier from Avernaut for estimating the risk category of proposed autonomous cyber-defense actions.

Model

TF-IDF + multinomial logistic regression trained on the synthetic avernaut/cyber-defense-actions dataset.

Labels

• low
• medium
• high

Evaluation

Synthetic test split:

• Accuracy: 0.767
• Macro F1: 0.733
• Test records: 60

These metrics measure consistency with the synthetic labeling heuristic, not real-world security performance.

Intended use

Research, demonstrations, and baseline experiments for risk-aware autonomous cyber defense.

Not intended for

Direct production enforcement, safety-critical decisions, or autonomous blocking without independent policy checks and human-defined controls.

Usage

from inference import predict_risk

result = predict_risk(
    environment="edge",
    threat="credential_brute_force",
    proposed_action="block_subnet",
    asset_criticality="high",
    scope_level=4,
    reversible=False,
    policy_match=True,
    human_approval_required=True,
    blast_radius_level=5,
)
print(result)

Related projects

• AegisAI: https://github.com/avernaut/aegis-ai
• INVERIQ: https://github.com/avernaut/inveriq