ShadowCore-v2

Symbolic Network Risk Intelligence

Overview

ShadowCore-v2 is an 83.92M parameter hybrid neural architecture designed for symbolic network risk classification.

The model analyzes fixed-length sequences of network events and predicts a risk score between 0 and 9, representing increasing levels of network instability, degradation, and failure severity.

ShadowCore-v2 is the successor to ShadowCore-v1 and introduces a significantly expanded token vocabulary, a larger output space, and richer representation of network behavior while maintaining greater than 90% training accuracy.

Developed by BRSX-Labs.

---

Highlights

• 83.92M Parameters
• CNN + GRU + Transformer + Mamba-like Hybrid Architecture
• 11 Symbolic Network Event Tokens
• 10 Risk Classes (0-9)
• Context Length: 64 Tokens
• Global Sequence-Level Classification

• 90% Training Accuracy

• Supports Recovery-Aware Risk Estimation

---

What's New in ShadowCore-v2

Expanded Vocabulary

ShadowCore-v1 used only four symbolic events:

U
D
+
-

ShadowCore-v2 expands the vocabulary to eleven network events:

U
D
+
-
J
R
L
T
C
H
F

This allows the model to represent more realistic network conditions and failure scenarios.

---

Expanded Output Space

ShadowCore-v1:

3 Risk Classes

ShadowCore-v2:

10 Risk Classes
(0-9)

This enables finer anomaly severity estimation and more granular decision making.

---

Improved Network Awareness

ShadowCore-v2 introduces explicit representation of:

• Packet Loss
• Retransmissions
• Jitter
• Connection Resets
• Timeouts
• Recovery Events
• Traffic Bursts

which were not available in ShadowCore-v1.

---

Token Definitions

U = Upload Increase
D = Download Increase

+ = Latency Increase
- = Latency Decrease

J = Jitter
R = Retransmission
L = Packet Loss

T = Timeout
C = Connection Reset

H = Recovery
F = Flow Burst

---

Token Interpretation

Low Risk

H = Recovery
U = Upload Increase
D = Download Increase
- = Latency Decrease

Moderate Risk

+ = Latency Increase
F = Flow Burst

High Risk

J = Jitter
R = Retransmission

Critical Risk

L = Packet Loss
T = Timeout
C = Connection Reset

Actual predictions depend on the entire sequence and not on individual token presence.

---

Risk Scale

0 = Healthy

1 = Normal Operation

2 = Minor Variation

3 = Low Risk Anomaly

4 = Moderate Risk

5 = Elevated Risk

6 = Significant Risk

7 = Severe Risk

8 = Critical Risk

9 = Extreme Risk / Failure State

---

Architecture

ShadowCore-v2 uses four specialized experts operating in parallel.

Input
  ↓
Embedding
  ↓
 ┌───────────────┐
 │ CNN Expert    │
 ├───────────────┤
 │ GRU Expert    │
 ├───────────────┤
 │ Transformer   │
 ├───────────────┤
 │ Mamba Expert  │
 └───────────────┘
         ↓
      Fusion
         ↓
 Global Pooling
         ↓
   Classifier
         ↓
     Risk Score

---

Embedding Layer

Vocabulary Size : 11
Dimension       : 512

All symbolic tokens are projected into a shared embedding space before expert processing.

---

CNN Expert

Purpose:

• Local pattern extraction
• Burst detection
• Short-term event relationships

Configuration:

Blocks   : 7
Channels : 960
Kernel   : 3

---

GRU Expert

Purpose:

• Sequential modeling
• Temporal event tracking

Configuration:

Hidden Size : 960
Layers      : 4

---

Transformer Expert

Purpose:

• Long-range dependencies
• Global context understanding

Configuration:

Layers          : 6
Heads           : 8
Feedforward     : 2048
Dropout         : 0.1

---

Mamba-like Expert

Purpose:

• Efficient state-space sequence modeling
• Long-context compression

Configuration:

Layers      : 10
State Dim   : 1408

---

Fusion Layer

Outputs from all experts are concatenated and fused.

CNN
+
GRU
+
Transformer
+
Mamba
↓
Linear Fusion
↓
LayerNorm
↓
GELU

---

Classification Head

Global Mean Pooling
↓
Linear(512)
↓
GELU
↓
Linear(10)

Final output:

Risk Score
0-9

---

Model Size

Total Parameters

83.92 Million

---

Training Configuration

Optimizer       : AdamW
Learning Rate   : 1e-4

Batch Size      : 64

Epochs          : 4

Gradient Clip   : 1.0

Checkpoint
Every 1000 Steps

---

Sequence Format

Input length must be exactly 64 tokens.

Example:

UUUDDUUUDDUUUUDDHHHHUUUDD++JJRRLLTTUUUDDUUUDDUUUUDDHHHHUUUDD

---

Benchmark Summary

ShadowCore-v2 maintains greater than 90% training accuracy despite:

Vocabulary Expansion

4 Tokens
   ↓
11 Tokens

Output Expansion

3 Classes
   ↓
10 Classes

Observed training results:

Epoch 1 ≈ 90%

Epoch 2 ≈ 92%

Epoch 3 ≈ 92%

Epoch 4 ≈ 92-93%

This indicates that the architecture successfully scales to a larger symbolic event space without major degradation in training performance.

---

Behavioral Evaluation

Observed behavior during manual testing suggests that the model:

• Differentiates Timeout and Connection Reset events.
• Detects increasing failure density.
• Uses intermediate risk levels instead of binary decisions.
• Recognizes Recovery patterns.
• Reacts to escalating anomaly accumulation.
• Produces stable risk estimates for normal traffic sequences.

Example observations:

Healthy Traffic
→ Low Risk

Timeout + Recovery
→ Reduced Risk

Connection Reset Dominated
→ Critical Risk

Mixed Jitter / Loss / Retransmission
→ Medium-High Risk

---

Intended Use

ShadowCore-v2 is intended for:

• Network anomaly research
• Symbolic traffic classification
• Risk scoring experiments
• Cybersecurity research
• Educational projects
• Sequence classification studies

---

Limitations

• Fixed context length of 64 tokens.
• Requires symbolic event encoding.
• Not intended as a production IDS/IPS replacement.
• Training accuracy is not equivalent to real-world deployment performance.
• Requires domain-specific token generation pipelines.

---

Citation

ShadowCore-v2

83.92M Parameter Hybrid CNN-GRU-Transformer-Mamba
Architecture for Symbolic Network Risk Classification

Developed by BRSX-Labs
2026