README.md

---
license: other
license_name: brsx-open-license
license_link: https://brsxlabs.gt.tc/brsxlicense.html
tags:
- cyber
- hybrid
---

# ShadowCore-v2

![ShadowCore-v2](shadowcore_v2_banner.png)

Symbolic Network Risk Intelligence

## Overview

ShadowCore-v2 is an 83.92M parameter hybrid neural architecture designed for symbolic network risk classification.

The model analyzes fixed-length sequences of network events and predicts a risk score between 0 and 9, representing increasing levels of network instability, degradation, and failure severity.

ShadowCore-v2 is the successor to ShadowCore-v1 and introduces a significantly expanded token vocabulary, a larger output space, and richer representation of network behavior while maintaining greater than 90% training accuracy.

Developed by BRSX-Labs.

---

# Highlights

* 83.92M Parameters
* CNN + GRU + Transformer + Mamba-like Hybrid Architecture
* 11 Symbolic Network Event Tokens
* 10 Risk Classes (0-9)
* Context Length: 64 Tokens
* Global Sequence-Level Classification
* > 90% Training Accuracy
* Supports Recovery-Aware Risk Estimation

---

# What's New in ShadowCore-v2

## Expanded Vocabulary

ShadowCore-v1 used only four symbolic events:

```text
U
D
+
-
```

ShadowCore-v2 expands the vocabulary to eleven network events:

```text
U
D
+
-
J
R
L
T
C
H
F
```

This allows the model to represent more realistic network conditions and failure scenarios.

---

## Expanded Output Space

ShadowCore-v1:

```text
3 Risk Classes
```

ShadowCore-v2:

```text
10 Risk Classes
(0-9)
```

This enables finer anomaly severity estimation and more granular decision making.

---

## Improved Network Awareness

ShadowCore-v2 introduces explicit representation of:

* Packet Loss
* Retransmissions
* Jitter
* Connection Resets
* Timeouts
* Recovery Events
* Traffic Bursts

which were not available in ShadowCore-v1.

---

# Token Definitions

```text
U = Upload Increase
D = Download Increase

+ = Latency Increase
- = Latency Decrease

J = Jitter
R = Retransmission
L = Packet Loss

T = Timeout
C = Connection Reset

H = Recovery
F = Flow Burst
```

---

# Token Interpretation

```text
Low Risk

H = Recovery
U = Upload Increase
D = Download Increase
- = Latency Decrease

Moderate Risk

+ = Latency Increase
F = Flow Burst

High Risk

J = Jitter
R = Retransmission

Critical Risk

L = Packet Loss
T = Timeout
C = Connection Reset
```

Actual predictions depend on the entire sequence and not on individual token presence.

---

# Risk Scale

```text
0 = Healthy

1 = Normal Operation

2 = Minor Variation

3 = Low Risk Anomaly

4 = Moderate Risk

5 = Elevated Risk

6 = Significant Risk

7 = Severe Risk

8 = Critical Risk

9 = Extreme Risk / Failure State
```

---

# Architecture

ShadowCore-v2 uses four specialized experts operating in parallel.

```text
Input
  ↓
Embedding
  ↓
 ┌───────────────┐
 │ CNN Expert    │
 ├───────────────┤
 │ GRU Expert    │
 ├───────────────┤
 │ Transformer   │
 ├───────────────┤
 │ Mamba Expert  │
 └───────────────┘
         ↓
      Fusion
         ↓
 Global Pooling
         ↓
   Classifier
         ↓
     Risk Score
```

---

# Embedding Layer

```text
Vocabulary Size : 11
Dimension       : 512
```

All symbolic tokens are projected into a shared embedding space before expert processing.

---

# CNN Expert

Purpose:

* Local pattern extraction
* Burst detection
* Short-term event relationships

Configuration:

```text
Blocks   : 7
Channels : 960
Kernel   : 3
```

---

# GRU Expert

Purpose:

* Sequential modeling
* Temporal event tracking

Configuration:

```text
Hidden Size : 960
Layers      : 4
```

---

# Transformer Expert

Purpose:

* Long-range dependencies
* Global context understanding

Configuration:

```text
Layers          : 6
Heads           : 8
Feedforward     : 2048
Dropout         : 0.1
```

---

# Mamba-like Expert

Purpose:

* Efficient state-space sequence modeling
* Long-context compression

Configuration:

```text
Layers      : 10
State Dim   : 1408
```

---

# Fusion Layer

Outputs from all experts are concatenated and fused.

```text
CNN
+
GRU
+
Transformer
+
Mamba
↓
Linear Fusion
↓
LayerNorm
↓
GELU
```

---

# Classification Head

```text
Global Mean Pooling
↓
Linear(512)
↓
GELU
↓
Linear(10)
```

Final output:

```text
Risk Score
0-9
```

---

# Model Size

```text
Total Parameters

83.92 Million
```

---

# Training Configuration

```text
Optimizer       : AdamW
Learning Rate   : 1e-4

Batch Size      : 64

Epochs          : 4

Gradient Clip   : 1.0

Checkpoint
Every 1000 Steps
```

---

# Sequence Format

Input length must be exactly 64 tokens.

Example:

```text
UUUDDUUUDDUUUUDDHHHHUUUDD++JJRRLLTTUUUDDUUUDDUUUUDDHHHHUUUDD
```

---

# Benchmark Summary

ShadowCore-v2 maintains greater than 90% training accuracy despite:

```text
Vocabulary Expansion

4 Tokens
   ↓
11 Tokens

Output Expansion

3 Classes
   ↓
10 Classes
```

Observed training results:

```text
Epoch 1 ≈ 90%

Epoch 2 ≈ 92%

Epoch 3 ≈ 92%

Epoch 4 ≈ 92-93%
```

This indicates that the architecture successfully scales to a larger symbolic event space without major degradation in training performance.

---

# Behavioral Evaluation

Observed behavior during manual testing suggests that the model:

* Differentiates Timeout and Connection Reset events.
* Detects increasing failure density.
* Uses intermediate risk levels instead of binary decisions.
* Recognizes Recovery patterns.
* Reacts to escalating anomaly accumulation.
* Produces stable risk estimates for normal traffic sequences.

Example observations:

```text
Healthy Traffic
→ Low Risk

Timeout + Recovery
→ Reduced Risk

Connection Reset Dominated
→ Critical Risk

Mixed Jitter / Loss / Retransmission
→ Medium-High Risk
```

---

# Intended Use

ShadowCore-v2 is intended for:

* Network anomaly research
* Symbolic traffic classification
* Risk scoring experiments
* Cybersecurity research
* Educational projects
* Sequence classification studies

---

# Limitations

* Fixed context length of 64 tokens.
* Requires symbolic event encoding.
* Not intended as a production IDS/IPS replacement.
* Training accuracy is not equivalent to real-world deployment performance.
* Requires domain-specific token generation pipelines.

---

# Citation

```text
ShadowCore-v2

83.92M Parameter Hybrid CNN-GRU-Transformer-Mamba
Architecture for Symbolic Network Risk Classification

Developed by BRSX-Labs
2026
```