| --- |
| license: other |
| license_name: brsx-open-license |
| license_link: https://brsxlabs.gt.tc/brsxlicense.html |
| tags: |
| - cyber |
| - hybrid |
| --- |
| |
| # ShadowCore-v2 |
|
|
|  |
|
|
| Symbolic Network Risk Intelligence |
|
|
| ## Overview |
|
|
| ShadowCore-v2 is an 83.92M parameter hybrid neural architecture designed for symbolic network risk classification. |
|
|
| The model analyzes fixed-length sequences of network events and predicts a risk score between 0 and 9, representing increasing levels of network instability, degradation, and failure severity. |
|
|
| ShadowCore-v2 is the successor to ShadowCore-v1 and introduces a significantly expanded token vocabulary, a larger output space, and richer representation of network behavior while maintaining greater than 90% training accuracy. |
|
|
| Developed by BRSX-Labs. |
|
|
| --- |
|
|
| # Highlights |
|
|
| * 83.92M Parameters |
| * CNN + GRU + Transformer + Mamba-like Hybrid Architecture |
| * 11 Symbolic Network Event Tokens |
| * 10 Risk Classes (0-9) |
| * Context Length: 64 Tokens |
| * Global Sequence-Level Classification |
| * > 90% Training Accuracy |
| * Supports Recovery-Aware Risk Estimation |
|
|
| --- |
|
|
| # What's New in ShadowCore-v2 |
|
|
| ## Expanded Vocabulary |
|
|
| ShadowCore-v1 used only four symbolic events: |
|
|
| ```text |
| U |
| D |
| + |
| - |
| ``` |
|
|
| ShadowCore-v2 expands the vocabulary to eleven network events: |
|
|
| ```text |
| U |
| D |
| + |
| - |
| J |
| R |
| L |
| T |
| C |
| H |
| F |
| ``` |
|
|
| This allows the model to represent more realistic network conditions and failure scenarios. |
|
|
| --- |
|
|
| ## Expanded Output Space |
|
|
| ShadowCore-v1: |
|
|
| ```text |
| 3 Risk Classes |
| ``` |
|
|
| ShadowCore-v2: |
|
|
| ```text |
| 10 Risk Classes |
| (0-9) |
| ``` |
|
|
| This enables finer anomaly severity estimation and more granular decision making. |
|
|
| --- |
|
|
| ## Improved Network Awareness |
|
|
| ShadowCore-v2 introduces explicit representation of: |
|
|
| * Packet Loss |
| * Retransmissions |
| * Jitter |
| * Connection Resets |
| * Timeouts |
| * Recovery Events |
| * Traffic Bursts |
|
|
| which were not available in ShadowCore-v1. |
|
|
| --- |
|
|
| # Token Definitions |
|
|
| ```text |
| U = Upload Increase |
| D = Download Increase |
| |
| + = Latency Increase |
| - = Latency Decrease |
| |
| J = Jitter |
| R = Retransmission |
| L = Packet Loss |
| |
| T = Timeout |
| C = Connection Reset |
| |
| H = Recovery |
| F = Flow Burst |
| ``` |
|
|
| --- |
|
|
| # Token Interpretation |
|
|
| ```text |
| Low Risk |
| |
| H = Recovery |
| U = Upload Increase |
| D = Download Increase |
| - = Latency Decrease |
| |
| Moderate Risk |
| |
| + = Latency Increase |
| F = Flow Burst |
| |
| High Risk |
| |
| J = Jitter |
| R = Retransmission |
| |
| Critical Risk |
| |
| L = Packet Loss |
| T = Timeout |
| C = Connection Reset |
| ``` |
|
|
| Actual predictions depend on the entire sequence and not on individual token presence. |
|
|
| --- |
|
|
| # Risk Scale |
|
|
| ```text |
| 0 = Healthy |
| |
| 1 = Normal Operation |
| |
| 2 = Minor Variation |
| |
| 3 = Low Risk Anomaly |
| |
| 4 = Moderate Risk |
| |
| 5 = Elevated Risk |
| |
| 6 = Significant Risk |
| |
| 7 = Severe Risk |
| |
| 8 = Critical Risk |
| |
| 9 = Extreme Risk / Failure State |
| ``` |
|
|
| --- |
|
|
| # Architecture |
|
|
| ShadowCore-v2 uses four specialized experts operating in parallel. |
|
|
| ```text |
| Input |
| ↓ |
| Embedding |
| ↓ |
| ┌───────────────┐ |
| │ CNN Expert │ |
| ├───────────────┤ |
| │ GRU Expert │ |
| ├───────────────┤ |
| │ Transformer │ |
| ├───────────────┤ |
| │ Mamba Expert │ |
| └───────────────┘ |
| ↓ |
| Fusion |
| ↓ |
| Global Pooling |
| ↓ |
| Classifier |
| ↓ |
| Risk Score |
| ``` |
|
|
| --- |
|
|
| # Embedding Layer |
|
|
| ```text |
| Vocabulary Size : 11 |
| Dimension : 512 |
| ``` |
|
|
| All symbolic tokens are projected into a shared embedding space before expert processing. |
|
|
| --- |
|
|
| # CNN Expert |
|
|
| Purpose: |
|
|
| * Local pattern extraction |
| * Burst detection |
| * Short-term event relationships |
|
|
| Configuration: |
|
|
| ```text |
| Blocks : 7 |
| Channels : 960 |
| Kernel : 3 |
| ``` |
|
|
| --- |
|
|
| # GRU Expert |
|
|
| Purpose: |
|
|
| * Sequential modeling |
| * Temporal event tracking |
|
|
| Configuration: |
|
|
| ```text |
| Hidden Size : 960 |
| Layers : 4 |
| ``` |
|
|
| --- |
|
|
| # Transformer Expert |
|
|
| Purpose: |
|
|
| * Long-range dependencies |
| * Global context understanding |
|
|
| Configuration: |
|
|
| ```text |
| Layers : 6 |
| Heads : 8 |
| Feedforward : 2048 |
| Dropout : 0.1 |
| ``` |
|
|
| --- |
|
|
| # Mamba-like Expert |
|
|
| Purpose: |
|
|
| * Efficient state-space sequence modeling |
| * Long-context compression |
|
|
| Configuration: |
|
|
| ```text |
| Layers : 10 |
| State Dim : 1408 |
| ``` |
|
|
| --- |
|
|
| # Fusion Layer |
|
|
| Outputs from all experts are concatenated and fused. |
|
|
| ```text |
| CNN |
| + |
| GRU |
| + |
| Transformer |
| + |
| Mamba |
| ↓ |
| Linear Fusion |
| ↓ |
| LayerNorm |
| ↓ |
| GELU |
| ``` |
|
|
| --- |
|
|
| # Classification Head |
|
|
| ```text |
| Global Mean Pooling |
| ↓ |
| Linear(512) |
| ↓ |
| GELU |
| ↓ |
| Linear(10) |
| ``` |
|
|
| Final output: |
|
|
| ```text |
| Risk Score |
| 0-9 |
| ``` |
|
|
| --- |
|
|
| # Model Size |
|
|
| ```text |
| Total Parameters |
| |
| 83.92 Million |
| ``` |
|
|
| --- |
|
|
| # Training Configuration |
|
|
| ```text |
| Optimizer : AdamW |
| Learning Rate : 1e-4 |
| |
| Batch Size : 64 |
| |
| Epochs : 4 |
| |
| Gradient Clip : 1.0 |
| |
| Checkpoint |
| Every 1000 Steps |
| ``` |
|
|
| --- |
|
|
| # Sequence Format |
|
|
| Input length must be exactly 64 tokens. |
|
|
| Example: |
|
|
| ```text |
| UUUDDUUUDDUUUUDDHHHHUUUDD++JJRRLLTTUUUDDUUUDDUUUUDDHHHHUUUDD |
| ``` |
|
|
| --- |
|
|
| # Benchmark Summary |
|
|
| ShadowCore-v2 maintains greater than 90% training accuracy despite: |
|
|
| ```text |
| Vocabulary Expansion |
| |
| 4 Tokens |
| ↓ |
| 11 Tokens |
| |
| Output Expansion |
| |
| 3 Classes |
| ↓ |
| 10 Classes |
| ``` |
|
|
| Observed training results: |
|
|
| ```text |
| Epoch 1 ≈ 90% |
| |
| Epoch 2 ≈ 92% |
| |
| Epoch 3 ≈ 92% |
| |
| Epoch 4 ≈ 92-93% |
| ``` |
|
|
| This indicates that the architecture successfully scales to a larger symbolic event space without major degradation in training performance. |
|
|
| --- |
|
|
| # Behavioral Evaluation |
|
|
| Observed behavior during manual testing suggests that the model: |
|
|
| * Differentiates Timeout and Connection Reset events. |
| * Detects increasing failure density. |
| * Uses intermediate risk levels instead of binary decisions. |
| * Recognizes Recovery patterns. |
| * Reacts to escalating anomaly accumulation. |
| * Produces stable risk estimates for normal traffic sequences. |
|
|
| Example observations: |
|
|
| ```text |
| Healthy Traffic |
| → Low Risk |
| |
| Timeout + Recovery |
| → Reduced Risk |
| |
| Connection Reset Dominated |
| → Critical Risk |
| |
| Mixed Jitter / Loss / Retransmission |
| → Medium-High Risk |
| ``` |
|
|
| --- |
|
|
| # Intended Use |
|
|
| ShadowCore-v2 is intended for: |
|
|
| * Network anomaly research |
| * Symbolic traffic classification |
| * Risk scoring experiments |
| * Cybersecurity research |
| * Educational projects |
| * Sequence classification studies |
|
|
| --- |
|
|
| # Limitations |
|
|
| * Fixed context length of 64 tokens. |
| * Requires symbolic event encoding. |
| * Not intended as a production IDS/IPS replacement. |
| * Training accuracy is not equivalent to real-world deployment performance. |
| * Requires domain-specific token generation pipelines. |
|
|
| --- |
|
|
| # Citation |
|
|
| ```text |
| ShadowCore-v2 |
| |
| 83.92M Parameter Hybrid CNN-GRU-Transformer-Mamba |
| Architecture for Symbolic Network Risk Classification |
| |
| Developed by BRSX-Labs |
| 2026 |
| ``` |
|
|
