Update README.md

README.md

@@ -2,4 +2,470 @@
 license: other
 license_name: brsx-open-license
 license_link: https://brsxlabs.gt.tc/brsxlicense.html
+tags:
+- cyber
+- hybrid
 ---
+# ShadowCore-v2
+
+## Overview
+
+ShadowCore-v2 is an 83.92M parameter hybrid neural architecture designed for symbolic network risk classification.
+
+The model analyzes fixed-length sequences of network events and predicts a risk score between 0 and 9, representing increasing levels of network instability, degradation, and failure severity.
+
+ShadowCore-v2 is the successor to ShadowCore-v1 and introduces a significantly expanded token vocabulary, a larger output space, and richer representation of network behavior while maintaining greater than 90% training accuracy.
+
+Developed by BRSX-Labs.
+
+---
+
+# Highlights
+
+* 83.92M Parameters
+* CNN + GRU + Transformer + Mamba-like Hybrid Architecture
+* 11 Symbolic Network Event Tokens
+* 10 Risk Classes (0-9)
+* Context Length: 64 Tokens
+* Global Sequence-Level Classification
+* > 90% Training Accuracy
+* Supports Recovery-Aware Risk Estimation
+
+---
+
+# What's New in ShadowCore-v2
+
+## Expanded Vocabulary
+
+ShadowCore-v1 used only four symbolic events:
+
+```text
+U
+D
++
+-
+```
+
+ShadowCore-v2 expands the vocabulary to eleven network events:
+
+```text
+U
+D
++
+-
+J
+R
+L
+T
+C
+H
+F
+```
+
+This allows the model to represent more realistic network conditions and failure scenarios.
+
+---
+
+## Expanded Output Space
+
+ShadowCore-v1:
+
+```text
+3 Risk Classes
+```
+
+ShadowCore-v2:
+
+```text
+10 Risk Classes
+(0-9)
+```
+
+This enables finer anomaly severity estimation and more granular decision making.
+
+---
+
+## Improved Network Awareness
+
+ShadowCore-v2 introduces explicit representation of:
+
+* Packet Loss
+* Retransmissions
+* Jitter
+* Connection Resets
+* Timeouts
+* Recovery Events
+* Traffic Bursts
+
+which were not available in ShadowCore-v1.
+
+---
+
+# Token Definitions
+
+```text
+U = Upload Increase
+D = Download Increase
+
++ = Latency Increase
+- = Latency Decrease
+
+J = Jitter
+R = Retransmission
+L = Packet Loss
+
+T = Timeout
+C = Connection Reset
+
+H = Recovery
+F = Flow Burst
+```
+
+---
+
+# Token Interpretation
+
+```text
+Low Risk
+
+H = Recovery
+U = Upload Increase
+D = Download Increase
+- = Latency Decrease
+
+Moderate Risk
+
++ = Latency Increase
+F = Flow Burst
+
+High Risk
+
+J = Jitter
+R = Retransmission
+
+Critical Risk
+
+L = Packet Loss
+T = Timeout
+C = Connection Reset
+```
+
+Actual predictions depend on the entire sequence and not on individual token presence.
+
+---
+
+# Risk Scale
+
+```text
+0 = Healthy
+
+1 = Normal Operation
+
+2 = Minor Variation
+
+3 = Low Risk Anomaly
+
+4 = Moderate Risk
+
+5 = Elevated Risk
+
+6 = Significant Risk
+
+7 = Severe Risk
+
+8 = Critical Risk
+
+9 = Extreme Risk / Failure State
+```
+
+---
+
+# Architecture
+
+ShadowCore-v2 uses four specialized experts operating in parallel.
+
+```text
+Input
+  ↓
+Embedding
+  ↓
+ ┌───────────────┐
+ │ CNN Expert    │
+ ├───────────────┤
+ │ GRU Expert    │
+ ├───────────────┤
+ │ Transformer   │
+ ├───────────────┤
+ │ Mamba Expert  │
+ └───────────────┘
+         ↓
+      Fusion
+         ↓
+ Global Pooling
+         ↓
+   Classifier
+         ↓
+     Risk Score
+```
+
+---
+
+# Embedding Layer
+
+```text
+Vocabulary Size : 11
+Dimension       : 512
+```
+
+All symbolic tokens are projected into a shared embedding space before expert processing.
+
+---
+
+# CNN Expert
+
+Purpose:
+
+* Local pattern extraction
+* Burst detection
+* Short-term event relationships
+
+Configuration:
+
+```text
+Blocks   : 7
+Channels : 960
+Kernel   : 3
+```
+
+---
+
+# GRU Expert
+
+Purpose:
+
+* Sequential modeling
+* Temporal event tracking
+
+Configuration:
+
+```text
+Hidden Size : 960
+Layers      : 4
+```
+
+---
+
+# Transformer Expert
+
+Purpose:
+
+* Long-range dependencies
+* Global context understanding
+
+Configuration:
+
+```text
+Layers          : 6
+Heads           : 8
+Feedforward     : 2048
+Dropout         : 0.1
+```
+
+---
+
+# Mamba-like Expert
+
+Purpose:
+
+* Efficient state-space sequence modeling
+* Long-context compression
+
+Configuration:
+
+```text
+Layers      : 10
+State Dim   : 1408
+```
+
+---
+
+# Fusion Layer
+
+Outputs from all experts are concatenated and fused.
+
+```text
+CNN
++
+GRU
++
+Transformer
++
+Mamba
+↓
+Linear Fusion
+↓
+LayerNorm
+↓
+GELU
+```
+
+---
+
+# Classification Head
+
+```text
+Global Mean Pooling
+↓
+Linear(512)
+↓
+GELU
+↓
+Linear(10)
+```
+
+Final output:
+
+```text
+Risk Score
+0-9
+```
+
+---
+
+# Model Size
+
+```text
+Total Parameters
+
+83.92 Million
+```
+
+---
+
+# Training Configuration
+
+```text
+Optimizer       : AdamW
+Learning Rate   : 1e-4
+
+Batch Size      : 64
+
+Epochs          : 4
+
+Gradient Clip   : 1.0
+
+Checkpoint
+Every 1000 Steps
+```
+
+---
+
+# Sequence Format
+
+Input length must be exactly 64 tokens.
+
+Example:
+
+```text
+UUUDDUUUDDUUUUDDHHHHUUUDD++JJRRLLTTUUUDDUUUDDUUUUDDHHHHUUUDD
+```
+
+---
+
+# Benchmark Summary
+
+ShadowCore-v2 maintains greater than 90% training accuracy despite:
+
+```text
+Vocabulary Expansion
+
+4 Tokens
+   ↓
+11 Tokens
+
+Output Expansion
+
+3 Classes
+   ↓
+10 Classes
+```
+
+Observed training results:
+
+```text
+Epoch 1 ≈ 90%
+
+Epoch 2 ≈ 92%
+
+Epoch 3 ≈ 92%
+
+Epoch 4 ≈ 92-93%
+```
+
+This indicates that the architecture successfully scales to a larger symbolic event space without major degradation in training performance.
+
+---
+
+# Behavioral Evaluation
+
+Observed behavior during manual testing suggests that the model:
+
+* Differentiates Timeout and Connection Reset events.
+* Detects increasing failure density.
+* Uses intermediate risk levels instead of binary decisions.
+* Recognizes Recovery patterns.
+* Reacts to escalating anomaly accumulation.
+* Produces stable risk estimates for normal traffic sequences.
+
+Example observations:
+
+```text
+Healthy Traffic
+→ Low Risk
+
+Timeout + Recovery
+→ Reduced Risk
+
+Connection Reset Dominated
+→ Critical Risk
+
+Mixed Jitter / Loss / Retransmission
+→ Medium-High Risk
+```
+
+---
+
+# Intended Use
+
+ShadowCore-v2 is intended for:
+
+* Network anomaly research
+* Symbolic traffic classification
+* Risk scoring experiments
+* Cybersecurity research
+* Educational projects
+* Sequence classification studies
+
+---
+
+# Limitations
+
+* Fixed context length of 64 tokens.
+* Requires symbolic event encoding.
+* Not intended as a production IDS/IPS replacement.
+* Training accuracy is not equivalent to real-world deployment performance.
+* Requires domain-specific token generation pipelines.
+
+---
+
+# Citation
+
+```text
+ShadowCore-v2
+
+83.92M Parameter Hybrid CNN-GRU-Transformer-Mamba
+Architecture for Symbolic Network Risk Classification
+
+Developed by BRSX-Labs
+2026
+```