--- license: other license_name: brsx-open-license license_link: https://brsxlabs.gt.tc/brsxlicense.html tags: - cyber - hybrid --- # ShadowCore-v2 ![ShadowCore-v2](shadowcore_v2_banner.png) Symbolic Network Risk Intelligence ## Overview ShadowCore-v2 is an 83.92M parameter hybrid neural architecture designed for symbolic network risk classification. The model analyzes fixed-length sequences of network events and predicts a risk score between 0 and 9, representing increasing levels of network instability, degradation, and failure severity. ShadowCore-v2 is the successor to ShadowCore-v1 and introduces a significantly expanded token vocabulary, a larger output space, and richer representation of network behavior while maintaining greater than 90% training accuracy. Developed by BRSX-Labs. --- # Highlights * 83.92M Parameters * CNN + GRU + Transformer + Mamba-like Hybrid Architecture * 11 Symbolic Network Event Tokens * 10 Risk Classes (0-9) * Context Length: 64 Tokens * Global Sequence-Level Classification * > 90% Training Accuracy * Supports Recovery-Aware Risk Estimation --- # What's New in ShadowCore-v2 ## Expanded Vocabulary ShadowCore-v1 used only four symbolic events: ```text U D + - ``` ShadowCore-v2 expands the vocabulary to eleven network events: ```text U D + - J R L T C H F ``` This allows the model to represent more realistic network conditions and failure scenarios. --- ## Expanded Output Space ShadowCore-v1: ```text 3 Risk Classes ``` ShadowCore-v2: ```text 10 Risk Classes (0-9) ``` This enables finer anomaly severity estimation and more granular decision making. --- ## Improved Network Awareness ShadowCore-v2 introduces explicit representation of: * Packet Loss * Retransmissions * Jitter * Connection Resets * Timeouts * Recovery Events * Traffic Bursts which were not available in ShadowCore-v1. --- # Token Definitions ```text U = Upload Increase D = Download Increase + = Latency Increase - = Latency Decrease J = Jitter R = Retransmission L = Packet Loss T = Timeout C = Connection Reset H = Recovery F = Flow Burst ``` --- # Token Interpretation ```text Low Risk H = Recovery U = Upload Increase D = Download Increase - = Latency Decrease Moderate Risk + = Latency Increase F = Flow Burst High Risk J = Jitter R = Retransmission Critical Risk L = Packet Loss T = Timeout C = Connection Reset ``` Actual predictions depend on the entire sequence and not on individual token presence. --- # Risk Scale ```text 0 = Healthy 1 = Normal Operation 2 = Minor Variation 3 = Low Risk Anomaly 4 = Moderate Risk 5 = Elevated Risk 6 = Significant Risk 7 = Severe Risk 8 = Critical Risk 9 = Extreme Risk / Failure State ``` --- # Architecture ShadowCore-v2 uses four specialized experts operating in parallel. ```text Input ↓ Embedding ↓ ┌───────────────┐ │ CNN Expert │ ├───────────────┤ │ GRU Expert │ ├───────────────┤ │ Transformer │ ├───────────────┤ │ Mamba Expert │ └───────────────┘ ↓ Fusion ↓ Global Pooling ↓ Classifier ↓ Risk Score ``` --- # Embedding Layer ```text Vocabulary Size : 11 Dimension : 512 ``` All symbolic tokens are projected into a shared embedding space before expert processing. --- # CNN Expert Purpose: * Local pattern extraction * Burst detection * Short-term event relationships Configuration: ```text Blocks : 7 Channels : 960 Kernel : 3 ``` --- # GRU Expert Purpose: * Sequential modeling * Temporal event tracking Configuration: ```text Hidden Size : 960 Layers : 4 ``` --- # Transformer Expert Purpose: * Long-range dependencies * Global context understanding Configuration: ```text Layers : 6 Heads : 8 Feedforward : 2048 Dropout : 0.1 ``` --- # Mamba-like Expert Purpose: * Efficient state-space sequence modeling * Long-context compression Configuration: ```text Layers : 10 State Dim : 1408 ``` --- # Fusion Layer Outputs from all experts are concatenated and fused. ```text CNN + GRU + Transformer + Mamba ↓ Linear Fusion ↓ LayerNorm ↓ GELU ``` --- # Classification Head ```text Global Mean Pooling ↓ Linear(512) ↓ GELU ↓ Linear(10) ``` Final output: ```text Risk Score 0-9 ``` --- # Model Size ```text Total Parameters 83.92 Million ``` --- # Training Configuration ```text Optimizer : AdamW Learning Rate : 1e-4 Batch Size : 64 Epochs : 4 Gradient Clip : 1.0 Checkpoint Every 1000 Steps ``` --- # Sequence Format Input length must be exactly 64 tokens. Example: ```text UUUDDUUUDDUUUUDDHHHHUUUDD++JJRRLLTTUUUDDUUUDDUUUUDDHHHHUUUDD ``` --- # Benchmark Summary ShadowCore-v2 maintains greater than 90% training accuracy despite: ```text Vocabulary Expansion 4 Tokens ↓ 11 Tokens Output Expansion 3 Classes ↓ 10 Classes ``` Observed training results: ```text Epoch 1 ≈ 90% Epoch 2 ≈ 92% Epoch 3 ≈ 92% Epoch 4 ≈ 92-93% ``` This indicates that the architecture successfully scales to a larger symbolic event space without major degradation in training performance. --- # Behavioral Evaluation Observed behavior during manual testing suggests that the model: * Differentiates Timeout and Connection Reset events. * Detects increasing failure density. * Uses intermediate risk levels instead of binary decisions. * Recognizes Recovery patterns. * Reacts to escalating anomaly accumulation. * Produces stable risk estimates for normal traffic sequences. Example observations: ```text Healthy Traffic → Low Risk Timeout + Recovery → Reduced Risk Connection Reset Dominated → Critical Risk Mixed Jitter / Loss / Retransmission → Medium-High Risk ``` --- # Intended Use ShadowCore-v2 is intended for: * Network anomaly research * Symbolic traffic classification * Risk scoring experiments * Cybersecurity research * Educational projects * Sequence classification studies --- # Limitations * Fixed context length of 64 tokens. * Requires symbolic event encoding. * Not intended as a production IDS/IPS replacement. * Training accuracy is not equivalent to real-world deployment performance. * Requires domain-specific token generation pipelines. --- # Citation ```text ShadowCore-v2 83.92M Parameter Hybrid CNN-GRU-Transformer-Mamba Architecture for Symbolic Network Risk Classification Developed by BRSX-Labs 2026 ```