SecEBL-Rev20 L2 Artifact
This directory contains the minimal public L2 artifact bundle for SecEBL-Rev20.
It is included so the companion GitHub scripts/run_examples.sh can run the
public Linux benchmark-subset session scoring path by default when this Hugging
Face model snapshot is used as MODEL_DIR.
Files
| Path | Purpose |
|---|---|
logreg.joblib |
Fitted logistic-regression L2 session-risk model. |
tag_risk_policy.rev20.json |
Matching L2 feature policy. Its tag-selection settings are internal to L2 feature extraction. |
train_summary.json |
Public aggregate training/evaluation summary with no raw rows or real session identifiers. |
The release does not include the L2 training JSONL, raw pressure-stream archive,
full internal sessions, per-session pressure results, alert JSONL, source-code
copies, or private run logs. This repository includes the public benchmark
subset under examples/linux/; use the companion GitHub repository for source
code and the one-command runner.
Scope
L2 is an experimental session scorer. A session is a sequence of events grouped
by session_id. L1 labels each event independently; L2 scores the whole session
by aggregating cached L1 ranked tags, retrieval scores, tag diversity, behavior
transitions, and routine-operation context.
Runtime L2 does not use raw command text, user names, host names, or session ids as scoring features. Session ids may appear in private data-prep workflows for label assignment, but they are not runtime allow/deny lists.
For compatibility with the released L2 artifact, L2 derives its session
features from cached L1 top_labels using an internal selected-tag feature
path. This does not change L1 prediction output: users still receive ranked
top_labels, not a selected behavior_tags field.
Public Summary
| Check | Result |
|---|---|
| Fitted withheld Linux session benchmark | 663 sessions, 365 TP, 298 TN, 0 FP, 0 FN |
| 7M pressure-stream fit-check | 6,286,568 rows, 102,117 sessions, 61 alert sessions |
| OOF validation | 5,747 sessions, 99.39% accuracy, 96.44% attack precision, 95.31% attack recall |
The high session benchmark accuracy is scoped to the current fitted internal experiment. It is evidence that this L2 setup works well on the current complex internal benchmark and pressure-data fit-check, not an independent claim of general production IDS accuracy.
Use the companion GitHub helpers so feature extraction matches the released L2 artifact.