| # SecEBL-Rev20 L2 Artifact |
|
|
| This directory contains the minimal public L2 artifact bundle for SecEBL-Rev20. |
| It is included so the companion GitHub `scripts/run_examples.sh` can run the |
| public Linux benchmark-subset session scoring path by default when this Hugging |
| Face model snapshot is used as `MODEL_DIR`. |
|
|
| ## Files |
|
|
| | Path | Purpose | |
| | --- | --- | |
| | `logreg.joblib` | Fitted logistic-regression L2 session-risk model. | |
| | `tag_risk_policy.rev20.json` | Matching L2 feature policy. Its tag-selection settings are internal to L2 feature extraction. | |
| | `train_summary.json` | Public aggregate training/evaluation summary with no raw rows or real session identifiers. | |
|
|
| The release does not include the L2 training JSONL, raw pressure-stream archive, |
| full internal sessions, per-session pressure results, alert JSONL, source-code |
| copies, or private run logs. This repository includes the public benchmark |
| subset under `examples/linux/`; use the companion GitHub repository for source |
| code and the one-command runner. |
|
|
| ## Scope |
|
|
| L2 is an experimental session scorer. A session is a sequence of events grouped |
| by `session_id`. L1 labels each event independently; L2 scores the whole session |
| by aggregating cached L1 ranked tags, retrieval scores, tag diversity, behavior |
| transitions, and routine-operation context. |
|
|
| Runtime L2 does not use raw command text, user names, host names, or session ids |
| as scoring features. Session ids may appear in private data-prep workflows for |
| label assignment, but they are not runtime allow/deny lists. |
|
|
| For compatibility with the released L2 artifact, L2 derives its session |
| features from cached L1 `top_labels` using an internal selected-tag feature |
| path. This does not change L1 prediction output: users still receive ranked |
| `top_labels`, not a selected `behavior_tags` field. |
|
|
| ## Public Summary |
|
|
| | Check | Result | |
| | --- | ---: | |
| | Fitted withheld Linux session benchmark | 663 sessions, 365 TP, 298 TN, 0 FP, 0 FN | |
| | 7M pressure-stream fit-check | 6,286,568 rows, 102,117 sessions, 61 alert sessions | |
| | OOF validation | 5,747 sessions, 99.39% accuracy, 96.44% attack precision, 95.31% attack recall | |
|
|
| The high session benchmark accuracy is scoped to the current fitted internal |
| experiment. It is evidence that this L2 setup works well on the current complex |
| internal benchmark and pressure-data fit-check, not an independent claim of |
| general production IDS accuracy. |
|
|
| Use the companion GitHub helpers so feature extraction matches the released L2 |
| artifact. |
|
|
