| { |
| "schema": "secebl_rev20_l2_public_summary_v1", |
| "l1_release": "SecEBL-Rev20 public L1 release", |
| "l2_release": "SecEBL-Rev20 public L2 artifact", |
| "model_type": "logistic_regression_session_scorer", |
| "scoring_scope": "experimental fitted L2 session scorer over cached L1 semantic features", |
| "runtime_feature_exclusions": [ |
| "raw_command_text", |
| "user_name", |
| "host_name", |
| "session_id" |
| ], |
| "training_mixture": { |
| "sessions": 5747, |
| "positive_sessions": 426, |
| "negative_sessions": 5321, |
| "synthetic_pressure_positive_sessions": 60, |
| "reviewed_real_pressure_positive_sessions": 1, |
| "random_real_pressure_background_negative_sessions": 5000, |
| "reviewed_hard_negative_pressure_sessions": 23 |
| }, |
| "validation_oof": { |
| "folds": 5, |
| "accuracy": 0.9939098660170523, |
| "attack_precision": 0.9643705463182898, |
| "attack_recall": 0.9530516431924883, |
| "normal_recall": 0.9971809810186055, |
| "tp": 406, |
| "fn": 20, |
| "fp": 15, |
| "tn": 5306 |
| }, |
| "withheld_session_benchmark_fit_check": { |
| "sessions": 663, |
| "rows_seen": 12594, |
| "attack_sessions": 365, |
| "normal_sessions": 298, |
| "accuracy": 1.0, |
| "attack_precision": 1.0, |
| "attack_recall": 1.0, |
| "normal_recall": 1.0, |
| "tp": 365, |
| "fn": 0, |
| "fp": 0, |
| "tn": 298 |
| }, |
| "pressure_stream_fit_check": { |
| "rows_seen": 6286568, |
| "sessions": 102117, |
| "alert_sessions": 61, |
| "reviewed_real_alert_sessions": 1, |
| "synthetic_alert_sessions": 60, |
| "raw_rows_redistributed": false, |
| "real_session_identifiers_redistributed": false |
| }, |
| "thresholds": { |
| "score_threshold": 0.5, |
| "model_probability_threshold": 0.9, |
| "score_transform": "threshold_margin", |
| "score_transform_scale": 2.0 |
| }, |
| "caveat": "This is an experimental fitted L2 artifact for reproducible SecEBL-Rev20 session experiments, not an independent claim of general production IDS accuracy." |
| } |
|
|
