# SecEBL-Rev20 L2 Artifact

This directory contains the minimal public L2 artifact bundle for SecEBL-Rev20.
It is included so the companion GitHub `scripts/run_examples.sh` can run the
public Linux benchmark-subset session scoring path by default when this Hugging
Face model snapshot is used as `MODEL_DIR`.

## Files

| Path | Purpose |
| --- | --- |
| `logreg.joblib` | Fitted logistic-regression L2 session-risk model. |
| `tag_risk_policy.rev20.json` | Matching L2 feature policy. Its tag-selection settings are internal to L2 feature extraction. |
| `train_summary.json` | Public aggregate training/evaluation summary with no raw rows or real session identifiers. |

The release does not include the L2 training JSONL, raw pressure-stream archive,
full internal sessions, per-session pressure results, alert JSONL, source-code
copies, or private run logs. This repository includes the public benchmark
subset under `examples/linux/`; use the companion GitHub repository for source
code and the one-command runner.

## Scope

L2 is an experimental session scorer. A session is a sequence of events grouped
by `session_id`. L1 labels each event independently; L2 scores the whole session
by aggregating cached L1 ranked tags, retrieval scores, tag diversity, behavior
transitions, and routine-operation context.

Runtime L2 does not use raw command text, user names, host names, or session ids
as scoring features. Session ids may appear in private data-prep workflows for
label assignment, but they are not runtime allow/deny lists.

For compatibility with the released L2 artifact, L2 derives its session
features from cached L1 `top_labels` using an internal selected-tag feature
path. This does not change L1 prediction output: users still receive ranked
`top_labels`, not a selected `behavior_tags` field.

## Public Summary

| Check | Result |
| --- | ---: |
| Fitted withheld Linux session benchmark | 663 sessions, 365 TP, 298 TN, 0 FP, 0 FN |
| 7M pressure-stream fit-check | 6,286,568 rows, 102,117 sessions, 61 alert sessions |
| OOF validation | 5,747 sessions, 99.39% accuracy, 96.44% attack precision, 95.31% attack recall |

The high session benchmark accuracy is scoped to the current fitted internal
experiment. It is evidence that this L2 setup works well on the current complex
internal benchmark and pressure-data fit-check, not an independent claim of
general production IDS accuracy.

Use the companion GitHub helpers so feature extraction matches the released L2
artifact.