behavior_encoder.json

{
  "backbone": "microsoft/codebert-base",
  "stage_map": {
    "C2 / Remote Access": 0,
    "Collection / Staging": 1,
    "Context Required": 2,
    "Credential Access": 3,
    "Defense Evasion": 4,
    "Discovery / Recon": 5,
    "Execution": 6,
    "Exfiltration": 7,
    "Impact": 8,
    "Lateral Movement": 9,
    "Payload Retrieval": 10,
    "Persistence": 11,
    "Privilege Escalation": 12
  },
  "action_map": {
    "archive_data": 0,
    "download_remote_resource": 1,
    "execute_inline_code": 2,
    "execute_interpreter": 3,
    "extract_archive": 4,
    "remote_execution": 5,
    "use_encoded_payload": 6,
    "use_obfuscation": 7,
    "use_signed_proxy_binary": 8
  },
  "test_metrics": {
    "stage_acc": 0.5654761904761905,
    "stage_macro_f1": 0.5003193773622796,
    "action_micro_f1": 0.9359062715368711
  },
  "max_length": 256
}