Add private Cat Shell Risk Commander preview with verified JSON inference and model card
Browse files- README.md +163 -0
- evaluation.json +1621 -0
- manifest.json +32 -0
- model.json +0 -0
- requirements.txt +3 -0
- shell_cat_guard.py +42 -0
- validation.json +24 -0
README.md
ADDED
|
@@ -0,0 +1,163 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
---
|
| 2 |
+
pipeline_tag: text-classification
|
| 3 |
+
library_name: sklearn
|
| 4 |
+
metrics:
|
| 5 |
+
- recall
|
| 6 |
+
- f1
|
| 7 |
+
datasets:
|
| 8 |
+
- tomngdev/shell-safety
|
| 9 |
+
- wwe123/Benign_and_malicious_PowerShell_scripts
|
| 10 |
+
tags:
|
| 11 |
+
- shell-security
|
| 12 |
+
- shell-risk
|
| 13 |
+
- bash
|
| 14 |
+
- powershell
|
| 15 |
+
- cmd
|
| 16 |
+
- coding-agents
|
| 17 |
+
- tf-idf
|
| 18 |
+
- logistic-regression
|
| 19 |
+
- cpu
|
| 20 |
+
- research
|
| 21 |
+
inference: false
|
| 22 |
+
---
|
| 23 |
+
|
| 24 |
+
# Cat Shell Risk Commander
|
| 25 |
+
|
| 26 |
+
**A compact linear classifier for flagging potentially risky shell commands and scripts locally.**
|
| 27 |
+
|
| 28 |
+
Cat Shell Risk Commander is Patronus's expanded TF-IDF and logistic-regression model from our exploratory ShellRisk experiments. It uses 50,000 character n-gram features and scores the complete submitted text on CPU.
|
| 29 |
+
|
| 30 |
+
It is a newly trained Patronus model. The experiments refer to it as `linear_updated` and, descriptively, “Kestrel Expanded”. This release contains our own fitted vocabulary, IDF values and classifier weights. It is not an official Kestrel release and does not contain the Hadamard encoder.
|
| 31 |
+
|
| 32 |
+
**Release status: private research preview.** This repository is intentionally private. A public release license has not been assigned to this preview.
|
| 33 |
+
|
| 34 |
+
Read the experiment report:
|
| 35 |
+
|
| 36 |
+
- [English: Detecting risky shell commands](https://patronus.studio/en/posts/detecting-risky-shell-commands-shellrisk-benchmark)
|
| 37 |
+
- [Deutsch: Gefährliche Shell-Befehle erkennen](https://patronus.studio/posts/gefaehrliche-shell-befehle-erkennen-shellrisk-benchmark)
|
| 38 |
+
|
| 39 |
+
## What the model does
|
| 40 |
+
|
| 41 |
+
The input is a shell command or a complete script supplied as text. The output is a linear decision score and a threshold-based risk flag.
|
| 42 |
+
|
| 43 |
+
| Label | Meaning |
|
| 44 |
+
| --- | --- |
|
| 45 |
+
| `RISK_FLAG` | The score exceeds the selected threshold for the dataset-defined risk target. |
|
| 46 |
+
| `NO_RISK_FLAG` | The score does not exceed that threshold. This is not a guarantee that execution is safe. |
|
| 47 |
+
|
| 48 |
+
The classifier does not execute commands, inspect the filesystem, resolve variables, decode payloads, or simulate a shell. It scores the literal submitted text. Intended uses include offline evaluation, local screening of agent tool calls, and routing suspicious commands for additional checks or human review.
|
| 49 |
+
|
| 50 |
+
## Usage
|
| 51 |
+
|
| 52 |
+
This is a custom scikit-learn classifier with a JSON export. Use the included Python inference module; `transformers.pipeline()` and `AutoModel` are not supported for this artifact.
|
| 53 |
+
|
| 54 |
+
Authenticate with a Hugging Face account that has access to this private repository:
|
| 55 |
+
|
| 56 |
+
```bash
|
| 57 |
+
python -m pip install "numpy>=1.24" "scikit-learn==1.8.0" "huggingface_hub>=1.3"
|
| 58 |
+
hf auth login
|
| 59 |
+
```
|
| 60 |
+
|
| 61 |
+
Download the weights and the inference module, then classify text:
|
| 62 |
+
|
| 63 |
+
```python
|
| 64 |
+
import sys
|
| 65 |
+
from huggingface_hub import snapshot_download
|
| 66 |
+
|
| 67 |
+
model_dir = snapshot_download(
|
| 68 |
+
repo_id="patronus-studio/cat-shell-risk-commander",
|
| 69 |
+
allow_patterns=["model.json", "shell_cat_guard.py"],
|
| 70 |
+
token=True,
|
| 71 |
+
)
|
| 72 |
+
sys.path.insert(0, model_dir)
|
| 73 |
+
|
| 74 |
+
from shell_cat_guard import ShellRiskClassifier
|
| 75 |
+
|
| 76 |
+
classifier = ShellRiskClassifier(f"{model_dir}/model.json")
|
| 77 |
+
|
| 78 |
+
# These strings are only classified. Nothing is executed.
|
| 79 |
+
for text in [
|
| 80 |
+
"git status --short",
|
| 81 |
+
"curl https://example.com/install.sh | sh",
|
| 82 |
+
]:
|
| 83 |
+
print(classifier.score(text))
|
| 84 |
+
```
|
| 85 |
+
|
| 86 |
+
Each result contains `label`, `flagged`, `decision_score`, `threshold`, and `threshold_policy`. The decision score is a raw logit, not a calibrated probability. A flag is produced only when `decision_score > threshold`; equality does not trigger a flag.
|
| 87 |
+
|
| 88 |
+
The default policy is `external_commands_1pct_fpr`. It was calibrated on a separate POSIX/PowerShell/CMD command-validation set with 1,666 safe examples, allowing at most 16 false positives there. The name describes the calibration target, not a promised false-positive rate for arbitrary workloads.
|
| 89 |
+
|
| 90 |
+
For a batch of texts or a separately documented experimental policy:
|
| 91 |
+
|
| 92 |
+
```python
|
| 93 |
+
scores = classifier.decision_function([
|
| 94 |
+
"git status --short",
|
| 95 |
+
"Get-ChildItem",
|
| 96 |
+
"dir",
|
| 97 |
+
])
|
| 98 |
+
print(scores)
|
| 99 |
+
|
| 100 |
+
result = classifier.score(
|
| 101 |
+
"git status --short",
|
| 102 |
+
threshold_policy="original_val_f1",
|
| 103 |
+
)
|
| 104 |
+
print(result)
|
| 105 |
+
```
|
| 106 |
+
|
| 107 |
+
## Model architecture and training
|
| 108 |
+
|
| 109 |
+
- Character-within-word (`char_wb`) n-grams of lengths 3 to 5.
|
| 110 |
+
- Lowercasing, sublinear term frequency, IDF weighting, and L2 normalization.
|
| 111 |
+
- A fitted vocabulary of 50,000 features.
|
| 112 |
+
- Binary logistic regression; selected regularization parameter `C = 10` and training random state `13`.
|
| 113 |
+
- Full-text vectorization, without a 510-byte prefix cut or encoder chunking.
|
| 114 |
+
|
| 115 |
+
Training combines 13,417 original fitting examples with 18,918 additional fitting examples, for 32,335 total. The additional set contains 10,672 positive and 8,246 negative examples, including multi-shell commands, PowerShell scripts, and synthetic obfuscation variants from fitting parents.
|
| 116 |
+
|
| 117 |
+
The fitting data builds on [ShellRisk-Bench](https://github.com/kontext-security/shellrisk-bench), [Shell Safety](https://huggingface.co/datasets/tomngdev/shell-safety), and [Benign and malicious PowerShell scripts](https://huggingface.co/datasets/wwe123/Benign_and_malicious_PowerShell_scripts).
|
| 118 |
+
|
| 119 |
+
`C` was selected from `0.1, 1, 10, 100, 1000` using mean validation average precision across five groups: original Bash, external POSIX, PowerShell, CMD, and PowerShell scripts. Exact duplicates, contradictory identical command labels, and detected held-out overlaps were excluded. Generated variants follow their original parent's split. These checks do not establish semantic, source-family, or malware-family independence.
|
| 120 |
+
|
| 121 |
+
No dataset command or script was executed during the reported experiments. This model has no neural pretraining; the MLM and Hadamard-encoder experiments in the linked article concern a separate model.
|
| 122 |
+
|
| 123 |
+
## Evaluation
|
| 124 |
+
|
| 125 |
+
Experiments were run from October 4 to October 6, 2026. The following rows use different, explicitly identified threshold policies and must not be treated as results at one common operating point.
|
| 126 |
+
|
| 127 |
+
| Evaluation | Test size | Threshold policy | Recall | False-positive rate | F1 |
|
| 128 |
+
| --- | ---: | --- | ---: | ---: | ---: |
|
| 129 |
+
| External POSIX/PowerShell/CMD commands | 918: 374 risky, 544 safe | `external_commands_1pct_fpr` | 85.83% | 0.92% | 91.71% |
|
| 130 |
+
| Original Bash test | 4,194: 193 risky, 4,001 safe | `original_val_f1` | 85.49% | 0.45% | 87.77% |
|
| 131 |
+
| Complete PowerShell scripts | 2,000: 1,000 per class | `original_val_f1` | 96.10% | 2.80% | 96.63% |
|
| 132 |
+
|
| 133 |
+
The external command-test counts are 321 true positives, 53 false negatives, 5 false positives, and 539 true negatives. Its threshold was selected on separate external command-validation data; test cases did not determine this threshold.
|
| 134 |
+
|
| 135 |
+
The external command test contains 735 POSIX, 119 PowerShell, and 64 CMD examples. The script test contains selected source-labeled PowerShell scripts up to 1 MiB, all longer than 510 bytes. Large scripts outside that bound were excluded from that experiment.
|
| 136 |
+
|
| 137 |
+
Additional stored policies are `original_val_1pct_fpr`, `combined_val_f1`, and `exploratory_multigroup_0_5pct_fpr`. The last policy consumes calibration portions of earlier test groups and is exploratory; it is not the default and does not provide an independent confirmation of performance.
|
| 138 |
+
|
| 139 |
+
Detailed per-group metrics, threshold values and training/audit counts are included in `evaluation.json`. The linked article also reports synthetic obfuscation and comment-padding stress tests.
|
| 140 |
+
|
| 141 |
+
## Limitations
|
| 142 |
+
|
| 143 |
+
- The target is the source-labeled risk status of text. Labels are not independently verified malicious behavior or execution outcomes, and different source datasets use different labeling criteria.
|
| 144 |
+
- A legitimate installer may look risky; a harmful command may appear harmless when its payload or environment is absent from the input.
|
| 145 |
+
- Character n-grams do not provide shell parsing or document-wide semantic reasoning.
|
| 146 |
+
- Harmless comment padding can weaken detection. In the reported padding test, this linear model's POSIX recall fell from 91.10% to 50.00% behind 4 KiB of repeated comments and to 41.78% behind 16 KiB. Those results use the original-validation F1 policy and this specific synthetic transformation.
|
| 147 |
+
- PowerShell and CMD command-test samples are small. Results use one training seed and source-conditioned splits, not a prospective production evaluation.
|
| 148 |
+
- Processing the entire text does not guarantee robust detection of hidden or late risks. Runtime and memory use grow with input size; no deployment latency claim is made here.
|
| 149 |
+
|
| 150 |
+
Use the classifier alongside execution permissions, sandboxing, explicit policy checks and review where needed. Evaluate threshold behavior on your own representative validation data before enabling automatic blocking.
|
| 151 |
+
|
| 152 |
+
## Repository files
|
| 153 |
+
|
| 154 |
+
| File | Contents |
|
| 155 |
+
| --- | --- |
|
| 156 |
+
| `model.json` | Vocabulary, IDF values, linear weights, intercept, inference configuration and threshold policies. |
|
| 157 |
+
| `shell_cat_guard.py` | CPU inference implementation and result schema. |
|
| 158 |
+
| `requirements.txt` | Runtime dependencies; the reference implementation was checked with scikit-learn 1.8.0. |
|
| 159 |
+
| `evaluation.json` | Stored experiment metrics and data-audit summaries. |
|
| 160 |
+
| `validation.json` | Export verification results against saved test scores. |
|
| 161 |
+
| `manifest.json` | File hashes and source-model provenance. |
|
| 162 |
+
|
| 163 |
+
The JSON export preserves the fitted inference parameters. It omits training-only estimator state and does not require loading a pickle or enabling Transformers remote code.
|
evaluation.json
ADDED
|
@@ -0,0 +1,1621 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
{
|
| 2 |
+
"experiment_dates": "2026-10-04 to 2026-10-06",
|
| 3 |
+
"model_selection": {
|
| 4 |
+
"C": 10,
|
| 5 |
+
"features": 50000,
|
| 6 |
+
"fit_examples": 32335,
|
| 7 |
+
"fit_positives": 11291,
|
| 8 |
+
"random_state": 13
|
| 9 |
+
},
|
| 10 |
+
"external_commands": {
|
| 11 |
+
"n": 918,
|
| 12 |
+
"positive_count": 374,
|
| 13 |
+
"tp": 321,
|
| 14 |
+
"fp": 5,
|
| 15 |
+
"fn": 53,
|
| 16 |
+
"tn": 539,
|
| 17 |
+
"threshold": 1.1503808109736977,
|
| 18 |
+
"recall": 0.8582887700534759,
|
| 19 |
+
"specificity": 0.9908088235294118,
|
| 20 |
+
"f1": 0.9171428571428571,
|
| 21 |
+
"ap": 0.9864445849280075,
|
| 22 |
+
"auc": 0.9889607581000315
|
| 23 |
+
},
|
| 24 |
+
"original_bash": {
|
| 25 |
+
"original_val_f1": {
|
| 26 |
+
"n": 4194,
|
| 27 |
+
"positive_count": 193,
|
| 28 |
+
"tp": 165,
|
| 29 |
+
"fp": 18,
|
| 30 |
+
"fn": 28,
|
| 31 |
+
"tn": 3983,
|
| 32 |
+
"threshold": 0.23999364623390296,
|
| 33 |
+
"recall": 0.8549222797927462,
|
| 34 |
+
"specificity": 0.9955011247188202,
|
| 35 |
+
"f1": 0.8776595744680851,
|
| 36 |
+
"ap": 0.940109809927308,
|
| 37 |
+
"auc": 0.9949041237100051
|
| 38 |
+
},
|
| 39 |
+
"original_val_1pct_fpr": {
|
| 40 |
+
"n": 4194,
|
| 41 |
+
"positive_count": 193,
|
| 42 |
+
"tp": 177,
|
| 43 |
+
"fp": 51,
|
| 44 |
+
"fn": 16,
|
| 45 |
+
"tn": 3950,
|
| 46 |
+
"threshold": -0.7815297361664113,
|
| 47 |
+
"recall": 0.917098445595855,
|
| 48 |
+
"specificity": 0.9872531867033242,
|
| 49 |
+
"f1": 0.8408551068883611,
|
| 50 |
+
"ap": 0.940109809927308,
|
| 51 |
+
"auc": 0.9949041237100051
|
| 52 |
+
},
|
| 53 |
+
"combined_val_f1": {
|
| 54 |
+
"n": 4194,
|
| 55 |
+
"positive_count": 193,
|
| 56 |
+
"tp": 171,
|
| 57 |
+
"fp": 23,
|
| 58 |
+
"fn": 22,
|
| 59 |
+
"tn": 3978,
|
| 60 |
+
"threshold": -0.022361982385277646,
|
| 61 |
+
"recall": 0.8860103626943006,
|
| 62 |
+
"specificity": 0.9942514371407148,
|
| 63 |
+
"f1": 0.8837209302325582,
|
| 64 |
+
"ap": 0.940109809927308,
|
| 65 |
+
"auc": 0.9949041237100051
|
| 66 |
+
}
|
| 67 |
+
},
|
| 68 |
+
"external_groups": {
|
| 69 |
+
"commands_powershell": {
|
| 70 |
+
"over_510_bytes": 0,
|
| 71 |
+
"metrics": {
|
| 72 |
+
"original_val_f1": {
|
| 73 |
+
"n": 119,
|
| 74 |
+
"positive_count": 58,
|
| 75 |
+
"tp": 57,
|
| 76 |
+
"fp": 0,
|
| 77 |
+
"fn": 1,
|
| 78 |
+
"tn": 61,
|
| 79 |
+
"threshold": 0.23999364623390296,
|
| 80 |
+
"recall": 0.9827586206896551,
|
| 81 |
+
"specificity": 1.0,
|
| 82 |
+
"f1": 0.991304347826087,
|
| 83 |
+
"ap": 0.9997077732320282,
|
| 84 |
+
"auc": 0.9997173544375353
|
| 85 |
+
},
|
| 86 |
+
"original_val_1pct_fpr": {
|
| 87 |
+
"n": 119,
|
| 88 |
+
"positive_count": 58,
|
| 89 |
+
"tp": 58,
|
| 90 |
+
"fp": 2,
|
| 91 |
+
"fn": 0,
|
| 92 |
+
"tn": 59,
|
| 93 |
+
"threshold": -0.7815297361664113,
|
| 94 |
+
"recall": 1.0,
|
| 95 |
+
"specificity": 0.9672131147540983,
|
| 96 |
+
"f1": 0.9830508474576272,
|
| 97 |
+
"ap": 0.9997077732320282,
|
| 98 |
+
"auc": 0.9997173544375353
|
| 99 |
+
},
|
| 100 |
+
"combined_val_f1": {
|
| 101 |
+
"n": 119,
|
| 102 |
+
"positive_count": 58,
|
| 103 |
+
"tp": 57,
|
| 104 |
+
"fp": 1,
|
| 105 |
+
"fn": 1,
|
| 106 |
+
"tn": 60,
|
| 107 |
+
"threshold": -0.022361982385277646,
|
| 108 |
+
"recall": 0.9827586206896551,
|
| 109 |
+
"specificity": 0.9836065573770492,
|
| 110 |
+
"f1": 0.9827586206896551,
|
| 111 |
+
"ap": 0.9997077732320282,
|
| 112 |
+
"auc": 0.9997173544375353
|
| 113 |
+
}
|
| 114 |
+
}
|
| 115 |
+
},
|
| 116 |
+
"paired_powershell_utf16_base64": {
|
| 117 |
+
"over_510_bytes": 1,
|
| 118 |
+
"metrics": {
|
| 119 |
+
"original_val_f1": {
|
| 120 |
+
"n": 119,
|
| 121 |
+
"positive_count": 58,
|
| 122 |
+
"tp": 56,
|
| 123 |
+
"fp": 4,
|
| 124 |
+
"fn": 2,
|
| 125 |
+
"tn": 57,
|
| 126 |
+
"threshold": 0.23999364623390296,
|
| 127 |
+
"recall": 0.9655172413793104,
|
| 128 |
+
"specificity": 0.9344262295081968,
|
| 129 |
+
"f1": 0.9491525423728814,
|
| 130 |
+
"ap": 0.9908188538251569,
|
| 131 |
+
"auc": 0.9909553420011306
|
| 132 |
+
},
|
| 133 |
+
"original_val_1pct_fpr": {
|
| 134 |
+
"n": 119,
|
| 135 |
+
"positive_count": 58,
|
| 136 |
+
"tp": 58,
|
| 137 |
+
"fp": 9,
|
| 138 |
+
"fn": 0,
|
| 139 |
+
"tn": 52,
|
| 140 |
+
"threshold": -0.7815297361664113,
|
| 141 |
+
"recall": 1.0,
|
| 142 |
+
"specificity": 0.8524590163934426,
|
| 143 |
+
"f1": 0.928,
|
| 144 |
+
"ap": 0.9908188538251569,
|
| 145 |
+
"auc": 0.9909553420011306
|
| 146 |
+
},
|
| 147 |
+
"combined_val_f1": {
|
| 148 |
+
"n": 119,
|
| 149 |
+
"positive_count": 58,
|
| 150 |
+
"tp": 56,
|
| 151 |
+
"fp": 5,
|
| 152 |
+
"fn": 2,
|
| 153 |
+
"tn": 56,
|
| 154 |
+
"threshold": -0.022361982385277646,
|
| 155 |
+
"recall": 0.9655172413793104,
|
| 156 |
+
"specificity": 0.9180327868852459,
|
| 157 |
+
"f1": 0.9411764705882353,
|
| 158 |
+
"ap": 0.9908188538251569,
|
| 159 |
+
"auc": 0.9909553420011306
|
| 160 |
+
}
|
| 161 |
+
},
|
| 162 |
+
"paired_original_metrics": {
|
| 163 |
+
"original_val_f1": {
|
| 164 |
+
"n": 119,
|
| 165 |
+
"positive_count": 58,
|
| 166 |
+
"tp": 57,
|
| 167 |
+
"fp": 0,
|
| 168 |
+
"fn": 1,
|
| 169 |
+
"tn": 61,
|
| 170 |
+
"threshold": 0.23999364623390296,
|
| 171 |
+
"recall": 0.9827586206896551,
|
| 172 |
+
"specificity": 1.0,
|
| 173 |
+
"f1": 0.991304347826087,
|
| 174 |
+
"ap": 0.9997077732320282,
|
| 175 |
+
"auc": 0.9997173544375353
|
| 176 |
+
},
|
| 177 |
+
"original_val_1pct_fpr": {
|
| 178 |
+
"n": 119,
|
| 179 |
+
"positive_count": 58,
|
| 180 |
+
"tp": 58,
|
| 181 |
+
"fp": 2,
|
| 182 |
+
"fn": 0,
|
| 183 |
+
"tn": 59,
|
| 184 |
+
"threshold": -0.7815297361664113,
|
| 185 |
+
"recall": 1.0,
|
| 186 |
+
"specificity": 0.9672131147540983,
|
| 187 |
+
"f1": 0.9830508474576272,
|
| 188 |
+
"ap": 0.9997077732320282,
|
| 189 |
+
"auc": 0.9997173544375353
|
| 190 |
+
},
|
| 191 |
+
"combined_val_f1": {
|
| 192 |
+
"n": 119,
|
| 193 |
+
"positive_count": 58,
|
| 194 |
+
"tp": 57,
|
| 195 |
+
"fp": 1,
|
| 196 |
+
"fn": 1,
|
| 197 |
+
"tn": 60,
|
| 198 |
+
"threshold": -0.022361982385277646,
|
| 199 |
+
"recall": 0.9827586206896551,
|
| 200 |
+
"specificity": 0.9836065573770492,
|
| 201 |
+
"f1": 0.9827586206896551,
|
| 202 |
+
"ap": 0.9997077732320282,
|
| 203 |
+
"auc": 0.9997173544375353
|
| 204 |
+
}
|
| 205 |
+
},
|
| 206 |
+
"decision_changes": {
|
| 207 |
+
"original_val_f1": 7,
|
| 208 |
+
"original_val_1pct_fpr": 7,
|
| 209 |
+
"combined_val_f1": 7
|
| 210 |
+
}
|
| 211 |
+
},
|
| 212 |
+
"commands_posix": {
|
| 213 |
+
"over_510_bytes": 0,
|
| 214 |
+
"metrics": {
|
| 215 |
+
"original_val_f1": {
|
| 216 |
+
"n": 735,
|
| 217 |
+
"positive_count": 292,
|
| 218 |
+
"tp": 266,
|
| 219 |
+
"fp": 19,
|
| 220 |
+
"fn": 26,
|
| 221 |
+
"tn": 424,
|
| 222 |
+
"threshold": 0.23999364623390296,
|
| 223 |
+
"recall": 0.910958904109589,
|
| 224 |
+
"specificity": 0.9571106094808126,
|
| 225 |
+
"f1": 0.9220103986135182,
|
| 226 |
+
"ap": 0.9813814307925482,
|
| 227 |
+
"auc": 0.9848712081387798
|
| 228 |
+
},
|
| 229 |
+
"original_val_1pct_fpr": {
|
| 230 |
+
"n": 735,
|
| 231 |
+
"positive_count": 292,
|
| 232 |
+
"tp": 280,
|
| 233 |
+
"fp": 54,
|
| 234 |
+
"fn": 12,
|
| 235 |
+
"tn": 389,
|
| 236 |
+
"threshold": -0.7815297361664113,
|
| 237 |
+
"recall": 0.958904109589041,
|
| 238 |
+
"specificity": 0.8781038374717833,
|
| 239 |
+
"f1": 0.8945686900958466,
|
| 240 |
+
"ap": 0.9813814307925482,
|
| 241 |
+
"auc": 0.9848712081387798
|
| 242 |
+
},
|
| 243 |
+
"combined_val_f1": {
|
| 244 |
+
"n": 735,
|
| 245 |
+
"positive_count": 292,
|
| 246 |
+
"tp": 270,
|
| 247 |
+
"fp": 25,
|
| 248 |
+
"fn": 22,
|
| 249 |
+
"tn": 418,
|
| 250 |
+
"threshold": -0.022361982385277646,
|
| 251 |
+
"recall": 0.9246575342465754,
|
| 252 |
+
"specificity": 0.9435665914221218,
|
| 253 |
+
"f1": 0.919931856899489,
|
| 254 |
+
"ap": 0.9813814307925482,
|
| 255 |
+
"auc": 0.9848712081387798
|
| 256 |
+
}
|
| 257 |
+
}
|
| 258 |
+
},
|
| 259 |
+
"paired_bash_base64_wrapper": {
|
| 260 |
+
"over_510_bytes": 2,
|
| 261 |
+
"metrics": {
|
| 262 |
+
"original_val_f1": {
|
| 263 |
+
"n": 735,
|
| 264 |
+
"positive_count": 292,
|
| 265 |
+
"tp": 244,
|
| 266 |
+
"fp": 26,
|
| 267 |
+
"fn": 48,
|
| 268 |
+
"tn": 417,
|
| 269 |
+
"threshold": 0.23999364623390296,
|
| 270 |
+
"recall": 0.8356164383561644,
|
| 271 |
+
"specificity": 0.9413092550790068,
|
| 272 |
+
"f1": 0.8683274021352313,
|
| 273 |
+
"ap": 0.9445323360591276,
|
| 274 |
+
"auc": 0.9552475339373512
|
| 275 |
+
},
|
| 276 |
+
"original_val_1pct_fpr": {
|
| 277 |
+
"n": 735,
|
| 278 |
+
"positive_count": 292,
|
| 279 |
+
"tp": 272,
|
| 280 |
+
"fp": 92,
|
| 281 |
+
"fn": 20,
|
| 282 |
+
"tn": 351,
|
| 283 |
+
"threshold": -0.7815297361664113,
|
| 284 |
+
"recall": 0.9315068493150684,
|
| 285 |
+
"specificity": 0.7923250564334086,
|
| 286 |
+
"f1": 0.8292682926829268,
|
| 287 |
+
"ap": 0.9445323360591276,
|
| 288 |
+
"auc": 0.9552475339373512
|
| 289 |
+
},
|
| 290 |
+
"combined_val_f1": {
|
| 291 |
+
"n": 735,
|
| 292 |
+
"positive_count": 292,
|
| 293 |
+
"tp": 249,
|
| 294 |
+
"fp": 37,
|
| 295 |
+
"fn": 43,
|
| 296 |
+
"tn": 406,
|
| 297 |
+
"threshold": -0.022361982385277646,
|
| 298 |
+
"recall": 0.8527397260273972,
|
| 299 |
+
"specificity": 0.9164785553047404,
|
| 300 |
+
"f1": 0.8615916955017301,
|
| 301 |
+
"ap": 0.9445323360591276,
|
| 302 |
+
"auc": 0.9552475339373512
|
| 303 |
+
}
|
| 304 |
+
},
|
| 305 |
+
"paired_original_metrics": {
|
| 306 |
+
"original_val_f1": {
|
| 307 |
+
"n": 735,
|
| 308 |
+
"positive_count": 292,
|
| 309 |
+
"tp": 266,
|
| 310 |
+
"fp": 19,
|
| 311 |
+
"fn": 26,
|
| 312 |
+
"tn": 424,
|
| 313 |
+
"threshold": 0.23999364623390296,
|
| 314 |
+
"recall": 0.910958904109589,
|
| 315 |
+
"specificity": 0.9571106094808126,
|
| 316 |
+
"f1": 0.9220103986135182,
|
| 317 |
+
"ap": 0.9813814307925482,
|
| 318 |
+
"auc": 0.9848712081387798
|
| 319 |
+
},
|
| 320 |
+
"original_val_1pct_fpr": {
|
| 321 |
+
"n": 735,
|
| 322 |
+
"positive_count": 292,
|
| 323 |
+
"tp": 280,
|
| 324 |
+
"fp": 54,
|
| 325 |
+
"fn": 12,
|
| 326 |
+
"tn": 389,
|
| 327 |
+
"threshold": -0.7815297361664113,
|
| 328 |
+
"recall": 0.958904109589041,
|
| 329 |
+
"specificity": 0.8781038374717833,
|
| 330 |
+
"f1": 0.8945686900958466,
|
| 331 |
+
"ap": 0.9813814307925482,
|
| 332 |
+
"auc": 0.9848712081387798
|
| 333 |
+
},
|
| 334 |
+
"combined_val_f1": {
|
| 335 |
+
"n": 735,
|
| 336 |
+
"positive_count": 292,
|
| 337 |
+
"tp": 270,
|
| 338 |
+
"fp": 25,
|
| 339 |
+
"fn": 22,
|
| 340 |
+
"tn": 418,
|
| 341 |
+
"threshold": -0.022361982385277646,
|
| 342 |
+
"recall": 0.9246575342465754,
|
| 343 |
+
"specificity": 0.9435665914221218,
|
| 344 |
+
"f1": 0.919931856899489,
|
| 345 |
+
"ap": 0.9813814307925482,
|
| 346 |
+
"auc": 0.9848712081387798
|
| 347 |
+
}
|
| 348 |
+
},
|
| 349 |
+
"decision_changes": {
|
| 350 |
+
"original_val_f1": 69,
|
| 351 |
+
"original_val_1pct_fpr": 92,
|
| 352 |
+
"combined_val_f1": 75
|
| 353 |
+
}
|
| 354 |
+
},
|
| 355 |
+
"paired_bash_quote_command": {
|
| 356 |
+
"over_510_bytes": 0,
|
| 357 |
+
"metrics": {
|
| 358 |
+
"original_val_f1": {
|
| 359 |
+
"n": 724,
|
| 360 |
+
"positive_count": 290,
|
| 361 |
+
"tp": 262,
|
| 362 |
+
"fp": 17,
|
| 363 |
+
"fn": 28,
|
| 364 |
+
"tn": 417,
|
| 365 |
+
"threshold": 0.23999364623390296,
|
| 366 |
+
"recall": 0.903448275862069,
|
| 367 |
+
"specificity": 0.9608294930875576,
|
| 368 |
+
"f1": 0.9209138840070299,
|
| 369 |
+
"ap": 0.9852005836600706,
|
| 370 |
+
"auc": 0.9889400921658986
|
| 371 |
+
},
|
| 372 |
+
"original_val_1pct_fpr": {
|
| 373 |
+
"n": 724,
|
| 374 |
+
"positive_count": 290,
|
| 375 |
+
"tp": 281,
|
| 376 |
+
"fp": 46,
|
| 377 |
+
"fn": 9,
|
| 378 |
+
"tn": 388,
|
| 379 |
+
"threshold": -0.7815297361664113,
|
| 380 |
+
"recall": 0.9689655172413794,
|
| 381 |
+
"specificity": 0.8940092165898618,
|
| 382 |
+
"f1": 0.9108589951377634,
|
| 383 |
+
"ap": 0.9852005836600706,
|
| 384 |
+
"auc": 0.9889400921658986
|
| 385 |
+
},
|
| 386 |
+
"combined_val_f1": {
|
| 387 |
+
"n": 724,
|
| 388 |
+
"positive_count": 290,
|
| 389 |
+
"tp": 267,
|
| 390 |
+
"fp": 25,
|
| 391 |
+
"fn": 23,
|
| 392 |
+
"tn": 409,
|
| 393 |
+
"threshold": -0.022361982385277646,
|
| 394 |
+
"recall": 0.9206896551724137,
|
| 395 |
+
"specificity": 0.9423963133640553,
|
| 396 |
+
"f1": 0.9175257731958762,
|
| 397 |
+
"ap": 0.9852005836600706,
|
| 398 |
+
"auc": 0.9889400921658986
|
| 399 |
+
}
|
| 400 |
+
},
|
| 401 |
+
"paired_original_metrics": {
|
| 402 |
+
"original_val_f1": {
|
| 403 |
+
"n": 724,
|
| 404 |
+
"positive_count": 290,
|
| 405 |
+
"tp": 264,
|
| 406 |
+
"fp": 19,
|
| 407 |
+
"fn": 26,
|
| 408 |
+
"tn": 415,
|
| 409 |
+
"threshold": 0.23999364623390296,
|
| 410 |
+
"recall": 0.9103448275862069,
|
| 411 |
+
"specificity": 0.956221198156682,
|
| 412 |
+
"f1": 0.9214659685863874,
|
| 413 |
+
"ap": 0.9812355568663865,
|
| 414 |
+
"auc": 0.9845781026537422
|
| 415 |
+
},
|
| 416 |
+
"original_val_1pct_fpr": {
|
| 417 |
+
"n": 724,
|
| 418 |
+
"positive_count": 290,
|
| 419 |
+
"tp": 278,
|
| 420 |
+
"fp": 54,
|
| 421 |
+
"fn": 12,
|
| 422 |
+
"tn": 380,
|
| 423 |
+
"threshold": -0.7815297361664113,
|
| 424 |
+
"recall": 0.9586206896551724,
|
| 425 |
+
"specificity": 0.8755760368663594,
|
| 426 |
+
"f1": 0.8938906752411575,
|
| 427 |
+
"ap": 0.9812355568663865,
|
| 428 |
+
"auc": 0.9845781026537422
|
| 429 |
+
},
|
| 430 |
+
"combined_val_f1": {
|
| 431 |
+
"n": 724,
|
| 432 |
+
"positive_count": 290,
|
| 433 |
+
"tp": 268,
|
| 434 |
+
"fp": 25,
|
| 435 |
+
"fn": 22,
|
| 436 |
+
"tn": 409,
|
| 437 |
+
"threshold": -0.022361982385277646,
|
| 438 |
+
"recall": 0.9241379310344827,
|
| 439 |
+
"specificity": 0.9423963133640553,
|
| 440 |
+
"f1": 0.9193825042881647,
|
| 441 |
+
"ap": 0.9812355568663865,
|
| 442 |
+
"auc": 0.9845781026537422
|
| 443 |
+
}
|
| 444 |
+
},
|
| 445 |
+
"decision_changes": {
|
| 446 |
+
"original_val_f1": 18,
|
| 447 |
+
"original_val_1pct_fpr": 33,
|
| 448 |
+
"combined_val_f1": 25
|
| 449 |
+
}
|
| 450 |
+
},
|
| 451 |
+
"commands_cmd": {
|
| 452 |
+
"over_510_bytes": 0,
|
| 453 |
+
"metrics": {
|
| 454 |
+
"original_val_f1": {
|
| 455 |
+
"n": 64,
|
| 456 |
+
"positive_count": 24,
|
| 457 |
+
"tp": 22,
|
| 458 |
+
"fp": 0,
|
| 459 |
+
"fn": 2,
|
| 460 |
+
"tn": 40,
|
| 461 |
+
"threshold": 0.23999364623390296,
|
| 462 |
+
"recall": 0.9166666666666666,
|
| 463 |
+
"specificity": 1.0,
|
| 464 |
+
"f1": 0.9565217391304348,
|
| 465 |
+
"ap": 0.9999999999999999,
|
| 466 |
+
"auc": 1.0
|
| 467 |
+
},
|
| 468 |
+
"original_val_1pct_fpr": {
|
| 469 |
+
"n": 64,
|
| 470 |
+
"positive_count": 24,
|
| 471 |
+
"tp": 24,
|
| 472 |
+
"fp": 0,
|
| 473 |
+
"fn": 0,
|
| 474 |
+
"tn": 40,
|
| 475 |
+
"threshold": -0.7815297361664113,
|
| 476 |
+
"recall": 1.0,
|
| 477 |
+
"specificity": 1.0,
|
| 478 |
+
"f1": 1.0,
|
| 479 |
+
"ap": 0.9999999999999999,
|
| 480 |
+
"auc": 1.0
|
| 481 |
+
},
|
| 482 |
+
"combined_val_f1": {
|
| 483 |
+
"n": 64,
|
| 484 |
+
"positive_count": 24,
|
| 485 |
+
"tp": 23,
|
| 486 |
+
"fp": 0,
|
| 487 |
+
"fn": 1,
|
| 488 |
+
"tn": 40,
|
| 489 |
+
"threshold": -0.022361982385277646,
|
| 490 |
+
"recall": 0.9583333333333334,
|
| 491 |
+
"specificity": 1.0,
|
| 492 |
+
"f1": 0.9787234042553191,
|
| 493 |
+
"ap": 0.9999999999999999,
|
| 494 |
+
"auc": 1.0
|
| 495 |
+
}
|
| 496 |
+
}
|
| 497 |
+
},
|
| 498 |
+
"paired_cmd_caret_command": {
|
| 499 |
+
"over_510_bytes": 0,
|
| 500 |
+
"metrics": {
|
| 501 |
+
"original_val_f1": {
|
| 502 |
+
"n": 57,
|
| 503 |
+
"positive_count": 24,
|
| 504 |
+
"tp": 22,
|
| 505 |
+
"fp": 0,
|
| 506 |
+
"fn": 2,
|
| 507 |
+
"tn": 33,
|
| 508 |
+
"threshold": 0.23999364623390296,
|
| 509 |
+
"recall": 0.9166666666666666,
|
| 510 |
+
"specificity": 1.0,
|
| 511 |
+
"f1": 0.9565217391304348,
|
| 512 |
+
"ap": 0.9965972222222221,
|
| 513 |
+
"auc": 0.9974747474747475
|
| 514 |
+
},
|
| 515 |
+
"original_val_1pct_fpr": {
|
| 516 |
+
"n": 57,
|
| 517 |
+
"positive_count": 24,
|
| 518 |
+
"tp": 24,
|
| 519 |
+
"fp": 1,
|
| 520 |
+
"fn": 0,
|
| 521 |
+
"tn": 32,
|
| 522 |
+
"threshold": -0.7815297361664113,
|
| 523 |
+
"recall": 1.0,
|
| 524 |
+
"specificity": 0.9696969696969697,
|
| 525 |
+
"f1": 0.9795918367346939,
|
| 526 |
+
"ap": 0.9965972222222221,
|
| 527 |
+
"auc": 0.9974747474747475
|
| 528 |
+
},
|
| 529 |
+
"combined_val_f1": {
|
| 530 |
+
"n": 57,
|
| 531 |
+
"positive_count": 24,
|
| 532 |
+
"tp": 22,
|
| 533 |
+
"fp": 0,
|
| 534 |
+
"fn": 2,
|
| 535 |
+
"tn": 33,
|
| 536 |
+
"threshold": -0.022361982385277646,
|
| 537 |
+
"recall": 0.9166666666666666,
|
| 538 |
+
"specificity": 1.0,
|
| 539 |
+
"f1": 0.9565217391304348,
|
| 540 |
+
"ap": 0.9965972222222221,
|
| 541 |
+
"auc": 0.9974747474747475
|
| 542 |
+
}
|
| 543 |
+
},
|
| 544 |
+
"paired_original_metrics": {
|
| 545 |
+
"original_val_f1": {
|
| 546 |
+
"n": 57,
|
| 547 |
+
"positive_count": 24,
|
| 548 |
+
"tp": 22,
|
| 549 |
+
"fp": 0,
|
| 550 |
+
"fn": 2,
|
| 551 |
+
"tn": 33,
|
| 552 |
+
"threshold": 0.23999364623390296,
|
| 553 |
+
"recall": 0.9166666666666666,
|
| 554 |
+
"specificity": 1.0,
|
| 555 |
+
"f1": 0.9565217391304348,
|
| 556 |
+
"ap": 0.9999999999999999,
|
| 557 |
+
"auc": 1.0
|
| 558 |
+
},
|
| 559 |
+
"original_val_1pct_fpr": {
|
| 560 |
+
"n": 57,
|
| 561 |
+
"positive_count": 24,
|
| 562 |
+
"tp": 24,
|
| 563 |
+
"fp": 0,
|
| 564 |
+
"fn": 0,
|
| 565 |
+
"tn": 33,
|
| 566 |
+
"threshold": -0.7815297361664113,
|
| 567 |
+
"recall": 1.0,
|
| 568 |
+
"specificity": 1.0,
|
| 569 |
+
"f1": 1.0,
|
| 570 |
+
"ap": 0.9999999999999999,
|
| 571 |
+
"auc": 1.0
|
| 572 |
+
},
|
| 573 |
+
"combined_val_f1": {
|
| 574 |
+
"n": 57,
|
| 575 |
+
"positive_count": 24,
|
| 576 |
+
"tp": 23,
|
| 577 |
+
"fp": 0,
|
| 578 |
+
"fn": 1,
|
| 579 |
+
"tn": 33,
|
| 580 |
+
"threshold": -0.022361982385277646,
|
| 581 |
+
"recall": 0.9583333333333334,
|
| 582 |
+
"specificity": 1.0,
|
| 583 |
+
"f1": 0.9787234042553191,
|
| 584 |
+
"ap": 0.9999999999999999,
|
| 585 |
+
"auc": 1.0
|
| 586 |
+
}
|
| 587 |
+
},
|
| 588 |
+
"decision_changes": {
|
| 589 |
+
"original_val_f1": 0,
|
| 590 |
+
"original_val_1pct_fpr": 1,
|
| 591 |
+
"combined_val_f1": 1
|
| 592 |
+
}
|
| 593 |
+
},
|
| 594 |
+
"commands_posix_explicit_harm_audit": {
|
| 595 |
+
"over_510_bytes": 0,
|
| 596 |
+
"metrics": {
|
| 597 |
+
"original_val_f1": {
|
| 598 |
+
"n": 551,
|
| 599 |
+
"positive_count": 108,
|
| 600 |
+
"tp": 100,
|
| 601 |
+
"fp": 19,
|
| 602 |
+
"fn": 8,
|
| 603 |
+
"tn": 424,
|
| 604 |
+
"threshold": 0.23999364623390296,
|
| 605 |
+
"recall": 0.9259259259259259,
|
| 606 |
+
"specificity": 0.9571106094808126,
|
| 607 |
+
"f1": 0.8810572687224669,
|
| 608 |
+
"ap": 0.9684925357047942,
|
| 609 |
+
"auc": 0.9862887718418193
|
| 610 |
+
},
|
| 611 |
+
"original_val_1pct_fpr": {
|
| 612 |
+
"n": 551,
|
| 613 |
+
"positive_count": 108,
|
| 614 |
+
"tp": 102,
|
| 615 |
+
"fp": 54,
|
| 616 |
+
"fn": 6,
|
| 617 |
+
"tn": 389,
|
| 618 |
+
"threshold": -0.7815297361664113,
|
| 619 |
+
"recall": 0.9444444444444444,
|
| 620 |
+
"specificity": 0.8781038374717833,
|
| 621 |
+
"f1": 0.7727272727272727,
|
| 622 |
+
"ap": 0.9684925357047942,
|
| 623 |
+
"auc": 0.9862887718418193
|
| 624 |
+
},
|
| 625 |
+
"combined_val_f1": {
|
| 626 |
+
"n": 551,
|
| 627 |
+
"positive_count": 108,
|
| 628 |
+
"tp": 101,
|
| 629 |
+
"fp": 25,
|
| 630 |
+
"fn": 7,
|
| 631 |
+
"tn": 418,
|
| 632 |
+
"threshold": -0.022361982385277646,
|
| 633 |
+
"recall": 0.9351851851851852,
|
| 634 |
+
"specificity": 0.9435665914221218,
|
| 635 |
+
"f1": 0.8632478632478633,
|
| 636 |
+
"ap": 0.9684925357047942,
|
| 637 |
+
"auc": 0.9862887718418193
|
| 638 |
+
}
|
| 639 |
+
}
|
| 640 |
+
},
|
| 641 |
+
"commands_powershell_explicit_harm_audit": {
|
| 642 |
+
"over_510_bytes": 0,
|
| 643 |
+
"metrics": {
|
| 644 |
+
"original_val_f1": {
|
| 645 |
+
"n": 84,
|
| 646 |
+
"positive_count": 23,
|
| 647 |
+
"tp": 23,
|
| 648 |
+
"fp": 0,
|
| 649 |
+
"fn": 0,
|
| 650 |
+
"tn": 61,
|
| 651 |
+
"threshold": 0.23999364623390296,
|
| 652 |
+
"recall": 1.0,
|
| 653 |
+
"specificity": 1.0,
|
| 654 |
+
"f1": 1.0,
|
| 655 |
+
"ap": 0.9999999999999998,
|
| 656 |
+
"auc": 1.0
|
| 657 |
+
},
|
| 658 |
+
"original_val_1pct_fpr": {
|
| 659 |
+
"n": 84,
|
| 660 |
+
"positive_count": 23,
|
| 661 |
+
"tp": 23,
|
| 662 |
+
"fp": 2,
|
| 663 |
+
"fn": 0,
|
| 664 |
+
"tn": 59,
|
| 665 |
+
"threshold": -0.7815297361664113,
|
| 666 |
+
"recall": 1.0,
|
| 667 |
+
"specificity": 0.9672131147540983,
|
| 668 |
+
"f1": 0.9583333333333334,
|
| 669 |
+
"ap": 0.9999999999999998,
|
| 670 |
+
"auc": 1.0
|
| 671 |
+
},
|
| 672 |
+
"combined_val_f1": {
|
| 673 |
+
"n": 84,
|
| 674 |
+
"positive_count": 23,
|
| 675 |
+
"tp": 23,
|
| 676 |
+
"fp": 1,
|
| 677 |
+
"fn": 0,
|
| 678 |
+
"tn": 60,
|
| 679 |
+
"threshold": -0.022361982385277646,
|
| 680 |
+
"recall": 1.0,
|
| 681 |
+
"specificity": 0.9836065573770492,
|
| 682 |
+
"f1": 0.9787234042553191,
|
| 683 |
+
"ap": 0.9999999999999998,
|
| 684 |
+
"auc": 1.0
|
| 685 |
+
}
|
| 686 |
+
}
|
| 687 |
+
},
|
| 688 |
+
"commands_cmd_explicit_harm_audit": {
|
| 689 |
+
"over_510_bytes": 0,
|
| 690 |
+
"metrics": {
|
| 691 |
+
"original_val_f1": {
|
| 692 |
+
"n": 50,
|
| 693 |
+
"positive_count": 10,
|
| 694 |
+
"tp": 9,
|
| 695 |
+
"fp": 0,
|
| 696 |
+
"fn": 1,
|
| 697 |
+
"tn": 40,
|
| 698 |
+
"threshold": 0.23999364623390296,
|
| 699 |
+
"recall": 0.9,
|
| 700 |
+
"specificity": 1.0,
|
| 701 |
+
"f1": 0.9473684210526315,
|
| 702 |
+
"ap": 1.0,
|
| 703 |
+
"auc": 1.0
|
| 704 |
+
},
|
| 705 |
+
"original_val_1pct_fpr": {
|
| 706 |
+
"n": 50,
|
| 707 |
+
"positive_count": 10,
|
| 708 |
+
"tp": 10,
|
| 709 |
+
"fp": 0,
|
| 710 |
+
"fn": 0,
|
| 711 |
+
"tn": 40,
|
| 712 |
+
"threshold": -0.7815297361664113,
|
| 713 |
+
"recall": 1.0,
|
| 714 |
+
"specificity": 1.0,
|
| 715 |
+
"f1": 1.0,
|
| 716 |
+
"ap": 1.0,
|
| 717 |
+
"auc": 1.0
|
| 718 |
+
},
|
| 719 |
+
"combined_val_f1": {
|
| 720 |
+
"n": 50,
|
| 721 |
+
"positive_count": 10,
|
| 722 |
+
"tp": 10,
|
| 723 |
+
"fp": 0,
|
| 724 |
+
"fn": 0,
|
| 725 |
+
"tn": 40,
|
| 726 |
+
"threshold": -0.022361982385277646,
|
| 727 |
+
"recall": 1.0,
|
| 728 |
+
"specificity": 1.0,
|
| 729 |
+
"f1": 1.0,
|
| 730 |
+
"ap": 1.0,
|
| 731 |
+
"auc": 1.0
|
| 732 |
+
}
|
| 733 |
+
}
|
| 734 |
+
},
|
| 735 |
+
"powershell_scripts": {
|
| 736 |
+
"over_510_bytes": 2000,
|
| 737 |
+
"metrics": {
|
| 738 |
+
"original_val_f1": {
|
| 739 |
+
"n": 2000,
|
| 740 |
+
"positive_count": 1000,
|
| 741 |
+
"tp": 961,
|
| 742 |
+
"fp": 28,
|
| 743 |
+
"fn": 39,
|
| 744 |
+
"tn": 972,
|
| 745 |
+
"threshold": 0.23999364623390296,
|
| 746 |
+
"recall": 0.961,
|
| 747 |
+
"specificity": 0.972,
|
| 748 |
+
"f1": 0.9663147310206134,
|
| 749 |
+
"ap": 0.9950698156102049,
|
| 750 |
+
"auc": 0.994873
|
| 751 |
+
},
|
| 752 |
+
"original_val_1pct_fpr": {
|
| 753 |
+
"n": 2000,
|
| 754 |
+
"positive_count": 1000,
|
| 755 |
+
"tp": 982,
|
| 756 |
+
"fp": 52,
|
| 757 |
+
"fn": 18,
|
| 758 |
+
"tn": 948,
|
| 759 |
+
"threshold": -0.7815297361664113,
|
| 760 |
+
"recall": 0.982,
|
| 761 |
+
"specificity": 0.948,
|
| 762 |
+
"f1": 0.9655850540806293,
|
| 763 |
+
"ap": 0.9950698156102049,
|
| 764 |
+
"auc": 0.994873
|
| 765 |
+
},
|
| 766 |
+
"combined_val_f1": {
|
| 767 |
+
"n": 2000,
|
| 768 |
+
"positive_count": 1000,
|
| 769 |
+
"tp": 967,
|
| 770 |
+
"fp": 34,
|
| 771 |
+
"fn": 33,
|
| 772 |
+
"tn": 966,
|
| 773 |
+
"threshold": -0.022361982385277646,
|
| 774 |
+
"recall": 0.967,
|
| 775 |
+
"specificity": 0.966,
|
| 776 |
+
"f1": 0.9665167416291854,
|
| 777 |
+
"ap": 0.9950698156102049,
|
| 778 |
+
"auc": 0.994873
|
| 779 |
+
}
|
| 780 |
+
},
|
| 781 |
+
"linear_prefix510_metrics": {
|
| 782 |
+
"original_val_f1": {
|
| 783 |
+
"n": 2000,
|
| 784 |
+
"positive_count": 1000,
|
| 785 |
+
"tp": 753,
|
| 786 |
+
"fp": 223,
|
| 787 |
+
"fn": 247,
|
| 788 |
+
"tn": 777,
|
| 789 |
+
"threshold": 0.23999364623390296,
|
| 790 |
+
"recall": 0.753,
|
| 791 |
+
"specificity": 0.777,
|
| 792 |
+
"f1": 0.7621457489878543,
|
| 793 |
+
"ap": 0.8763817908324397,
|
| 794 |
+
"auc": 0.844846
|
| 795 |
+
},
|
| 796 |
+
"original_val_1pct_fpr": {
|
| 797 |
+
"n": 2000,
|
| 798 |
+
"positive_count": 1000,
|
| 799 |
+
"tp": 837,
|
| 800 |
+
"fp": 391,
|
| 801 |
+
"fn": 163,
|
| 802 |
+
"tn": 609,
|
| 803 |
+
"threshold": -0.7815297361664113,
|
| 804 |
+
"recall": 0.837,
|
| 805 |
+
"specificity": 0.609,
|
| 806 |
+
"f1": 0.751346499102334,
|
| 807 |
+
"ap": 0.8763817908324397,
|
| 808 |
+
"auc": 0.844846
|
| 809 |
+
},
|
| 810 |
+
"combined_val_f1": {
|
| 811 |
+
"n": 2000,
|
| 812 |
+
"positive_count": 1000,
|
| 813 |
+
"tp": 776,
|
| 814 |
+
"fp": 267,
|
| 815 |
+
"fn": 224,
|
| 816 |
+
"tn": 733,
|
| 817 |
+
"threshold": -0.022361982385277646,
|
| 818 |
+
"recall": 0.776,
|
| 819 |
+
"specificity": 0.733,
|
| 820 |
+
"f1": 0.759667156142927,
|
| 821 |
+
"ap": 0.8763817908324397,
|
| 822 |
+
"auc": 0.844846
|
| 823 |
+
}
|
| 824 |
+
}
|
| 825 |
+
},
|
| 826 |
+
"powershell_scripts_long": {
|
| 827 |
+
"over_510_bytes": 2000,
|
| 828 |
+
"metrics": {
|
| 829 |
+
"original_val_f1": {
|
| 830 |
+
"n": 2000,
|
| 831 |
+
"positive_count": 1000,
|
| 832 |
+
"tp": 961,
|
| 833 |
+
"fp": 28,
|
| 834 |
+
"fn": 39,
|
| 835 |
+
"tn": 972,
|
| 836 |
+
"threshold": 0.23999364623390296,
|
| 837 |
+
"recall": 0.961,
|
| 838 |
+
"specificity": 0.972,
|
| 839 |
+
"f1": 0.9663147310206134,
|
| 840 |
+
"ap": 0.9950698156102049,
|
| 841 |
+
"auc": 0.994873
|
| 842 |
+
},
|
| 843 |
+
"original_val_1pct_fpr": {
|
| 844 |
+
"n": 2000,
|
| 845 |
+
"positive_count": 1000,
|
| 846 |
+
"tp": 982,
|
| 847 |
+
"fp": 52,
|
| 848 |
+
"fn": 18,
|
| 849 |
+
"tn": 948,
|
| 850 |
+
"threshold": -0.7815297361664113,
|
| 851 |
+
"recall": 0.982,
|
| 852 |
+
"specificity": 0.948,
|
| 853 |
+
"f1": 0.9655850540806293,
|
| 854 |
+
"ap": 0.9950698156102049,
|
| 855 |
+
"auc": 0.994873
|
| 856 |
+
},
|
| 857 |
+
"combined_val_f1": {
|
| 858 |
+
"n": 2000,
|
| 859 |
+
"positive_count": 1000,
|
| 860 |
+
"tp": 967,
|
| 861 |
+
"fp": 34,
|
| 862 |
+
"fn": 33,
|
| 863 |
+
"tn": 966,
|
| 864 |
+
"threshold": -0.022361982385277646,
|
| 865 |
+
"recall": 0.967,
|
| 866 |
+
"specificity": 0.966,
|
| 867 |
+
"f1": 0.9665167416291854,
|
| 868 |
+
"ap": 0.9950698156102049,
|
| 869 |
+
"auc": 0.994873
|
| 870 |
+
}
|
| 871 |
+
},
|
| 872 |
+
"linear_prefix510_metrics": {
|
| 873 |
+
"original_val_f1": {
|
| 874 |
+
"n": 2000,
|
| 875 |
+
"positive_count": 1000,
|
| 876 |
+
"tp": 753,
|
| 877 |
+
"fp": 223,
|
| 878 |
+
"fn": 247,
|
| 879 |
+
"tn": 777,
|
| 880 |
+
"threshold": 0.23999364623390296,
|
| 881 |
+
"recall": 0.753,
|
| 882 |
+
"specificity": 0.777,
|
| 883 |
+
"f1": 0.7621457489878543,
|
| 884 |
+
"ap": 0.8763817908324397,
|
| 885 |
+
"auc": 0.844846
|
| 886 |
+
},
|
| 887 |
+
"original_val_1pct_fpr": {
|
| 888 |
+
"n": 2000,
|
| 889 |
+
"positive_count": 1000,
|
| 890 |
+
"tp": 837,
|
| 891 |
+
"fp": 391,
|
| 892 |
+
"fn": 163,
|
| 893 |
+
"tn": 609,
|
| 894 |
+
"threshold": -0.7815297361664113,
|
| 895 |
+
"recall": 0.837,
|
| 896 |
+
"specificity": 0.609,
|
| 897 |
+
"f1": 0.751346499102334,
|
| 898 |
+
"ap": 0.8763817908324397,
|
| 899 |
+
"auc": 0.844846
|
| 900 |
+
},
|
| 901 |
+
"combined_val_f1": {
|
| 902 |
+
"n": 2000,
|
| 903 |
+
"positive_count": 1000,
|
| 904 |
+
"tp": 776,
|
| 905 |
+
"fp": 267,
|
| 906 |
+
"fn": 224,
|
| 907 |
+
"tn": 733,
|
| 908 |
+
"threshold": -0.022361982385277646,
|
| 909 |
+
"recall": 0.776,
|
| 910 |
+
"specificity": 0.733,
|
| 911 |
+
"f1": 0.759667156142927,
|
| 912 |
+
"ap": 0.8763817908324397,
|
| 913 |
+
"auc": 0.844846
|
| 914 |
+
}
|
| 915 |
+
}
|
| 916 |
+
},
|
| 917 |
+
"powershell_scripts_encoding_markers": {
|
| 918 |
+
"over_510_bytes": 884,
|
| 919 |
+
"metrics": {
|
| 920 |
+
"original_val_f1": {
|
| 921 |
+
"n": 884,
|
| 922 |
+
"positive_count": 739,
|
| 923 |
+
"tp": 720,
|
| 924 |
+
"fp": 6,
|
| 925 |
+
"fn": 19,
|
| 926 |
+
"tn": 139,
|
| 927 |
+
"threshold": 0.23999364623390296,
|
| 928 |
+
"recall": 0.9742895805142084,
|
| 929 |
+
"specificity": 0.9586206896551724,
|
| 930 |
+
"f1": 0.9829351535836177,
|
| 931 |
+
"ap": 0.9989178392165023,
|
| 932 |
+
"auc": 0.9945872801082545
|
| 933 |
+
},
|
| 934 |
+
"original_val_1pct_fpr": {
|
| 935 |
+
"n": 884,
|
| 936 |
+
"positive_count": 739,
|
| 937 |
+
"tp": 730,
|
| 938 |
+
"fp": 9,
|
| 939 |
+
"fn": 9,
|
| 940 |
+
"tn": 136,
|
| 941 |
+
"threshold": -0.7815297361664113,
|
| 942 |
+
"recall": 0.9878213802435724,
|
| 943 |
+
"specificity": 0.9379310344827586,
|
| 944 |
+
"f1": 0.9878213802435724,
|
| 945 |
+
"ap": 0.9989178392165023,
|
| 946 |
+
"auc": 0.9945872801082545
|
| 947 |
+
},
|
| 948 |
+
"combined_val_f1": {
|
| 949 |
+
"n": 884,
|
| 950 |
+
"positive_count": 739,
|
| 951 |
+
"tp": 723,
|
| 952 |
+
"fp": 6,
|
| 953 |
+
"fn": 16,
|
| 954 |
+
"tn": 139,
|
| 955 |
+
"threshold": -0.022361982385277646,
|
| 956 |
+
"recall": 0.9783491204330176,
|
| 957 |
+
"specificity": 0.9586206896551724,
|
| 958 |
+
"f1": 0.9850136239782016,
|
| 959 |
+
"ap": 0.9989178392165023,
|
| 960 |
+
"auc": 0.9945872801082545
|
| 961 |
+
}
|
| 962 |
+
},
|
| 963 |
+
"linear_prefix510_metrics": {
|
| 964 |
+
"original_val_f1": {
|
| 965 |
+
"n": 884,
|
| 966 |
+
"positive_count": 739,
|
| 967 |
+
"tp": 583,
|
| 968 |
+
"fp": 33,
|
| 969 |
+
"fn": 156,
|
| 970 |
+
"tn": 112,
|
| 971 |
+
"threshold": 0.23999364623390296,
|
| 972 |
+
"recall": 0.7889039242219216,
|
| 973 |
+
"specificity": 0.7724137931034483,
|
| 974 |
+
"f1": 0.8605166051660517,
|
| 975 |
+
"ap": 0.9667470111695307,
|
| 976 |
+
"auc": 0.8452802015771547
|
| 977 |
+
},
|
| 978 |
+
"original_val_1pct_fpr": {
|
| 979 |
+
"n": 884,
|
| 980 |
+
"positive_count": 739,
|
| 981 |
+
"tp": 625,
|
| 982 |
+
"fp": 52,
|
| 983 |
+
"fn": 114,
|
| 984 |
+
"tn": 93,
|
| 985 |
+
"threshold": -0.7815297361664113,
|
| 986 |
+
"recall": 0.8457374830852503,
|
| 987 |
+
"specificity": 0.6413793103448275,
|
| 988 |
+
"f1": 0.882768361581921,
|
| 989 |
+
"ap": 0.9667470111695307,
|
| 990 |
+
"auc": 0.8452802015771547
|
| 991 |
+
},
|
| 992 |
+
"combined_val_f1": {
|
| 993 |
+
"n": 884,
|
| 994 |
+
"positive_count": 739,
|
| 995 |
+
"tp": 595,
|
| 996 |
+
"fp": 45,
|
| 997 |
+
"fn": 144,
|
| 998 |
+
"tn": 100,
|
| 999 |
+
"threshold": -0.022361982385277646,
|
| 1000 |
+
"recall": 0.8051420838971584,
|
| 1001 |
+
"specificity": 0.6896551724137931,
|
| 1002 |
+
"f1": 0.8629441624365483,
|
| 1003 |
+
"ap": 0.9667470111695307,
|
| 1004 |
+
"auc": 0.8452802015771547
|
| 1005 |
+
}
|
| 1006 |
+
}
|
| 1007 |
+
},
|
| 1008 |
+
"paired_powershell_utf16_base64_both_fit_510": {
|
| 1009 |
+
"over_510_bytes": 0,
|
| 1010 |
+
"metrics": {
|
| 1011 |
+
"original_val_f1": {
|
| 1012 |
+
"n": 118,
|
| 1013 |
+
"positive_count": 57,
|
| 1014 |
+
"tp": 55,
|
| 1015 |
+
"fp": 4,
|
| 1016 |
+
"fn": 2,
|
| 1017 |
+
"tn": 57,
|
| 1018 |
+
"threshold": 0.23999364623390296,
|
| 1019 |
+
"recall": 0.9649122807017544,
|
| 1020 |
+
"specificity": 0.9344262295081968,
|
| 1021 |
+
"f1": 0.9482758620689655,
|
| 1022 |
+
"ap": 0.9904989033481227,
|
| 1023 |
+
"auc": 0.990796663790624
|
| 1024 |
+
},
|
| 1025 |
+
"original_val_1pct_fpr": {
|
| 1026 |
+
"n": 118,
|
| 1027 |
+
"positive_count": 57,
|
| 1028 |
+
"tp": 57,
|
| 1029 |
+
"fp": 9,
|
| 1030 |
+
"fn": 0,
|
| 1031 |
+
"tn": 52,
|
| 1032 |
+
"threshold": -0.7815297361664113,
|
| 1033 |
+
"recall": 1.0,
|
| 1034 |
+
"specificity": 0.8524590163934426,
|
| 1035 |
+
"f1": 0.926829268292683,
|
| 1036 |
+
"ap": 0.9904989033481227,
|
| 1037 |
+
"auc": 0.990796663790624
|
| 1038 |
+
},
|
| 1039 |
+
"combined_val_f1": {
|
| 1040 |
+
"n": 118,
|
| 1041 |
+
"positive_count": 57,
|
| 1042 |
+
"tp": 55,
|
| 1043 |
+
"fp": 5,
|
| 1044 |
+
"fn": 2,
|
| 1045 |
+
"tn": 56,
|
| 1046 |
+
"threshold": -0.022361982385277646,
|
| 1047 |
+
"recall": 0.9649122807017544,
|
| 1048 |
+
"specificity": 0.9180327868852459,
|
| 1049 |
+
"f1": 0.9401709401709402,
|
| 1050 |
+
"ap": 0.9904989033481227,
|
| 1051 |
+
"auc": 0.990796663790624
|
| 1052 |
+
}
|
| 1053 |
+
},
|
| 1054 |
+
"paired_original_metrics": {
|
| 1055 |
+
"original_val_f1": {
|
| 1056 |
+
"n": 118,
|
| 1057 |
+
"positive_count": 57,
|
| 1058 |
+
"tp": 56,
|
| 1059 |
+
"fp": 0,
|
| 1060 |
+
"fn": 1,
|
| 1061 |
+
"tn": 61,
|
| 1062 |
+
"threshold": 0.23999364623390296,
|
| 1063 |
+
"recall": 0.9824561403508771,
|
| 1064 |
+
"specificity": 1.0,
|
| 1065 |
+
"f1": 0.9911504424778761,
|
| 1066 |
+
"ap": 0.9996975196612221,
|
| 1067 |
+
"auc": 0.9997123957434569
|
| 1068 |
+
},
|
| 1069 |
+
"original_val_1pct_fpr": {
|
| 1070 |
+
"n": 118,
|
| 1071 |
+
"positive_count": 57,
|
| 1072 |
+
"tp": 57,
|
| 1073 |
+
"fp": 2,
|
| 1074 |
+
"fn": 0,
|
| 1075 |
+
"tn": 59,
|
| 1076 |
+
"threshold": -0.7815297361664113,
|
| 1077 |
+
"recall": 1.0,
|
| 1078 |
+
"specificity": 0.9672131147540983,
|
| 1079 |
+
"f1": 0.9827586206896551,
|
| 1080 |
+
"ap": 0.9996975196612221,
|
| 1081 |
+
"auc": 0.9997123957434569
|
| 1082 |
+
},
|
| 1083 |
+
"combined_val_f1": {
|
| 1084 |
+
"n": 118,
|
| 1085 |
+
"positive_count": 57,
|
| 1086 |
+
"tp": 56,
|
| 1087 |
+
"fp": 1,
|
| 1088 |
+
"fn": 1,
|
| 1089 |
+
"tn": 60,
|
| 1090 |
+
"threshold": -0.022361982385277646,
|
| 1091 |
+
"recall": 0.9824561403508771,
|
| 1092 |
+
"specificity": 0.9836065573770492,
|
| 1093 |
+
"f1": 0.9824561403508771,
|
| 1094 |
+
"ap": 0.9996975196612221,
|
| 1095 |
+
"auc": 0.9997123957434569
|
| 1096 |
+
}
|
| 1097 |
+
},
|
| 1098 |
+
"decision_changes": {
|
| 1099 |
+
"original_val_f1": 7,
|
| 1100 |
+
"original_val_1pct_fpr": 7,
|
| 1101 |
+
"combined_val_f1": 7
|
| 1102 |
+
}
|
| 1103 |
+
},
|
| 1104 |
+
"paired_bash_base64_wrapper_both_fit_510": {
|
| 1105 |
+
"over_510_bytes": 0,
|
| 1106 |
+
"metrics": {
|
| 1107 |
+
"original_val_f1": {
|
| 1108 |
+
"n": 733,
|
| 1109 |
+
"positive_count": 291,
|
| 1110 |
+
"tp": 243,
|
| 1111 |
+
"fp": 26,
|
| 1112 |
+
"fn": 48,
|
| 1113 |
+
"tn": 416,
|
| 1114 |
+
"threshold": 0.23999364623390296,
|
| 1115 |
+
"recall": 0.8350515463917526,
|
| 1116 |
+
"specificity": 0.9411764705882353,
|
| 1117 |
+
"f1": 0.8678571428571429,
|
| 1118 |
+
"ap": 0.9441685715918001,
|
| 1119 |
+
"auc": 0.9550154716922454
|
| 1120 |
+
},
|
| 1121 |
+
"original_val_1pct_fpr": {
|
| 1122 |
+
"n": 733,
|
| 1123 |
+
"positive_count": 291,
|
| 1124 |
+
"tp": 271,
|
| 1125 |
+
"fp": 92,
|
| 1126 |
+
"fn": 20,
|
| 1127 |
+
"tn": 350,
|
| 1128 |
+
"threshold": -0.7815297361664113,
|
| 1129 |
+
"recall": 0.9312714776632303,
|
| 1130 |
+
"specificity": 0.7918552036199095,
|
| 1131 |
+
"f1": 0.8287461773700305,
|
| 1132 |
+
"ap": 0.9441685715918001,
|
| 1133 |
+
"auc": 0.9550154716922454
|
| 1134 |
+
},
|
| 1135 |
+
"combined_val_f1": {
|
| 1136 |
+
"n": 733,
|
| 1137 |
+
"positive_count": 291,
|
| 1138 |
+
"tp": 248,
|
| 1139 |
+
"fp": 37,
|
| 1140 |
+
"fn": 43,
|
| 1141 |
+
"tn": 405,
|
| 1142 |
+
"threshold": -0.022361982385277646,
|
| 1143 |
+
"recall": 0.852233676975945,
|
| 1144 |
+
"specificity": 0.916289592760181,
|
| 1145 |
+
"f1": 0.8611111111111112,
|
| 1146 |
+
"ap": 0.9441685715918001,
|
| 1147 |
+
"auc": 0.9550154716922454
|
| 1148 |
+
}
|
| 1149 |
+
},
|
| 1150 |
+
"paired_original_metrics": {
|
| 1151 |
+
"original_val_f1": {
|
| 1152 |
+
"n": 733,
|
| 1153 |
+
"positive_count": 291,
|
| 1154 |
+
"tp": 265,
|
| 1155 |
+
"fp": 19,
|
| 1156 |
+
"fn": 26,
|
| 1157 |
+
"tn": 423,
|
| 1158 |
+
"threshold": 0.23999364623390296,
|
| 1159 |
+
"recall": 0.9106529209621993,
|
| 1160 |
+
"specificity": 0.9570135746606335,
|
| 1161 |
+
"f1": 0.9217391304347826,
|
| 1162 |
+
"ap": 0.9812704589496276,
|
| 1163 |
+
"auc": 0.9848004229447528
|
| 1164 |
+
},
|
| 1165 |
+
"original_val_1pct_fpr": {
|
| 1166 |
+
"n": 733,
|
| 1167 |
+
"positive_count": 291,
|
| 1168 |
+
"tp": 279,
|
| 1169 |
+
"fp": 54,
|
| 1170 |
+
"fn": 12,
|
| 1171 |
+
"tn": 388,
|
| 1172 |
+
"threshold": -0.7815297361664113,
|
| 1173 |
+
"recall": 0.9587628865979382,
|
| 1174 |
+
"specificity": 0.8778280542986425,
|
| 1175 |
+
"f1": 0.8942307692307693,
|
| 1176 |
+
"ap": 0.9812704589496276,
|
| 1177 |
+
"auc": 0.9848004229447528
|
| 1178 |
+
},
|
| 1179 |
+
"combined_val_f1": {
|
| 1180 |
+
"n": 733,
|
| 1181 |
+
"positive_count": 291,
|
| 1182 |
+
"tp": 269,
|
| 1183 |
+
"fp": 25,
|
| 1184 |
+
"fn": 22,
|
| 1185 |
+
"tn": 417,
|
| 1186 |
+
"threshold": -0.022361982385277646,
|
| 1187 |
+
"recall": 0.9243986254295533,
|
| 1188 |
+
"specificity": 0.9434389140271493,
|
| 1189 |
+
"f1": 0.9196581196581196,
|
| 1190 |
+
"ap": 0.9812704589496276,
|
| 1191 |
+
"auc": 0.9848004229447528
|
| 1192 |
+
}
|
| 1193 |
+
},
|
| 1194 |
+
"decision_changes": {
|
| 1195 |
+
"original_val_f1": 69,
|
| 1196 |
+
"original_val_1pct_fpr": 92,
|
| 1197 |
+
"combined_val_f1": 75
|
| 1198 |
+
}
|
| 1199 |
+
},
|
| 1200 |
+
"paired_bash_quote_command_both_fit_510": {
|
| 1201 |
+
"over_510_bytes": 0,
|
| 1202 |
+
"metrics": {
|
| 1203 |
+
"original_val_f1": {
|
| 1204 |
+
"n": 724,
|
| 1205 |
+
"positive_count": 290,
|
| 1206 |
+
"tp": 262,
|
| 1207 |
+
"fp": 17,
|
| 1208 |
+
"fn": 28,
|
| 1209 |
+
"tn": 417,
|
| 1210 |
+
"threshold": 0.23999364623390296,
|
| 1211 |
+
"recall": 0.903448275862069,
|
| 1212 |
+
"specificity": 0.9608294930875576,
|
| 1213 |
+
"f1": 0.9209138840070299,
|
| 1214 |
+
"ap": 0.9852005836600706,
|
| 1215 |
+
"auc": 0.9889400921658986
|
| 1216 |
+
},
|
| 1217 |
+
"original_val_1pct_fpr": {
|
| 1218 |
+
"n": 724,
|
| 1219 |
+
"positive_count": 290,
|
| 1220 |
+
"tp": 281,
|
| 1221 |
+
"fp": 46,
|
| 1222 |
+
"fn": 9,
|
| 1223 |
+
"tn": 388,
|
| 1224 |
+
"threshold": -0.7815297361664113,
|
| 1225 |
+
"recall": 0.9689655172413794,
|
| 1226 |
+
"specificity": 0.8940092165898618,
|
| 1227 |
+
"f1": 0.9108589951377634,
|
| 1228 |
+
"ap": 0.9852005836600706,
|
| 1229 |
+
"auc": 0.9889400921658986
|
| 1230 |
+
},
|
| 1231 |
+
"combined_val_f1": {
|
| 1232 |
+
"n": 724,
|
| 1233 |
+
"positive_count": 290,
|
| 1234 |
+
"tp": 267,
|
| 1235 |
+
"fp": 25,
|
| 1236 |
+
"fn": 23,
|
| 1237 |
+
"tn": 409,
|
| 1238 |
+
"threshold": -0.022361982385277646,
|
| 1239 |
+
"recall": 0.9206896551724137,
|
| 1240 |
+
"specificity": 0.9423963133640553,
|
| 1241 |
+
"f1": 0.9175257731958762,
|
| 1242 |
+
"ap": 0.9852005836600706,
|
| 1243 |
+
"auc": 0.9889400921658986
|
| 1244 |
+
}
|
| 1245 |
+
},
|
| 1246 |
+
"paired_original_metrics": {
|
| 1247 |
+
"original_val_f1": {
|
| 1248 |
+
"n": 724,
|
| 1249 |
+
"positive_count": 290,
|
| 1250 |
+
"tp": 264,
|
| 1251 |
+
"fp": 19,
|
| 1252 |
+
"fn": 26,
|
| 1253 |
+
"tn": 415,
|
| 1254 |
+
"threshold": 0.23999364623390296,
|
| 1255 |
+
"recall": 0.9103448275862069,
|
| 1256 |
+
"specificity": 0.956221198156682,
|
| 1257 |
+
"f1": 0.9214659685863874,
|
| 1258 |
+
"ap": 0.9812355568663865,
|
| 1259 |
+
"auc": 0.9845781026537422
|
| 1260 |
+
},
|
| 1261 |
+
"original_val_1pct_fpr": {
|
| 1262 |
+
"n": 724,
|
| 1263 |
+
"positive_count": 290,
|
| 1264 |
+
"tp": 278,
|
| 1265 |
+
"fp": 54,
|
| 1266 |
+
"fn": 12,
|
| 1267 |
+
"tn": 380,
|
| 1268 |
+
"threshold": -0.7815297361664113,
|
| 1269 |
+
"recall": 0.9586206896551724,
|
| 1270 |
+
"specificity": 0.8755760368663594,
|
| 1271 |
+
"f1": 0.8938906752411575,
|
| 1272 |
+
"ap": 0.9812355568663865,
|
| 1273 |
+
"auc": 0.9845781026537422
|
| 1274 |
+
},
|
| 1275 |
+
"combined_val_f1": {
|
| 1276 |
+
"n": 724,
|
| 1277 |
+
"positive_count": 290,
|
| 1278 |
+
"tp": 268,
|
| 1279 |
+
"fp": 25,
|
| 1280 |
+
"fn": 22,
|
| 1281 |
+
"tn": 409,
|
| 1282 |
+
"threshold": -0.022361982385277646,
|
| 1283 |
+
"recall": 0.9241379310344827,
|
| 1284 |
+
"specificity": 0.9423963133640553,
|
| 1285 |
+
"f1": 0.9193825042881647,
|
| 1286 |
+
"ap": 0.9812355568663865,
|
| 1287 |
+
"auc": 0.9845781026537422
|
| 1288 |
+
}
|
| 1289 |
+
},
|
| 1290 |
+
"decision_changes": {
|
| 1291 |
+
"original_val_f1": 18,
|
| 1292 |
+
"original_val_1pct_fpr": 33,
|
| 1293 |
+
"combined_val_f1": 25
|
| 1294 |
+
}
|
| 1295 |
+
},
|
| 1296 |
+
"paired_cmd_caret_command_both_fit_510": {
|
| 1297 |
+
"over_510_bytes": 0,
|
| 1298 |
+
"metrics": {
|
| 1299 |
+
"original_val_f1": {
|
| 1300 |
+
"n": 57,
|
| 1301 |
+
"positive_count": 24,
|
| 1302 |
+
"tp": 22,
|
| 1303 |
+
"fp": 0,
|
| 1304 |
+
"fn": 2,
|
| 1305 |
+
"tn": 33,
|
| 1306 |
+
"threshold": 0.23999364623390296,
|
| 1307 |
+
"recall": 0.9166666666666666,
|
| 1308 |
+
"specificity": 1.0,
|
| 1309 |
+
"f1": 0.9565217391304348,
|
| 1310 |
+
"ap": 0.9965972222222221,
|
| 1311 |
+
"auc": 0.9974747474747475
|
| 1312 |
+
},
|
| 1313 |
+
"original_val_1pct_fpr": {
|
| 1314 |
+
"n": 57,
|
| 1315 |
+
"positive_count": 24,
|
| 1316 |
+
"tp": 24,
|
| 1317 |
+
"fp": 1,
|
| 1318 |
+
"fn": 0,
|
| 1319 |
+
"tn": 32,
|
| 1320 |
+
"threshold": -0.7815297361664113,
|
| 1321 |
+
"recall": 1.0,
|
| 1322 |
+
"specificity": 0.9696969696969697,
|
| 1323 |
+
"f1": 0.9795918367346939,
|
| 1324 |
+
"ap": 0.9965972222222221,
|
| 1325 |
+
"auc": 0.9974747474747475
|
| 1326 |
+
},
|
| 1327 |
+
"combined_val_f1": {
|
| 1328 |
+
"n": 57,
|
| 1329 |
+
"positive_count": 24,
|
| 1330 |
+
"tp": 22,
|
| 1331 |
+
"fp": 0,
|
| 1332 |
+
"fn": 2,
|
| 1333 |
+
"tn": 33,
|
| 1334 |
+
"threshold": -0.022361982385277646,
|
| 1335 |
+
"recall": 0.9166666666666666,
|
| 1336 |
+
"specificity": 1.0,
|
| 1337 |
+
"f1": 0.9565217391304348,
|
| 1338 |
+
"ap": 0.9965972222222221,
|
| 1339 |
+
"auc": 0.9974747474747475
|
| 1340 |
+
}
|
| 1341 |
+
},
|
| 1342 |
+
"paired_original_metrics": {
|
| 1343 |
+
"original_val_f1": {
|
| 1344 |
+
"n": 57,
|
| 1345 |
+
"positive_count": 24,
|
| 1346 |
+
"tp": 22,
|
| 1347 |
+
"fp": 0,
|
| 1348 |
+
"fn": 2,
|
| 1349 |
+
"tn": 33,
|
| 1350 |
+
"threshold": 0.23999364623390296,
|
| 1351 |
+
"recall": 0.9166666666666666,
|
| 1352 |
+
"specificity": 1.0,
|
| 1353 |
+
"f1": 0.9565217391304348,
|
| 1354 |
+
"ap": 0.9999999999999999,
|
| 1355 |
+
"auc": 1.0
|
| 1356 |
+
},
|
| 1357 |
+
"original_val_1pct_fpr": {
|
| 1358 |
+
"n": 57,
|
| 1359 |
+
"positive_count": 24,
|
| 1360 |
+
"tp": 24,
|
| 1361 |
+
"fp": 0,
|
| 1362 |
+
"fn": 0,
|
| 1363 |
+
"tn": 33,
|
| 1364 |
+
"threshold": -0.7815297361664113,
|
| 1365 |
+
"recall": 1.0,
|
| 1366 |
+
"specificity": 1.0,
|
| 1367 |
+
"f1": 1.0,
|
| 1368 |
+
"ap": 0.9999999999999999,
|
| 1369 |
+
"auc": 1.0
|
| 1370 |
+
},
|
| 1371 |
+
"combined_val_f1": {
|
| 1372 |
+
"n": 57,
|
| 1373 |
+
"positive_count": 24,
|
| 1374 |
+
"tp": 23,
|
| 1375 |
+
"fp": 0,
|
| 1376 |
+
"fn": 1,
|
| 1377 |
+
"tn": 33,
|
| 1378 |
+
"threshold": -0.022361982385277646,
|
| 1379 |
+
"recall": 0.9583333333333334,
|
| 1380 |
+
"specificity": 1.0,
|
| 1381 |
+
"f1": 0.9787234042553191,
|
| 1382 |
+
"ap": 0.9999999999999999,
|
| 1383 |
+
"auc": 1.0
|
| 1384 |
+
}
|
| 1385 |
+
},
|
| 1386 |
+
"decision_changes": {
|
| 1387 |
+
"original_val_f1": 0,
|
| 1388 |
+
"original_val_1pct_fpr": 1,
|
| 1389 |
+
"combined_val_f1": 1
|
| 1390 |
+
}
|
| 1391 |
+
}
|
| 1392 |
+
},
|
| 1393 |
+
"training_audit": {
|
| 1394 |
+
"new_fit": 18918,
|
| 1395 |
+
"paired_candidates": 8863,
|
| 1396 |
+
"original_fit": 13417,
|
| 1397 |
+
"new_fit_by_source": {
|
| 1398 |
+
"shell-safety": 14918,
|
| 1399 |
+
"wwe123/Benign_and_malicious_PowerShell_scripts": 4000
|
| 1400 |
+
},
|
| 1401 |
+
"new_fit_by_shell_label": {
|
| 1402 |
+
"posix/0": 4467,
|
| 1403 |
+
"posix/1": 4467,
|
| 1404 |
+
"powershell/0": 3128,
|
| 1405 |
+
"powershell/1": 4995,
|
| 1406 |
+
"cmd/0": 651,
|
| 1407 |
+
"cmd/1": 1210
|
| 1408 |
+
},
|
| 1409 |
+
"audit": {
|
| 1410 |
+
"heldout_overlap": 8,
|
| 1411 |
+
"mlm_duplicate_or_heldout_window": 6270,
|
| 1412 |
+
"mlm_heldout_document": 58,
|
| 1413 |
+
"powershell_corpus_other_or_unknown_license": 55
|
| 1414 |
+
},
|
| 1415 |
+
"mlm": {
|
| 1416 |
+
"train": {
|
| 1417 |
+
"posix": {
|
| 1418 |
+
"windows": 23676,
|
| 1419 |
+
"unique_byte_tokens": 2577763
|
| 1420 |
+
},
|
| 1421 |
+
"powershell": {
|
| 1422 |
+
"windows": 86543,
|
| 1423 |
+
"unique_byte_tokens": 40923645
|
| 1424 |
+
},
|
| 1425 |
+
"cmd": {
|
| 1426 |
+
"windows": 1853,
|
| 1427 |
+
"unique_byte_tokens": 112628
|
| 1428 |
+
}
|
| 1429 |
+
},
|
| 1430 |
+
"val": {
|
| 1431 |
+
"posix": {
|
| 1432 |
+
"windows": 500,
|
| 1433 |
+
"unique_byte_tokens": 39090
|
| 1434 |
+
},
|
| 1435 |
+
"powershell": {
|
| 1436 |
+
"windows": 500,
|
| 1437 |
+
"unique_byte_tokens": 233394
|
| 1438 |
+
},
|
| 1439 |
+
"cmd": {
|
| 1440 |
+
"windows": 181,
|
| 1441 |
+
"unique_byte_tokens": 9411
|
| 1442 |
+
}
|
| 1443 |
+
}
|
| 1444 |
+
},
|
| 1445 |
+
"powershell_corpus_files": [
|
| 1446 |
+
{
|
| 1447 |
+
"file": "sources/NickIBrody/powershell-code-corpus/powershell_dataset.jsonl",
|
| 1448 |
+
"columns": [
|
| 1449 |
+
"source",
|
| 1450 |
+
"repo",
|
| 1451 |
+
"repo_url",
|
| 1452 |
+
"path",
|
| 1453 |
+
"language",
|
| 1454 |
+
"license",
|
| 1455 |
+
"stars",
|
| 1456 |
+
"ref",
|
| 1457 |
+
"size_bytes",
|
| 1458 |
+
"text"
|
| 1459 |
+
],
|
| 1460 |
+
"rows": 4632,
|
| 1461 |
+
"accepted_documents": 4577,
|
| 1462 |
+
"licenses": {
|
| 1463 |
+
"mit": 4249,
|
| 1464 |
+
"apache-2.0": 208,
|
| 1465 |
+
"bsd-3-clause": 120
|
| 1466 |
+
}
|
| 1467 |
+
}
|
| 1468 |
+
],
|
| 1469 |
+
"limits": [
|
| 1470 |
+
"Full-script binary labels supervise encoder prefixes; a risky script can have a benign prefix.",
|
| 1471 |
+
"MLM uses up to 32 sampled windows per fitting document, never executes its text.",
|
| 1472 |
+
"Generated train/test variants stay with their original parent splits.",
|
| 1473 |
+
"No semantic/template/malware-family independence guarantee."
|
| 1474 |
+
]
|
| 1475 |
+
},
|
| 1476 |
+
"command_audit": {
|
| 1477 |
+
"counts": {
|
| 1478 |
+
"train": {
|
| 1479 |
+
"posix": {
|
| 1480 |
+
"0": 1500,
|
| 1481 |
+
"1": 1500
|
| 1482 |
+
},
|
| 1483 |
+
"powershell": {
|
| 1484 |
+
"0": 564,
|
| 1485 |
+
"1": 1500
|
| 1486 |
+
},
|
| 1487 |
+
"cmd": {
|
| 1488 |
+
"0": 345,
|
| 1489 |
+
"1": 654
|
| 1490 |
+
}
|
| 1491 |
+
},
|
| 1492 |
+
"val": {
|
| 1493 |
+
"posix": {
|
| 1494 |
+
"0": 1370,
|
| 1495 |
+
"1": 1103
|
| 1496 |
+
},
|
| 1497 |
+
"powershell": {
|
| 1498 |
+
"1": 196,
|
| 1499 |
+
"0": 188
|
| 1500 |
+
},
|
| 1501 |
+
"cmd": {
|
| 1502 |
+
"1": 80,
|
| 1503 |
+
"0": 108
|
| 1504 |
+
}
|
| 1505 |
+
},
|
| 1506 |
+
"test": {
|
| 1507 |
+
"posix": {
|
| 1508 |
+
"1": 292,
|
| 1509 |
+
"0": 443
|
| 1510 |
+
},
|
| 1511 |
+
"powershell": {
|
| 1512 |
+
"0": 61,
|
| 1513 |
+
"1": 58
|
| 1514 |
+
},
|
| 1515 |
+
"cmd": {
|
| 1516 |
+
"0": 40,
|
| 1517 |
+
"1": 24
|
| 1518 |
+
}
|
| 1519 |
+
}
|
| 1520 |
+
},
|
| 1521 |
+
"excluded": {
|
| 1522 |
+
"contradictory_context_labels": 1382,
|
| 1523 |
+
"previous_experiment_overlap": 3714,
|
| 1524 |
+
"duplicate_or_upstream_split_overlap": 33156
|
| 1525 |
+
},
|
| 1526 |
+
"source_revision": "155dbb5d3047dd095523bd8ee3dd65adf1296dde",
|
| 1527 |
+
"license": "MIT",
|
| 1528 |
+
"limit": "Synthetic context-dependent safe labels, command-only input; no semantic/template split guarantee."
|
| 1529 |
+
},
|
| 1530 |
+
"script_audit": {
|
| 1531 |
+
"source": {
|
| 1532 |
+
"revision": "f3954a30aa723a79ba82dc01022c807b2b7b8457",
|
| 1533 |
+
"license": null,
|
| 1534 |
+
"files": [
|
| 1535 |
+
".gitattributes",
|
| 1536 |
+
"README.md",
|
| 1537 |
+
"ast_ps1_by_label.tar.gz"
|
| 1538 |
+
],
|
| 1539 |
+
"downloaded": {
|
| 1540 |
+
"README.md": {
|
| 1541 |
+
"sha256": "f4a67b31416ffb675731723e9d301099b13e5ed0be39b974bed4bb72dc757c8a",
|
| 1542 |
+
"bytes": 2562
|
| 1543 |
+
},
|
| 1544 |
+
"ast_ps1_by_label.tar.gz": {
|
| 1545 |
+
"sha256": "1faaea0e93851f98f74a27e9d64430e1db1da80bd6c56b58c5ffbe7ae12f9fa0",
|
| 1546 |
+
"bytes": 5211688057
|
| 1547 |
+
}
|
| 1548 |
+
}
|
| 1549 |
+
},
|
| 1550 |
+
"counts": {
|
| 1551 |
+
"train": {
|
| 1552 |
+
"0": 2000,
|
| 1553 |
+
"1": 2000
|
| 1554 |
+
},
|
| 1555 |
+
"val": {
|
| 1556 |
+
"0": 500,
|
| 1557 |
+
"1": 311
|
| 1558 |
+
},
|
| 1559 |
+
"test": {
|
| 1560 |
+
"0": 1000,
|
| 1561 |
+
"1": 1000
|
| 1562 |
+
}
|
| 1563 |
+
},
|
| 1564 |
+
"available_before_sampling": {
|
| 1565 |
+
"train": {
|
| 1566 |
+
"0": 7218,
|
| 1567 |
+
"1": 3562
|
| 1568 |
+
},
|
| 1569 |
+
"val": {
|
| 1570 |
+
"0": 826,
|
| 1571 |
+
"1": 311
|
| 1572 |
+
},
|
| 1573 |
+
"test": {
|
| 1574 |
+
"1": 3122,
|
| 1575 |
+
"0": 4060
|
| 1576 |
+
}
|
| 1577 |
+
},
|
| 1578 |
+
"audit": {
|
| 1579 |
+
"source_files": 30595,
|
| 1580 |
+
"over_1MiB_raw": 3675,
|
| 1581 |
+
"exact_duplicate": 4466,
|
| 1582 |
+
"heldout_encoder_input_overlap": 3262,
|
| 1583 |
+
"contradictory_exact_labels": 93
|
| 1584 |
+
},
|
| 1585 |
+
"prefix_stats": {
|
| 1586 |
+
"train": {
|
| 1587 |
+
"unique_prefixes": 3422,
|
| 1588 |
+
"conflicting_prefixes": 15,
|
| 1589 |
+
"within_510_bytes": 567,
|
| 1590 |
+
"total_utf8_bytes": 55014189
|
| 1591 |
+
},
|
| 1592 |
+
"val": {
|
| 1593 |
+
"unique_prefixes": 748,
|
| 1594 |
+
"conflicting_prefixes": 4,
|
| 1595 |
+
"within_510_bytes": 86,
|
| 1596 |
+
"total_utf8_bytes": 13016617
|
| 1597 |
+
},
|
| 1598 |
+
"test": {
|
| 1599 |
+
"unique_prefixes": 1223,
|
| 1600 |
+
"conflicting_prefixes": 0,
|
| 1601 |
+
"within_510_bytes": 0,
|
| 1602 |
+
"total_utf8_bytes": 349220761
|
| 1603 |
+
}
|
| 1604 |
+
},
|
| 1605 |
+
"max_supported_utf8_bytes": 1048576,
|
| 1606 |
+
"selection": "Smallest normalized SHA256 per label; source test remains test; 10% input-hash groups from source train become val.",
|
| 1607 |
+
"limits": [
|
| 1608 |
+
"Public source labels, not independently verified malware verdicts.",
|
| 1609 |
+
"Full scripts up to 1MiB only; larger source scripts excluded with counts.",
|
| 1610 |
+
"Exact text/prefix separation, no guarantee of semantic or malware-family separation.",
|
| 1611 |
+
"Frozen and updated encoder still reads the first 510 UTF-8 bytes."
|
| 1612 |
+
]
|
| 1613 |
+
},
|
| 1614 |
+
"thresholds": {
|
| 1615 |
+
"original_val_f1": 0.23999364623390296,
|
| 1616 |
+
"original_val_1pct_fpr": -0.7815297361664113,
|
| 1617 |
+
"combined_val_f1": -0.022361982385277646,
|
| 1618 |
+
"external_commands_1pct_fpr": 1.1503808109736977,
|
| 1619 |
+
"exploratory_multigroup_0_5pct_fpr": 1.804626633013823
|
| 1620 |
+
}
|
| 1621 |
+
}
|
manifest.json
ADDED
|
@@ -0,0 +1,32 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
{
|
| 2 |
+
"repo_id": "patronus-studio/cat-shell-risk-commander",
|
| 3 |
+
"private": true,
|
| 4 |
+
"source_experiment": "shellrisk-crossshell-2026-10-04/linear_updated",
|
| 5 |
+
"source_model_sha256": "8cc8963ec35aa3dac23bfdb7af622522268a6ae943a6cd1f883cab34b7580943",
|
| 6 |
+
"files": {
|
| 7 |
+
"README.md": {
|
| 8 |
+
"sha256": "a7e2d43a7d3fa96e2019777207402f8374861063d5b48d51e4ab8178baa9fd93",
|
| 9 |
+
"bytes": 9353
|
| 10 |
+
},
|
| 11 |
+
"evaluation.json": {
|
| 12 |
+
"sha256": "dc31ab2893ea4c8d79bf7f4f7fc8b584181daa1c3a63a03fb2c89d5388ad334f",
|
| 13 |
+
"bytes": 43967
|
| 14 |
+
},
|
| 15 |
+
"model.json": {
|
| 16 |
+
"sha256": "e6fb0bdf7ea42c517e7c07c129e03568dcb83c8f9890cf7ef7c53ba9fc518b36",
|
| 17 |
+
"bytes": 2539702
|
| 18 |
+
},
|
| 19 |
+
"requirements.txt": {
|
| 20 |
+
"sha256": "529d2fb8733c068f938d4ccf2cec991a017f047f84cb93f08872f24e0d6f3546",
|
| 21 |
+
"bytes": 53
|
| 22 |
+
},
|
| 23 |
+
"shell_cat_guard.py": {
|
| 24 |
+
"sha256": "4afe9f8d74824e15ade3d037223eefbcaf556aa60324c66d56610800b8e41894",
|
| 25 |
+
"bytes": 1795
|
| 26 |
+
},
|
| 27 |
+
"validation.json": {
|
| 28 |
+
"sha256": "d4d527fcd8e8002097ceecf58a74595d4e6e93fee394822372f70832e4015083",
|
| 29 |
+
"bytes": 587
|
| 30 |
+
}
|
| 31 |
+
}
|
| 32 |
+
}
|
model.json
ADDED
|
The diff for this file is too large to render.
See raw diff
|
|
|
requirements.txt
ADDED
|
@@ -0,0 +1,3 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
numpy>=1.24
|
| 2 |
+
scikit-learn==1.8.0
|
| 3 |
+
huggingface_hub>=1.3
|
shell_cat_guard.py
ADDED
|
@@ -0,0 +1,42 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
"""Local text-only inference for Cat Shell Risk Commander."""
|
| 2 |
+
import json
|
| 3 |
+
from pathlib import Path
|
| 4 |
+
|
| 5 |
+
import numpy as np
|
| 6 |
+
from sklearn.feature_extraction.text import TfidfVectorizer
|
| 7 |
+
|
| 8 |
+
|
| 9 |
+
class ShellRiskClassifier:
|
| 10 |
+
def __init__(self, model_path):
|
| 11 |
+
data = json.loads(Path(model_path).read_text(encoding='utf-8'))
|
| 12 |
+
if data['format_version'] != 1:
|
| 13 |
+
raise ValueError('Unsupported model format')
|
| 14 |
+
config = dict(data['vectorizer'])
|
| 15 |
+
config['ngram_range'] = tuple(config['ngram_range'])
|
| 16 |
+
config['dtype'] = np.dtype(data['feature_dtype']).type
|
| 17 |
+
self.vectorizer = TfidfVectorizer(vocabulary=data['vocabulary'], **config)
|
| 18 |
+
self.vectorizer.idf_ = np.asarray(data['idf'], dtype=data['idf_dtype'])
|
| 19 |
+
self.weights = np.asarray(data['weights'], dtype=np.float64)
|
| 20 |
+
self.intercept = data['intercept']
|
| 21 |
+
self.thresholds = data['thresholds']
|
| 22 |
+
self.default_policy = data['default_threshold_policy']
|
| 23 |
+
|
| 24 |
+
def decision_function(self, texts):
|
| 25 |
+
if isinstance(texts, str):
|
| 26 |
+
raise TypeError('Pass a list of strings, or use score(text)')
|
| 27 |
+
return np.asarray(self.vectorizer.transform(texts) @ self.weights).reshape(-1) + self.intercept
|
| 28 |
+
|
| 29 |
+
def score(self, text, threshold_policy=None):
|
| 30 |
+
if not isinstance(text, str):
|
| 31 |
+
raise TypeError('text must be a string')
|
| 32 |
+
policy = threshold_policy or self.default_policy
|
| 33 |
+
threshold = self.thresholds[policy]
|
| 34 |
+
score = float(self.decision_function([text])[0])
|
| 35 |
+
flagged = score > threshold
|
| 36 |
+
return {
|
| 37 |
+
'label': 'RISK_FLAG' if flagged else 'NO_RISK_FLAG',
|
| 38 |
+
'flagged': bool(flagged),
|
| 39 |
+
'decision_score': score,
|
| 40 |
+
'threshold': threshold,
|
| 41 |
+
'threshold_policy': policy,
|
| 42 |
+
}
|
validation.json
ADDED
|
@@ -0,0 +1,24 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
{
|
| 2 |
+
"reference": "Saved linear_updated_all_scores.npz; complete held-out POSIX/PowerShell/CMD command test",
|
| 3 |
+
"examples": 918,
|
| 4 |
+
"score_rtol": 1e-06,
|
| 5 |
+
"score_atol": 1e-06,
|
| 6 |
+
"max_absolute_score_error": 1.7763568394002505e-14,
|
| 7 |
+
"decision_changes": {
|
| 8 |
+
"original_val_f1": 0,
|
| 9 |
+
"original_val_1pct_fpr": 0,
|
| 10 |
+
"combined_val_f1": 0,
|
| 11 |
+
"external_commands_1pct_fpr": 0,
|
| 12 |
+
"exploratory_multigroup_0_5pct_fpr": 0
|
| 13 |
+
},
|
| 14 |
+
"default_policy_confusion_matrix": {
|
| 15 |
+
"tp": 321,
|
| 16 |
+
"fn": 53,
|
| 17 |
+
"fp": 5,
|
| 18 |
+
"tn": 539
|
| 19 |
+
},
|
| 20 |
+
"runtime": {
|
| 21 |
+
"python": "3.14.2",
|
| 22 |
+
"numpy": "2.5.3"
|
| 23 |
+
}
|
| 24 |
+
}
|