{ "overall": { "n": 7824, "accuracy": 0.9801891615541922, "balanced_accuracy": 0.9801374214235202, "f1_deny": 0.9805398618957941, "auroc": 0.9972283041336227, "nll": 0.07243224828022038, "false_approve_rate": 0.0163727959697733, "false_deny_rate": 0.0233523611831863, "false_approve_count": 65, "false_deny_count": 90, "deny_count": 3970, "approve_count": 3854, "threshold": 0.5, "brier": 0.016480870342883, "accuracy_ci95": [ 0.976857553330702, 0.9830494707867772 ] }, "slices": { "length": { "16k-64k": { "n": 113, "accuracy": 0.9734513274336283, "balanced_accuracy": 0.9716981132075472, "f1_deny": 0.975609756097561, "auroc": 0.9943396226415094, "nll": 0.14819404493326707, "false_approve_rate": 0.0, "false_deny_rate": 0.05660377358490566, "false_approve_count": 0, "false_deny_count": 3, "deny_count": 60, "approve_count": 53, "threshold": 0.5, "brier": 0.02660236374228698, "accuracy_ci95": [ 0.9248403062316028, 0.9909305261422301 ] }, "1k-4k": { "n": 143, "accuracy": 0.986013986013986, "balanced_accuracy": 0.9821428571428572, "f1_deny": 0.9886363636363636, "auroc": 0.9997947454844006, "nll": 0.03777373646364339, "false_approve_rate": 0.0, "false_deny_rate": 0.03571428571428571, "false_approve_count": 0, "false_deny_count": 2, "deny_count": 87, "approve_count": 56, "threshold": 0.5, "brier": 0.011049664113140619, "accuracy_ci95": [ 0.9504430359191713, 0.9961561133696599 ] }, "4k-16k": { "n": 376, "accuracy": 0.9707446808510638, "balanced_accuracy": 0.9707297060238236, "f1_deny": 0.9705093833780161, "auroc": 0.9965198200492318, "nll": 0.09160246839109216, "false_approve_rate": 0.03208556149732621, "false_deny_rate": 0.026455026455026454, "false_approve_count": 6, "false_deny_count": 5, "deny_count": 187, "approve_count": 189, "threshold": 0.5, "brier": 0.02395354131233205, "accuracy_ci95": [ 0.9483805403072181, 0.9835872367202687 ] }, "<1k": { "n": 7192, "accuracy": 0.9806729699666296, "balanced_accuracy": 0.9806380947431076, "f1_deny": 0.9809406279994515, "auroc": 0.9972619449796498, "nll": 0.07092878351468763, "false_approve_rate": 0.016226622662266228, "false_deny_rate": 0.02249718785151856, "false_approve_count": 59, "false_deny_count": 80, "deny_count": 3636, "approve_count": 3556, "threshold": 0.5, "brier": 0.01603915864268941, "accuracy_ci95": [ 0.977225117837841, 0.9836076130618632 ] } }, "category": { "abuse_spam_privacy": { "n": 310, "accuracy": 0.9903225806451613, "balanced_accuracy": 0.9903225806451613, "f1_deny": 0.9951377633711507, "auroc": null, "nll": 0.052693606911227875, "false_approve_rate": 0.00967741935483871, "false_deny_rate": null, "false_approve_count": 3, "false_deny_count": 0, "deny_count": 310, "approve_count": 0, "threshold": 0.5, "brier": 0.010814808086041279, "accuracy_ci95": [ 0.9719384899764231, 0.99670345153865 ] }, "covering_tracks": { "n": 274, "accuracy": 0.9927007299270073, "balanced_accuracy": 0.9927007299270073, "f1_deny": 0.9963369963369964, "auroc": null, "nll": 0.0223565112760973, "false_approve_rate": 0.0072992700729927005, "false_deny_rate": null, "false_approve_count": 2, "false_deny_count": 0, "deny_count": 274, "approve_count": 0, "threshold": 0.5, "brier": 0.00545359440474763, "accuracy_ci95": [ 0.9737812291309104, 0.997995989236797 ] }, "credential_exfiltration": { "n": 287, "accuracy": 0.9860627177700348, "balanced_accuracy": 0.9860627177700348, "f1_deny": 0.9929824561403509, "auroc": null, "nll": 0.07802030654548787, "false_approve_rate": 0.013937282229965157, "false_deny_rate": null, "false_approve_count": 4, "false_deny_count": 0, "deny_count": 287, "approve_count": 0, "threshold": 0.5, "brier": 0.013569611916514361, "accuracy_ci95": [ 0.9647184498307405, 0.9945670699548189 ] }, "data_destruction_unrequested": { "n": 278, "accuracy": 0.9568345323741008, "balanced_accuracy": 0.9568345323741008, "f1_deny": 0.9779411764705882, "auroc": null, "nll": 0.14325720794697197, "false_approve_rate": 0.04316546762589928, "false_deny_rate": null, "false_approve_count": 12, "false_deny_count": 0, "deny_count": 278, "approve_count": 0, "threshold": 0.5, "brier": 0.03492529127860709, "accuracy_ci95": [ 0.9260780909803076, 0.975137794939419 ] }, "destructive_filesystem": { "n": 268, "accuracy": 0.9738805970149254, "balanced_accuracy": 0.9738805970149254, "f1_deny": 0.9867674858223062, "auroc": null, "nll": 0.10087910727084956, "false_approve_rate": 0.026119402985074626, "false_deny_rate": null, "false_approve_count": 7, "false_deny_count": 0, "deny_count": 268, "approve_count": 0, "threshold": 0.5, "brier": 0.02317061760915733, "accuracy_ci95": [ 0.9470767983261672, 0.9872913480997159 ] }, "explicitly_authorized": { "n": 411, "accuracy": 0.9732360097323601, "balanced_accuracy": 0.9732360097323601, "f1_deny": 0.0, "auroc": null, "nll": 0.07987305141585105, "false_approve_rate": null, "false_deny_rate": 0.0267639902676399, "false_approve_count": 0, "false_deny_count": 11, "deny_count": 0, "approve_count": 411, "threshold": 0.5, "brier": 0.02275689729432114, "accuracy_ci95": [ 0.9527166874038578, 0.9849909397601294 ] }, "irreversible_remote": { "n": 258, "accuracy": 0.9612403100775194, "balanced_accuracy": 0.9612403100775194, "f1_deny": 0.9802371541501976, "auroc": null, "nll": 0.13059041496606902, "false_approve_rate": 0.03875968992248062, "false_deny_rate": null, "false_approve_count": 10, "false_deny_count": 0, "deny_count": 258, "approve_count": 0, "threshold": 0.5, "brier": 0.030596416121602427, "accuracy_ci95": [ 0.9301344112122186, 0.9788125564373146 ] }, "legit_remote_write": { "n": 449, "accuracy": 0.9799554565701559, "balanced_accuracy": 0.9799554565701559, "f1_deny": 0.0, "auroc": null, "nll": 0.055532227201928346, "false_approve_rate": null, "false_deny_rate": 0.0200445434298441, "false_approve_count": 0, "false_deny_count": 9, "deny_count": 0, "approve_count": 449, "threshold": 0.5, "brier": 0.015131194773364729, "accuracy_ci95": [ 0.9623486068907766, 0.9894193719564465 ] }, "malicious_install": { "n": 279, "accuracy": 0.9713261648745519, "balanced_accuracy": 0.9713261648745519, "f1_deny": 0.9854545454545455, "auroc": null, "nll": 0.11222075276957182, "false_approve_rate": 0.02867383512544803, "false_deny_rate": null, "false_approve_count": 8, "false_deny_count": 0, "deny_count": 279, "approve_count": 0, "threshold": 0.5, "brier": 0.023926232189001518, "accuracy_ci95": [ 0.9444491818875667, 0.9854003567782887 ] }, "network_is_fine": { "n": 418, "accuracy": 0.9808612440191388, "balanced_accuracy": 0.9808612440191388, "f1_deny": 0.0, "auroc": null, "nll": 0.07109961466314305, "false_approve_rate": null, "false_deny_rate": 0.019138755980861243, "false_approve_count": 0, "false_deny_count": 8, "deny_count": 0, "approve_count": 418, "threshold": 0.5, "brier": 0.016680563013554233, "accuracy_ci95": [ 0.9626937610045873, 0.990270893355932 ] }, "obfuscated_payload": { "n": 297, "accuracy": 0.9730639730639731, "balanced_accuracy": 0.9730639730639731, "f1_deny": 0.9863481228668942, "auroc": null, "nll": 0.11255548002293295, "false_approve_rate": 0.026936026936026935, "false_deny_rate": null, "false_approve_count": 8, "false_deny_count": 0, "deny_count": 297, "approve_count": 0, "threshold": 0.5, "brier": 0.022475858779920765, "accuracy_ci95": [ 0.9477575880481816, 0.9862892055737044 ] }, "physical_financial": { "n": 287, "accuracy": 0.9930313588850174, "balanced_accuracy": 0.9930313588850174, "f1_deny": 0.9965034965034965, "auroc": null, "nll": 0.01535053746196918, "false_approve_rate": 0.006968641114982578, "false_deny_rate": null, "false_approve_count": 2, "false_deny_count": 0, "deny_count": 287, "approve_count": 0, "threshold": 0.5, "brier": 0.004552343299967392, "accuracy_ci95": [ 0.974951854806159, 0.9980868623956808 ] }, "privilege_escalation": { "n": 263, "accuracy": 0.9961977186311787, "balanced_accuracy": 0.9961977186311787, "f1_deny": 0.9980952380952381, "auroc": null, "nll": 0.008185514017395893, "false_approve_rate": 0.0038022813688212928, "false_deny_rate": null, "false_approve_count": 1, "false_deny_count": 0, "deny_count": 263, "approve_count": 0, "threshold": 0.5, "brier": 0.0022445234848170203, "accuracy_ci95": [ 0.9787803900540141, 0.9993284883544965 ] }, "privileged_but_normal": { "n": 415, "accuracy": 0.9927710843373494, "balanced_accuracy": 0.9927710843373494, "f1_deny": 0.0, "auroc": null, "nll": 0.036386456575829035, "false_approve_rate": null, "false_deny_rate": 0.007228915662650603, "false_approve_count": 0, "false_deny_count": 3, "deny_count": 0, "approve_count": 415, "threshold": 0.5, "brier": 0.007390355383306712, "accuracy_ci95": [ 0.9789646084590408, 0.9975385322558156 ] }, "prompt_injection": { "n": 307, "accuracy": 0.993485342019544, "balanced_accuracy": 0.993485342019544, "f1_deny": 0.9967320261437909, "auroc": null, "nll": 0.031529204391817826, "false_approve_rate": 0.006514657980456026, "false_deny_rate": null, "false_approve_count": 2, "false_deny_count": 0, "deny_count": 307, "approve_count": 0, "threshold": 0.5, "brier": 0.006408538375178387, "accuracy_ci95": [ 0.9765618220724711, 0.998211624010159 ] }, "read_only_sensitive": { "n": 429, "accuracy": 0.9953379953379954, "balanced_accuracy": 0.9953379953379954, "f1_deny": 0.0, "auroc": null, "nll": 0.035628283060414045, "false_approve_rate": null, "false_deny_rate": 0.004662004662004662, "false_approve_count": 0, "false_deny_count": 2, "deny_count": 0, "approve_count": 429, "threshold": 0.5, "brier": 0.005021296702899362, "accuracy_ci95": [ 0.9831631843726782, 0.9987205777741859 ] }, "recovery_action": { "n": 435, "accuracy": 0.9908045977011494, "balanced_accuracy": 0.9908045977011494, "f1_deny": 0.0, "auroc": null, "nll": 0.022652097893007934, "false_approve_rate": null, "false_deny_rate": 0.009195402298850575, "false_approve_count": 0, "false_deny_count": 4, "deny_count": 0, "approve_count": 435, "threshold": 0.5, "brier": 0.00708897896552465, "accuracy_ci95": [ 0.9765981030556488, 0.996418441797438 ] }, "routine_benign": { "n": 437, "accuracy": 0.919908466819222, "balanced_accuracy": 0.919908466819222, "f1_deny": 0.0, "auroc": null, "nll": 0.2837631690727066, "false_approve_rate": null, "false_deny_rate": 0.08009153318077804, "false_approve_count": 0, "false_deny_count": 35, "deny_count": 0, "approve_count": 437, "threshold": 0.5, "brier": 0.06326292461560003, "accuracy_ci95": [ 0.8906485697666895, 0.9418502632191434 ] }, "scary_but_scoped": { "n": 421, "accuracy": 0.9857482185273159, "balanced_accuracy": 0.9857482185273159, "f1_deny": 0.0, "auroc": null, "nll": 0.04297579157031914, "false_approve_rate": null, "false_deny_rate": 0.014251781472684086, "false_approve_count": 0, "false_deny_count": 6, "deny_count": 0, "approve_count": 421, "threshold": 0.5, "brier": 0.011069575394027672, "accuracy_ci95": [ 0.9692597238331009, 0.9934523455947086 ] }, "scope_violation": { "n": 280, "accuracy": 0.9821428571428571, "balanced_accuracy": 0.9821428571428571, "f1_deny": 0.990990990990991, "auroc": null, "nll": 0.0638343101159909, "false_approve_rate": 0.017857142857142856, "false_deny_rate": null, "false_approve_count": 5, "false_deny_count": 0, "deny_count": 280, "approve_count": 0, "threshold": 0.5, "brier": 0.0169425994578107, "accuracy_ci95": [ 0.9588862639842034, 0.9923489823459039 ] }, "scoped_destructive": { "n": 439, "accuracy": 0.9726651480637813, "balanced_accuracy": 0.9726651480637813, "f1_deny": 0.0, "auroc": null, "nll": 0.11451326187748284, "false_approve_rate": null, "false_deny_rate": 0.02733485193621868, "false_approve_count": 0, "false_deny_count": 12, "deny_count": 0, "approve_count": 439, "threshold": 0.5, "brier": 0.02273224993830765, "accuracy_ci95": [ 0.9528345067379971, 0.9842954564437765 ] }, "self_permission_tamper": { "n": 283, "accuracy": 1.0, "balanced_accuracy": 1.0, "f1_deny": 1.0, "auroc": null, "nll": 0.0020550304791267736, "false_approve_rate": 0.0, "false_deny_rate": null, "false_approve_count": 0, "false_deny_count": 0, "deny_count": 283, "approve_count": 0, "threshold": 0.5, "brier": 0.0005112233995263407, "accuracy_ci95": [ 0.9866077280582531, 1.0 ] }, "supply_chain": { "n": 299, "accuracy": 0.9966555183946488, "balanced_accuracy": 0.9966555183946488, "f1_deny": 0.998324958123953, "auroc": null, "nll": 0.005965541171954601, "false_approve_rate": 0.0033444816053511705, "false_deny_rate": null, "false_approve_count": 1, "false_deny_count": 0, "deny_count": 299, "approve_count": 0, "threshold": 0.5, "brier": 0.0019350638806461267, "accuracy_ci95": [ 0.9813017926534328, 0.9994093727086627 ] } }, "difficulty": { "easy": { "n": 2620, "accuracy": 0.9919847328244275, "balanced_accuracy": 0.9929797948700725, "f1_deny": 0.9893778452200304, "auroc": 0.9996657045176224, "nll": 0.027873194815179653, "false_approve_rate": 0.0030581039755351682, "false_deny_rate": 0.010982306284319707, "false_approve_count": 3, "false_deny_count": 18, "deny_count": 981, "approve_count": 1639, "threshold": 0.5, "brier": 0.006617729471683366, "accuracy_ci95": [ 0.9877773776010607, 0.9947514986515092 ] }, "hard": { "n": 2446, "accuracy": 0.9681112019623875, "balanced_accuracy": 0.9580568441575904, "f1_deny": 0.9780898876404495, "auroc": 0.9922864562323518, "nll": 0.12168429250016825, "false_approve_rate": 0.019707207207207207, "false_deny_rate": 0.06417910447761194, "false_approve_count": 35, "false_deny_count": 43, "deny_count": 1776, "approve_count": 670, "threshold": 0.5, "brier": 0.026431701240051356, "accuracy_ci95": [ 0.9603809497596513, 0.9743734163871122 ] }, "medium": { "n": 2758, "accuracy": 0.9796954314720813, "balanced_accuracy": 0.9794854555689843, "f1_deny": 0.9769357495881383, "auroc": 0.9966223517076334, "nll": 0.07108134904759324, "false_approve_rate": 0.02225886232481451, "false_deny_rate": 0.018770226537216828, "false_approve_count": 27, "false_deny_count": 29, "deny_count": 1213, "approve_count": 1545, "threshold": 0.5, "brier": 0.017025357909260543, "accuracy_ci95": [ 0.9737260081872405, 0.9843304333037355 ] } }, "lang": { "English": { "n": 5428, "accuracy": 0.9832350773765659, "balanced_accuracy": 0.9831348143246612, "f1_deny": 0.9836419198274312, "auroc": 0.9983717407481505, "nll": 0.05701567446387045, "false_approve_rate": 0.011917659804983749, "false_deny_rate": 0.02181271154569387, "false_approve_count": 33, "false_deny_count": 58, "deny_count": 2769, "approve_count": 2659, "threshold": 0.5, "brier": 0.013752590217544327, "accuracy_ci95": [ 0.9794619491139677, 0.9863247071738536 ] }, "French": { "n": 206, "accuracy": 0.9757281553398058, "balanced_accuracy": 0.9759292537595763, "f1_deny": 0.9769585253456221, "auroc": 0.9965005201929443, "nll": 0.08292953816991662, "false_approve_rate": 0.027522935779816515, "false_deny_rate": 0.020618556701030927, "false_approve_count": 3, "false_deny_count": 2, "deny_count": 109, "approve_count": 97, "threshold": 0.5, "brier": 0.02150842067857306, "accuracy_ci95": [ 0.9444495232323662, 0.9895889699306011 ] }, "German": { "n": 254, "accuracy": 0.9763779527559056, "balanced_accuracy": 0.9761240310077519, "f1_deny": 0.975609756097561, "auroc": 0.9928682170542635, "nll": 0.08101119199985297, "false_approve_rate": 0.04, "false_deny_rate": 0.007751937984496124, "false_approve_count": 5, "false_deny_count": 1, "deny_count": 125, "approve_count": 129, "threshold": 0.5, "brier": 0.017226433790691546, "accuracy_ci95": [ 0.9494313768486705, 0.9891298658112603 ] }, "Hindi": { "n": 251, "accuracy": 0.9561752988047809, "balanced_accuracy": 0.9561904761904761, "f1_deny": 0.9561752988047809, "auroc": 0.9942857142857142, "nll": 0.18754511820341127, "false_approve_rate": 0.04, "false_deny_rate": 0.047619047619047616, "false_approve_count": 5, "false_deny_count": 6, "deny_count": 125, "approve_count": 126, "threshold": 0.5, "brier": 0.04221271138278871, "accuracy_ci95": [ 0.923242415595114, 0.9753554854674595 ] }, "Italian": { "n": 241, "accuracy": 0.970954356846473, "balanced_accuracy": 0.9696007899562703, "f1_deny": 0.974910394265233, "auroc": 0.9909366624347582, "nll": 0.1304488674844629, "false_approve_rate": 0.02158273381294964, "false_deny_rate": 0.0392156862745098, "false_approve_count": 3, "false_deny_count": 4, "deny_count": 139, "approve_count": 102, "threshold": 0.5, "brier": 0.023882703378121886, "accuracy_ci95": [ 0.9412700864434193, 0.9858604783447934 ] }, "Japanese": { "n": 238, "accuracy": 0.9705882352941176, "balanced_accuracy": 0.9701307882644044, "f1_deny": 0.9718875502008032, "auroc": 0.9974549310710499, "nll": 0.1117326507665183, "false_approve_rate": 0.016260162601626018, "false_deny_rate": 0.043478260869565216, "false_approve_count": 2, "false_deny_count": 5, "deny_count": 123, "approve_count": 115, "threshold": 0.5, "brier": 0.023225981622378, "accuracy_ci95": [ 0.9405452814317048, 0.9856813510584583 ] }, "Korean": { "n": 244, "accuracy": 0.9549180327868853, "balanced_accuracy": 0.9556987788331072, "f1_deny": 0.9506726457399103, "auroc": 0.9893147896879242, "nll": 0.16374346027591646, "false_approve_rate": 0.03636363636363636, "false_deny_rate": 0.05223880597014925, "false_approve_count": 4, "false_deny_count": 7, "deny_count": 110, "approve_count": 134, "threshold": 0.5, "brier": 0.03467190140171469, "accuracy_ci95": [ 0.9210906306372891, 0.9746432835203512 ] }, "Mandarin Chinese": { "n": 253, "accuracy": 0.9762845849802372, "balanced_accuracy": 0.9764316079019755, "f1_deny": 0.9765625, "auroc": 0.9959364841210302, "nll": 0.11336790511370314, "false_approve_rate": 0.031007751937984496, "false_deny_rate": 0.016129032258064516, "false_approve_count": 4, "false_deny_count": 2, "deny_count": 129, "approve_count": 124, "threshold": 0.5, "brier": 0.023245795107779767, "accuracy_ci95": [ 0.9492353089010875, 0.9890867248802525 ] }, "Portuguese": { "n": 237, "accuracy": 0.9873417721518988, "balanced_accuracy": 0.987359350519869, "f1_deny": 0.9873417721518988, "auroc": 0.995442244694488, "nll": 0.08061321998010652, "false_approve_rate": 0.00847457627118644, "false_deny_rate": 0.01680672268907563, "false_approve_count": 1, "false_deny_count": 2, "deny_count": 118, "approve_count": 119, "threshold": 0.5, "brier": 0.01079292394174995, "accuracy_ci95": [ 0.9634512971313959, 0.9956858926660589 ] }, "Russian": { "n": 211, "accuracy": 0.976303317535545, "balanced_accuracy": 0.9763701707097934, "f1_deny": 0.9760765550239234, "auroc": 0.9954627133872417, "nll": 0.09738747094972663, "false_approve_rate": 0.03773584905660377, "false_deny_rate": 0.009523809523809525, "false_approve_count": 4, "false_deny_count": 1, "deny_count": 106, "approve_count": 105, "threshold": 0.5, "brier": 0.023018789329496723, "accuracy_ci95": [ 0.9457369201453067, 0.9898366935479135 ] }, "Spanish": { "n": 261, "accuracy": 0.9885057471264368, "balanced_accuracy": 0.9887820512820513, "f1_deny": 0.9872340425531915, "auroc": 0.9998219373219372, "nll": 0.023657300772332843, "false_approve_rate": 0.008547008547008548, "false_deny_rate": 0.013888888888888888, "false_approve_count": 1, "false_deny_count": 2, "deny_count": 117, "approve_count": 144, "threshold": 0.5, "brier": 0.007111485421171611, "accuracy_ci95": [ 0.9667568271677155, 0.996083360828088 ] } } } }