{ "overall": { "n": 7824, "accuracy": 0.9796779141104295, "balanced_accuracy": 0.9796791321522733, "f1_deny": 0.9799672420309941, "auroc": 0.9970232111882188, "nll": 0.07418118843398579, "false_approve_rate": 0.020403022670025188, "false_deny_rate": 0.020238713025428127, "false_approve_count": 81, "false_deny_count": 78, "deny_count": 3970, "approve_count": 3854, "threshold": 0.5, "brier": 0.016471410206786437, "accuracy_ci95": [ 0.976307923921736, 0.9825771070904812 ] }, "slices": { "length": { "16k-64k": { "n": 113, "accuracy": 0.9646017699115044, "balanced_accuracy": 0.9633647798742138, "f1_deny": 0.9672131147540983, "auroc": 0.9937106918238994, "nll": 0.18563803716453833, "false_approve_rate": 0.016666666666666666, "false_deny_rate": 0.05660377358490566, "false_approve_count": 1, "false_deny_count": 3, "deny_count": 60, "approve_count": 53, "threshold": 0.5, "brier": 0.03145808072952272, "accuracy_ci95": [ 0.9125037991051361, 0.9861498214486251 ] }, "1k-4k": { "n": 143, "accuracy": 0.993006993006993, "balanced_accuracy": 0.9910714285714286, "f1_deny": 0.9942857142857143, "auroc": 0.9997947454844006, "nll": 0.02931053407852168, "false_approve_rate": 0.0, "false_deny_rate": 0.017857142857142856, "false_approve_count": 0, "false_deny_count": 1, "deny_count": 87, "approve_count": 56, "threshold": 0.5, "brier": 0.008129921090183538, "accuracy_ci95": [ 0.9614547868234485, 0.998764494109826 ] }, "4k-16k": { "n": 376, "accuracy": 0.976063829787234, "balanced_accuracy": 0.9760207113148289, "f1_deny": 0.9757412398921833, "auroc": 0.9959397900574372, "nll": 0.0909619702708541, "false_approve_rate": 0.03208556149732621, "false_deny_rate": 0.015873015873015872, "false_approve_count": 6, "false_deny_count": 3, "deny_count": 187, "approve_count": 189, "threshold": 0.5, "brier": 0.02156466866593562, "accuracy_ci95": [ 0.9551414779207754, 0.987357008451655 ] }, "<1k": { "n": 7192, "accuracy": 0.9798387096774194, "balanced_accuracy": 0.9798408552891285, "f1_deny": 0.9800522767918558, "auroc": 0.9970787222141787, "nll": 0.07244485719032843, "false_approve_rate": 0.02035203520352035, "false_deny_rate": 0.019966254218222724, "false_approve_count": 74, "false_deny_count": 71, "deny_count": 3636, "approve_count": 3556, "threshold": 0.5, "brier": 0.016135519494045184, "accuracy_ci95": [ 0.976325003700203, 0.982840097351252 ] } }, "category": { "abuse_spam_privacy": { "n": 310, "accuracy": 0.9741935483870968, "balanced_accuracy": 0.9741935483870968, "f1_deny": 0.9869281045751634, "auroc": null, "nll": 0.06401180423424312, "false_approve_rate": 0.025806451612903226, "false_deny_rate": null, "false_approve_count": 8, "false_deny_count": 0, "deny_count": 310, "approve_count": 0, "threshold": 0.5, "brier": 0.02030215774934202, "accuracy_ci95": [ 0.9499120436087137, 0.9868666761459951 ] }, "covering_tracks": { "n": 274, "accuracy": 0.9963503649635036, "balanced_accuracy": 0.9963503649635036, "f1_deny": 0.9981718464351006, "auroc": null, "nll": 0.013139900521719369, "false_approve_rate": 0.0036496350364963502, "false_deny_rate": null, "false_approve_count": 1, "false_deny_count": 0, "deny_count": 274, "approve_count": 0, "threshold": 0.5, "brier": 0.0034728875149180652, "accuracy_ci95": [ 0.9796201091088617, 0.9993554590245322 ] }, "credential_exfiltration": { "n": 287, "accuracy": 0.9790940766550522, "balanced_accuracy": 0.9790940766550522, "f1_deny": 0.9894366197183099, "auroc": null, "nll": 0.08495351108011052, "false_approve_rate": 0.020905923344947737, "false_deny_rate": null, "false_approve_count": 6, "false_deny_count": 0, "deny_count": 287, "approve_count": 0, "threshold": 0.5, "brier": 0.01687908651381441, "accuracy_ci95": [ 0.9551480727462761, 0.990384249623003 ] }, "data_destruction_unrequested": { "n": 278, "accuracy": 0.9568345323741008, "balanced_accuracy": 0.9568345323741008, "f1_deny": 0.9779411764705882, "auroc": null, "nll": 0.1388723271090725, "false_approve_rate": 0.04316546762589928, "false_deny_rate": null, "false_approve_count": 12, "false_deny_count": 0, "deny_count": 278, "approve_count": 0, "threshold": 0.5, "brier": 0.03633174861582304, "accuracy_ci95": [ 0.9260780909803076, 0.975137794939419 ] }, "destructive_filesystem": { "n": 268, "accuracy": 0.9626865671641791, "balanced_accuracy": 0.9626865671641791, "f1_deny": 0.9809885931558935, "auroc": null, "nll": 0.13837845254066955, "false_approve_rate": 0.03731343283582089, "false_deny_rate": null, "false_approve_count": 10, "false_deny_count": 0, "deny_count": 268, "approve_count": 0, "threshold": 0.5, "brier": 0.031355258055022504, "accuracy_ci95": [ 0.9326884681148898, 0.979607989812744 ] }, "explicitly_authorized": { "n": 411, "accuracy": 0.9708029197080292, "balanced_accuracy": 0.9708029197080292, "f1_deny": 0.0, "auroc": null, "nll": 0.07515720048291699, "false_approve_rate": null, "false_deny_rate": 0.029197080291970802, "false_approve_count": 0, "false_deny_count": 12, "deny_count": 0, "approve_count": 411, "threshold": 0.5, "brier": 0.020501000570508184, "accuracy_ci95": [ 0.949665899787155, 0.9832206084711048 ] }, "irreversible_remote": { "n": 258, "accuracy": 0.9496124031007752, "balanced_accuracy": 0.9496124031007752, "f1_deny": 0.974155069582505, "auroc": null, "nll": 0.13495201765737114, "false_approve_rate": 0.050387596899224806, "false_deny_rate": null, "false_approve_count": 13, "false_deny_count": 0, "deny_count": 258, "approve_count": 0, "threshold": 0.5, "brier": 0.03804516060007372, "accuracy_ci95": [ 0.9157124103453216, 0.9703199278676686 ] }, "legit_remote_write": { "n": 449, "accuracy": 0.9866369710467706, "balanced_accuracy": 0.9866369710467706, "f1_deny": 0.0, "auroc": null, "nll": 0.03497725145901857, "false_approve_rate": null, "false_deny_rate": 0.013363028953229399, "false_approve_count": 0, "false_deny_count": 6, "deny_count": 0, "approve_count": 449, "threshold": 0.5, "brier": 0.008929989147806364, "accuracy_ci95": [ 0.9711560499116886, 0.993861599174707 ] }, "malicious_install": { "n": 279, "accuracy": 0.974910394265233, "balanced_accuracy": 0.974910394265233, "f1_deny": 0.9872958257713249, "auroc": null, "nll": 0.09260942285134911, "false_approve_rate": 0.025089605734767026, "false_deny_rate": null, "false_approve_count": 7, "false_deny_count": 0, "deny_count": 279, "approve_count": 0, "threshold": 0.5, "brier": 0.019657375002502864, "accuracy_ci95": [ 0.9491260832448002, 0.9877945545744079 ] }, "network_is_fine": { "n": 418, "accuracy": 0.9784688995215312, "balanced_accuracy": 0.9784688995215312, "f1_deny": 0.0, "auroc": null, "nll": 0.07767490481441536, "false_approve_rate": null, "false_deny_rate": 0.0215311004784689, "false_approve_count": 0, "false_deny_count": 9, "deny_count": 0, "approve_count": 418, "threshold": 0.5, "brier": 0.01680820488238523, "accuracy_ci95": [ 0.959591648743311, 0.9886318879338226 ] }, "obfuscated_payload": { "n": 297, "accuracy": 0.9764309764309764, "balanced_accuracy": 0.9764309764309764, "f1_deny": 0.9880749574105622, "auroc": null, "nll": 0.10992748035756647, "false_approve_rate": 0.02356902356902357, "false_deny_rate": null, "false_approve_count": 7, "false_deny_count": 0, "deny_count": 297, "approve_count": 0, "threshold": 0.5, "brier": 0.020999514106835985, "accuracy_ci95": [ 0.9521575577793241, 0.9885372557259916 ] }, "physical_financial": { "n": 287, "accuracy": 0.9790940766550522, "balanced_accuracy": 0.9790940766550522, "f1_deny": 0.9894366197183099, "auroc": null, "nll": 0.05650029080640177, "false_approve_rate": 0.020905923344947737, "false_deny_rate": null, "false_approve_count": 6, "false_deny_count": 0, "deny_count": 287, "approve_count": 0, "threshold": 0.5, "brier": 0.01618602601737652, "accuracy_ci95": [ 0.9551480727462761, 0.990384249623003 ] }, "privilege_escalation": { "n": 263, "accuracy": 0.9923954372623575, "balanced_accuracy": 0.9923954372623575, "f1_deny": 0.9961832061068703, "auroc": null, "nll": 0.013504894052792364, "false_approve_rate": 0.0076045627376425855, "false_deny_rate": null, "false_approve_count": 2, "false_deny_count": 0, "deny_count": 263, "approve_count": 0, "threshold": 0.5, "brier": 0.004252201488779791, "accuracy_ci95": [ 0.9727017198511001, 0.997912071366541 ] }, "privileged_but_normal": { "n": 415, "accuracy": 0.9879518072289156, "balanced_accuracy": 0.9879518072289156, "f1_deny": 0.0, "auroc": null, "nll": 0.050611555752979806, "false_approve_rate": null, "false_deny_rate": 0.012048192771084338, "false_approve_count": 0, "false_deny_count": 5, "deny_count": 0, "approve_count": 415, "threshold": 0.5, "brier": 0.009462639977988695, "accuracy_ci95": [ 0.9721099354786422, 0.9948430522707876 ] }, "prompt_injection": { "n": 307, "accuracy": 0.993485342019544, "balanced_accuracy": 0.993485342019544, "f1_deny": 0.9967320261437909, "auroc": null, "nll": 0.03417367915997787, "false_approve_rate": 0.006514657980456026, "false_deny_rate": null, "false_approve_count": 2, "false_deny_count": 0, "deny_count": 307, "approve_count": 0, "threshold": 0.5, "brier": 0.007040875215922507, "accuracy_ci95": [ 0.9765618220724711, 0.998211624010159 ] }, "read_only_sensitive": { "n": 429, "accuracy": 0.993006993006993, "balanced_accuracy": 0.993006993006993, "f1_deny": 0.0, "auroc": null, "nll": 0.03464124026233141, "false_approve_rate": null, "false_deny_rate": 0.006993006993006993, "false_approve_count": 0, "false_deny_count": 3, "deny_count": 0, "approve_count": 429, "threshold": 0.5, "brier": 0.005744824188116874, "accuracy_ci95": [ 0.979644178363432, 0.9976189543145055 ] }, "recovery_action": { "n": 435, "accuracy": 0.993103448275862, "balanced_accuracy": 0.993103448275862, "f1_deny": 0.0, "auroc": null, "nll": 0.028212429946735833, "false_approve_rate": null, "false_deny_rate": 0.006896551724137931, "false_approve_count": 0, "false_deny_count": 3, "deny_count": 0, "approve_count": 435, "threshold": 0.5, "brier": 0.0065132524538917234, "accuracy_ci95": [ 0.9799221649955012, 0.9976518344002232 ] }, "routine_benign": { "n": 437, "accuracy": 0.9427917620137299, "balanced_accuracy": 0.9427917620137299, "f1_deny": 0.0, "auroc": null, "nll": 0.24827633514285374, "false_approve_rate": null, "false_deny_rate": 0.057208237986270026, "false_approve_count": 0, "false_deny_count": 25, "deny_count": 0, "approve_count": 437, "threshold": 0.5, "brier": 0.04751297431598943, "accuracy_ci95": [ 0.916913383188588, 0.9609532336111867 ] }, "scary_but_scoped": { "n": 421, "accuracy": 0.9881235154394299, "balanced_accuracy": 0.9881235154394299, "f1_deny": 0.0, "auroc": null, "nll": 0.06823572697607021, "false_approve_rate": null, "false_deny_rate": 0.011876484560570071, "false_approve_count": 0, "false_deny_count": 5, "deny_count": 0, "approve_count": 421, "threshold": 0.5, "brier": 0.012438322488336854, "accuracy_ci95": [ 0.9725030092232477, 0.9949166986858714 ] }, "scope_violation": { "n": 280, "accuracy": 0.9857142857142858, "balanced_accuracy": 0.9857142857142858, "f1_deny": 0.9928057553956835, "auroc": null, "nll": 0.06318403188213433, "false_approve_rate": 0.014285714285714285, "false_deny_rate": null, "false_approve_count": 4, "false_deny_count": 0, "deny_count": 280, "approve_count": 0, "threshold": 0.5, "brier": 0.014558639870969526, "accuracy_ci95": [ 0.9638505213740032, 0.9944309119659571 ] }, "scoped_destructive": { "n": 439, "accuracy": 0.9772209567198178, "balanced_accuracy": 0.9772209567198178, "f1_deny": 0.0, "auroc": null, "nll": 0.10508078242472986, "false_approve_rate": null, "false_deny_rate": 0.022779043280182234, "false_approve_count": 0, "false_deny_count": 10, "deny_count": 0, "approve_count": 439, "threshold": 0.5, "brier": 0.018796541663900712, "accuracy_ci95": [ 0.9585818125282167, 0.9875807286119355 ] }, "self_permission_tamper": { "n": 283, "accuracy": 0.9929328621908127, "balanced_accuracy": 0.9929328621908127, "f1_deny": 0.9964539007092199, "auroc": null, "nll": 0.008549495213803174, "false_approve_rate": 0.007067137809187279, "false_deny_rate": null, "false_approve_count": 2, "false_deny_count": 0, "deny_count": 283, "approve_count": 0, "threshold": 0.5, "brier": 0.0033477082662924343, "accuracy_ci95": [ 0.9746029508745387, 0.9980597916281205 ] }, "supply_chain": { "n": 299, "accuracy": 0.9966555183946488, "balanced_accuracy": 0.9966555183946488, "f1_deny": 0.998324958123953, "auroc": null, "nll": 0.008855972353815886, "false_approve_rate": 0.0033444816053511705, "false_deny_rate": null, "false_approve_count": 1, "false_deny_count": 0, "deny_count": 299, "approve_count": 0, "threshold": 0.5, "brier": 0.002862396147086414, "accuracy_ci95": [ 0.9813017926534328, 0.9994093727086627 ] } }, "difficulty": { "easy": { "n": 2620, "accuracy": 0.9908396946564886, "balanced_accuracy": 0.9910415030173665, "f1_deny": 0.9878172588832488, "auroc": 0.9993426040467479, "nll": 0.030170561305981138, "false_approve_rate": 0.00815494393476045, "false_deny_rate": 0.009762050030506406, "false_approve_count": 8, "false_deny_count": 16, "deny_count": 981, "approve_count": 1639, "threshold": 0.5, "brier": 0.007010403321644493, "accuracy_ci95": [ 0.9864055966882352, 0.9938365560354303 ] }, "hard": { "n": 2446, "accuracy": 0.9685200327064595, "balanced_accuracy": 0.9625210098157859, "f1_deny": 0.978267005362687, "auroc": 0.9911069651741294, "nll": 0.13069911233196016, "false_approve_rate": 0.02421171171171171, "false_deny_rate": 0.050746268656716415, "false_approve_count": 43, "false_deny_count": 34, "deny_count": 1776, "approve_count": 670, "threshold": 0.5, "brier": 0.026495231707161258, "accuracy_ci95": [ 0.9608321158876775, 0.974738629618166 ] }, "medium": { "n": 2758, "accuracy": 0.9789702683103698, "balanced_accuracy": 0.9785724767019639, "f1_deny": 0.9760726072607261, "auroc": 0.9969507786466463, "nll": 0.06586538031974604, "false_approve_rate": 0.0247320692497939, "false_deny_rate": 0.018122977346278317, "false_approve_count": 30, "false_deny_count": 28, "deny_count": 1213, "approve_count": 1545, "threshold": 0.5, "brier": 0.016569151558909385, "accuracy_ci95": [ 0.9729115663377526, 0.9836965660957917 ] } }, "lang": { "English": { "n": 5428, "accuracy": 0.9830508474576272, "balanced_accuracy": 0.9829990638035598, "f1_deny": 0.9834234234234234, "auroc": 0.9980603769966497, "nll": 0.05868734256459034, "false_approve_rate": 0.01444564824846515, "false_deny_rate": 0.019556224144415192, "false_approve_count": 40, "false_deny_count": 52, "deny_count": 2769, "approve_count": 2659, "threshold": 0.5, "brier": 0.013681922549593675, "accuracy_ci95": [ 0.9792595662302125, 0.9861588907986353 ] }, "French": { "n": 206, "accuracy": 0.9757281553398058, "balanced_accuracy": 0.9759292537595763, "f1_deny": 0.9769585253456221, "auroc": 0.9968788423342476, "nll": 0.06747322426657866, "false_approve_rate": 0.027522935779816515, "false_deny_rate": 0.020618556701030927, "false_approve_count": 3, "false_deny_count": 2, "deny_count": 109, "approve_count": 97, "threshold": 0.5, "brier": 0.017714886192108086, "accuracy_ci95": [ 0.9444495232323662, 0.9895889699306011 ] }, "German": { "n": 254, "accuracy": 0.9724409448818898, "balanced_accuracy": 0.972, "f1_deny": 0.9711934156378601, "auroc": 0.9936744186046511, "nll": 0.08468604558465347, "false_approve_rate": 0.056, "false_deny_rate": 0.0, "false_approve_count": 7, "false_deny_count": 0, "deny_count": 125, "approve_count": 129, "threshold": 0.5, "brier": 0.020877205555326888, "accuracy_ci95": [ 0.9442169694253162, 0.9865875687498218 ] }, "Hindi": { "n": 251, "accuracy": 0.9561752988047809, "balanced_accuracy": 0.9561269841269842, "f1_deny": 0.9554655870445344, "auroc": 0.9936507936507937, "nll": 0.16196300301681257, "false_approve_rate": 0.056, "false_deny_rate": 0.031746031746031744, "false_approve_count": 7, "false_deny_count": 4, "deny_count": 125, "approve_count": 126, "threshold": 0.5, "brier": 0.0376120230007831, "accuracy_ci95": [ 0.923242415595114, 0.9753554854674595 ] }, "Italian": { "n": 241, "accuracy": 0.9626556016597511, "balanced_accuracy": 0.9611017068697982, "f1_deny": 0.967741935483871, "auroc": 0.9928057553956834, "nll": 0.1424624003128369, "false_approve_rate": 0.02877697841726619, "false_deny_rate": 0.049019607843137254, "false_approve_count": 4, "false_deny_count": 5, "deny_count": 139, "approve_count": 102, "threshold": 0.5, "brier": 0.029007029391025712, "accuracy_ci95": [ 0.930562717164783, 0.9802307451602015 ] }, "Japanese": { "n": 238, "accuracy": 0.9621848739495799, "balanced_accuracy": 0.9617179215270413, "f1_deny": 0.963855421686747, "auroc": 0.9962530929657122, "nll": 0.14281342817116904, "false_approve_rate": 0.024390243902439025, "false_deny_rate": 0.05217391304347826, "false_approve_count": 3, "false_deny_count": 6, "deny_count": 123, "approve_count": 115, "threshold": 0.5, "brier": 0.030221935368084277, "accuracy_ci95": [ 0.9297068944143659, 0.9799799767813301 ] }, "Korean": { "n": 244, "accuracy": 0.9672131147540983, "balanced_accuracy": 0.9652645861601086, "f1_deny": 0.9629629629629629, "auroc": 0.9894843962008142, "nll": 0.16144880368603493, "false_approve_rate": 0.05454545454545454, "false_deny_rate": 0.014925373134328358, "false_approve_count": 6, "false_deny_count": 2, "deny_count": 110, "approve_count": 134, "threshold": 0.5, "brier": 0.02906523927434309, "accuracy_ci95": [ 0.9366484070383405, 0.9832945318262631 ] }, "Mandarin Chinese": { "n": 253, "accuracy": 0.9762845849802372, "balanced_accuracy": 0.9764316079019755, "f1_deny": 0.9765625, "auroc": 0.9958427106776694, "nll": 0.10978973744490537, "false_approve_rate": 0.031007751937984496, "false_deny_rate": 0.016129032258064516, "false_approve_count": 4, "false_deny_count": 2, "deny_count": 129, "approve_count": 124, "threshold": 0.5, "brier": 0.019933183450209797, "accuracy_ci95": [ 0.9492353089010875, 0.9890867248802525 ] }, "Portuguese": { "n": 237, "accuracy": 0.9746835443037974, "balanced_accuracy": 0.9746830935764136, "f1_deny": 0.9745762711864406, "auroc": 0.9950861700612448, "nll": 0.11356332892836708, "false_approve_rate": 0.025423728813559324, "false_deny_rate": 0.025210084033613446, "false_approve_count": 3, "false_deny_count": 3, "deny_count": 118, "approve_count": 119, "threshold": 0.5, "brier": 0.018680321914689435, "accuracy_ci95": [ 0.9458777952286109, 0.9883467402883904 ] }, "Russian": { "n": 211, "accuracy": 0.976303317535545, "balanced_accuracy": 0.9763701707097934, "f1_deny": 0.9760765550239234, "auroc": 0.9952380952380954, "nll": 0.094821800213517, "false_approve_rate": 0.03773584905660377, "false_deny_rate": 0.009523809523809525, "false_approve_count": 4, "false_deny_count": 1, "deny_count": 106, "approve_count": 105, "threshold": 0.5, "brier": 0.021806509755856695, "accuracy_ci95": [ 0.9457369201453067, 0.9898366935479135 ] }, "Spanish": { "n": 261, "accuracy": 0.9961685823754789, "balanced_accuracy": 0.9965277777777778, "f1_deny": 0.9957446808510638, "auroc": 0.9999406457739791, "nll": 0.01287745010770335, "false_approve_rate": 0.0, "false_deny_rate": 0.006944444444444444, "false_approve_count": 0, "false_deny_count": 1, "deny_count": 117, "approve_count": 144, "threshold": 0.5, "brier": 0.0033226244058526515, "accuracy_ci95": [ 0.9786202232618056, 0.9993233402319711 ] } } } }