ShadowCore-v1 is a compact sequence classification model designed to analyze short network-behavior streams and classify overall system state in real time.
The model operates on a minimal four-token vocabulary representing abstract network activity and can detect healthy, degraded, and potentially dangerous traffic patterns with millisecond-scale inference latency on modern hardware.
Overview
ShadowCore-v1 was created to explore whether a small specialized model can perform behavior-level network analysis without requiring massive LLM-scale architectures.
Instead of processing raw packets, logs, or protocol metadata, ShadowCore-v1 analyzes compressed symbolic sequences that represent network behavior over time.
The model is intended for:
Network health monitoring
Congestion detection
Anomaly detection
Traffic pattern analysis
Lightweight edge deployment
Real-time alerting systems
Vocabulary
ShadowCore-v1 uses a fixed vocabulary of only four tokens:
Token
Meaning
U
Upload activity
D
Download activity
+
High latency / congestion / waiting
-
Processing completed / idle time
Example:
UU--DD--UU--DD--
Interpretation:
text
1Request
2↓
3Processing
4↓
5Response
6↓
7Idle
This pattern generally represents healthy behavior.
ShadowCore-v1 is built on the same core architecture family used in previous successful experiments including:
GenoLite
IsingBreaker
ShadowCore
Key design goals:
Small parameter count
Fast training
Fast inference
Low memory usage
Strong pattern recognition on symbolic sequences
Model size:
~88 Million Parameters
Dataset
Training data was generated using a rule-based synthetic behavior generator.
Dataset characteristics:
text
14,500 samples
21,500 NORMAL
31,500 CRITICAL
41,500 DANGER
Features:
Fixed-length sequences
Duplicate filtering
Motif composition
Cluster variation
Sequence rotation
Behavioral balancing
The generator was designed to teach behavior patterns rather than memorization of exact sequences.
Benchmark Results
Evaluation Accuracy:
94.07%
The model consistently identifies:
Healthy traffic patterns
Growing congestion states
Severe overload conditions
Testing also demonstrated reasonable behavior on ambiguous boundary cases, where the model produces mixed confidence instead of collapsing into a single class prediction.
Performance
Training Environment:
text
1NVIDIA T4
2Batch Size: 64
3Epochs: 5
Training Time:
~4.5 minutes
Inference:
Millisecond-scale
on modern GPUs and suitable for real-time monitoring pipelines.
While the model successfully learns network-behavior concepts, production deployment should include:
Real traffic validation
Domain-specific calibration
Additional anomaly classes
Real-world benchmark datasets
Future Work
Planned improvements:
ShadowCore-v2
Larger motif library
Real traffic traces
Multi-stage anomaly classification
Attack family detection
Early-warning forecasting
License
Research & Experimental Use
ShadowCore-v1 demonstrates that lightweight specialized models can achieve >90% accuracy on behavior-oriented sequence classification tasks without requiring large-scale foundation models. 🚀
