Zone Model And Scoring

Zone Model & Behavioral Scoring Engine (BSE)

Every tracked process is continuously assigned to one of three execution zones based on its smoothed Behavioral Risk Score (S_t / EMA score). A zone transition — not an individual syscall — is the fundamental unit of analysis.

Dimensions

The composite score is a weighted sum across six behavioral dimensions:

Index	Dimension	Weight	Source
0	KB_DIM_PROCESS	20%	fork/exec/exit lineage
1	KB_DIM_SYSCALL	25%	windowed syscall-distribution entropy
2	KB_DIM_PRIVILEGE	20%	UID/GID/capability transitions
3	KB_DIM_FILE	10%	sensitive file access
4	KB_DIM_NETWORK	10%	connect/bind activity
5	KB_DIM_MEMORY	15%	RWX / anon+exec mappings, W^X violations

Every non-terminal containment action is designed to be reversible if the process's score normalizes.