[viktorbeck98]

Task

No issue. ECVC detection was too slow to run on HDFS and BGL (days per detector run).

Description

ECVCOp.calculate_score compared each detection window with every learned count vector in a Python loop, so the cost per log line grew with the number of learned vectors.

• calculate_score now scores all rows at once with numpy. Same formula, same result (sum |m - y| / sum max(m, y), minimum over the rows; still inf for an empty matrix).
• A window equal to a learned vector scores 0, which never exceeds the threshold. detect now returns early for those, using a set of the learned vectors (known_vecs, training split only). The key is built from the vector that would be scored, so windows containing eventID -1 are handled exactly as the score handles them.

No config or behaviour change: alerts and scores are identical.

How Has This Been Tested?

• New tests compare against the old row loop: calculate_score on random matrices, and detect against a full scan over random windows, including validation-split vectors and eventID -1. A third test checks that a window seen in training skips the scan.
• ECVC, persistence and pipeline tests pass, including --run-ignored.
• Old vs new on real data at cut 0.5, with ECVC at window_size: 10 (BGL and HDFS truncated to 200k rows):

dataset	lines detected	learned vectors	alerts old / new	old	new
AIT Firewall (russell_mitchell)	30k	157	8,515 / 8,515	1.04 ms/line	0.22 ms/line
BGL	30k	841	814 / 814	7.0 ms/line	1.7 ms/line
HDFS	20k	1,168	5 / 5	6.9 ms/line	0.21 ms/line

Alert rows and scores are identical on all three.

Checklist

• This Pull-Request goes to the development branch.
• I have successfully run prek locally.
• I have added tests to cover my changes.
• I have linked the issue-id to the task-description.
• I have performed a self-review of my own code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[ipmach]

looks good