Publish LightGBM static triage model

README.md

@@ -0,0 +1,41 @@
+---
+license: mit
+tags:
+  - malware
+  - lightgbm
+  - static-analysis
+  - ember
+  - cybersecurity
+library_name: lightgbm
+---
+
+# EMBER Malware Triage — LightGBM Classifier
+
+Binary classifier for static PE malware triage using EMBER-inspired 256-dimensional feature vectors.
+
+## Intended Use
+
+- **Primary:** SOC Tier-1 static triage of unknown PE files
+- **Secondary:** Research and benchmarking on EMBER-style features
+- **Out of scope:** Malware execution, sandbox detonation, exploit generation
+
+## Model Details
+
+| Property | Value |
+|----------|-------|
+| Architecture | LightGBM gradient boosted trees |
+| Features | 256-dim EMBER-inspired vector |
+| Output | Malware probability (0–1) |
+| Training data | Synthetic reproducible benchmark |
+
+## Limitations
+
+- Trained on synthetic features — fine-tune for production
+- Static analysis cannot detect runtime-only behavior
+- Not a substitute for sandbox analysis on high-risk samples
+
+## Bias & Safety
+
+- No real malware samples in training bundle
+- Defensive use only
+- Human analyst review required for enforcement actions

config.json

@@ -0,0 +1,16 @@
+{
+  "engine_version": "1.0.0",
+  "model_type": "lightgbm",
+  "feature_count": 256,
+  "trained_at": "2026-07-31",
+  "dataset": "ember-malware-triage-synthetic",
+  "risk_thresholds": {
+    "low": 0.25,
+    "medium": 0.5,
+    "high": 0.75,
+    "critical": 0.9
+  },
+  "decision_threshold": 0.5496,
+  "validation_roc_auc": 1.0,
+  "validation_pr_auc": 1.0
+}

feature_names.json

@@ -0,0 +1,258 @@
+[
+  "f_0",
+  "f_1",
+  "f_2",
+  "f_3",
+  "f_4",
+  "f_5",
+  "f_6",
+  "f_7",
+  "f_8",
+  "f_9",
+  "f_10",
+  "f_11",
+  "f_12",
+  "f_13",
+  "f_14",
+  "f_15",
+  "f_16",
+  "f_17",
+  "f_18",
+  "f_19",
+  "f_20",
+  "f_21",
+  "f_22",
+  "f_23",
+  "f_24",
+  "f_25",
+  "f_26",
+  "f_27",
+  "f_28",
+  "f_29",
+  "f_30",
+  "f_31",
+  "f_32",
+  "f_33",
+  "f_34",
+  "f_35",
+  "f_36",
+  "f_37",
+  "f_38",
+  "f_39",
+  "f_40",
+  "f_41",
+  "f_42",
+  "f_43",
+  "f_44",
+  "f_45",
+  "f_46",
+  "f_47",
+  "f_48",
+  "f_49",
+  "f_50",
+  "f_51",
+  "f_52",
+  "f_53",
+  "f_54",
+  "f_55",
+  "f_56",
+  "f_57",
+  "f_58",
+  "f_59",
+  "f_60",
+  "f_61",
+  "f_62",
+  "f_63",
+  "f_64",
+  "f_65",
+  "f_66",
+  "f_67",
+  "f_68",
+  "f_69",
+  "f_70",
+  "f_71",
+  "f_72",
+  "f_73",
+  "f_74",
+  "f_75",
+  "f_76",
+  "f_77",
+  "f_78",
+  "f_79",
+  "f_80",
+  "f_81",
+  "f_82",
+  "f_83",
+  "f_84",
+  "f_85",
+  "f_86",
+  "f_87",
+  "f_88",
+  "f_89",
+  "f_90",
+  "f_91",
+  "f_92",
+  "f_93",
+  "f_94",
+  "f_95",
+  "f_96",
+  "f_97",
+  "f_98",
+  "f_99",
+  "f_100",
+  "f_101",
+  "f_102",
+  "f_103",
+  "f_104",
+  "f_105",
+  "f_106",
+  "f_107",
+  "f_108",
+  "f_109",
+  "f_110",
+  "f_111",
+  "f_112",
+  "f_113",
+  "f_114",
+  "f_115",
+  "f_116",
+  "f_117",
+  "f_118",
+  "f_119",
+  "f_120",
+  "f_121",
+  "f_122",
+  "f_123",
+  "f_124",
+  "f_125",
+  "f_126",
+  "f_127",
+  "f_128",
+  "f_129",
+  "f_130",
+  "f_131",
+  "f_132",
+  "f_133",
+  "f_134",
+  "f_135",
+  "f_136",
+  "f_137",
+  "f_138",
+  "f_139",
+  "f_140",
+  "f_141",
+  "f_142",
+  "f_143",
+  "f_144",
+  "f_145",
+  "f_146",
+  "f_147",
+  "f_148",
+  "f_149",
+  "f_150",
+  "f_151",
+  "f_152",
+  "f_153",
+  "f_154",
+  "f_155",
+  "f_156",
+  "f_157",
+  "f_158",
+  "f_159",
+  "f_160",
+  "f_161",
+  "f_162",
+  "f_163",
+  "f_164",
+  "f_165",
+  "f_166",
+  "f_167",
+  "f_168",
+  "f_169",
+  "f_170",
+  "f_171",
+  "f_172",
+  "f_173",
+  "f_174",
+  "f_175",
+  "f_176",
+  "f_177",
+  "f_178",
+  "f_179",
+  "f_180",
+  "f_181",
+  "f_182",
+  "f_183",
+  "f_184",
+  "f_185",
+  "f_186",
+  "f_187",
+  "f_188",
+  "f_189",
+  "f_190",
+  "f_191",
+  "f_192",
+  "f_193",
+  "f_194",
+  "f_195",
+  "f_196",
+  "f_197",
+  "f_198",
+  "f_199",
+  "f_200",
+  "f_201",
+  "f_202",
+  "f_203",
+  "f_204",
+  "f_205",
+  "f_206",
+  "f_207",
+  "f_208",
+  "f_209",
+  "f_210",
+  "f_211",
+  "f_212",
+  "f_213",
+  "f_214",
+  "f_215",
+  "f_216",
+  "f_217",
+  "f_218",
+  "f_219",
+  "f_220",
+  "f_221",
+  "f_222",
+  "f_223",
+  "f_224",
+  "f_225",
+  "f_226",
+  "f_227",
+  "f_228",
+  "f_229",
+  "f_230",
+  "f_231",
+  "f_232",
+  "f_233",
+  "f_234",
+  "f_235",
+  "f_236",
+  "f_237",
+  "f_238",
+  "f_239",
+  "f_240",
+  "f_241",
+  "f_242",
+  "f_243",
+  "f_244",
+  "f_245",
+  "f_246",
+  "f_247",
+  "f_248",
+  "f_249",
+  "f_250",
+  "f_251",
+  "f_252",
+  "f_253",
+  "f_254",
+  "f_255"
+]

lgbm_model.txt

@@ -0,0 +1,191 @@
+tree
+version=v4
+num_class=1
+num_tree_per_iteration=1
+label_index=0
+max_feature_idx=255
+objective=binary sigmoid:1
+feature_names=f_0 f_1 f_2 f_3 f_4 f_5 f_6 f_7 f_8 f_9 f_10 f_11 f_12 f_13 f_14 f_15 f_16 f_17 f_18 f_19 f_20 f_21 f_22 f_23 f_24 f_25 f_26 f_27 f_28 f_29 f_30 f_31 f_32 f_33 f_34 f_35 f_36 f_37 f_38 f_39 f_40 f_41 f_42 f_43 f_44 f_45 f_46 f_47 f_48 f_49 f_50 f_51 f_52 f_53 f_54 f_55 f_56 f_57 f_58 f_59 f_60 f_61 f_62 f_63 f_64 f_65 f_66 f_67 f_68 f_69 f_70 f_71 f_72 f_73 f_74 f_75 f_76 f_77 f_78 f_79 f_80 f_81 f_82 f_83 f_84 f_85 f_86 f_87 f_88 f_89 f_90 f_91 f_92 f_93 f_94 f_95 f_96 f_97 f_98 f_99 f_100 f_101 f_102 f_103 f_104 f_105 f_106 f_107 f_108 f_109 f_110 f_111 f_112 f_113 f_114 f_115 f_116 f_117 f_118 f_119 f_120 f_121 f_122 f_123 f_124 f_125 f_126 f_127 f_128 f_129 f_130 f_131 f_132 f_133 f_134 f_135 f_136 f_137 f_138 f_139 f_140 f_141 f_142 f_143 f_144 f_145 f_146 f_147 f_148 f_149 f_150 f_151 f_152 f_153 f_154 f_155 f_156 f_157 f_158 f_159 f_160 f_161 f_162 f_163 f_164 f_165 f_166 f_167 f_168 f_169 f_170 f_171 f_172 f_173 f_174 f_175 f_176 f_177 f_178 f_179 f_180 f_181 f_182 f_183 f_184 f_185 f_186 f_187 f_188 f_189 f_190 f_191 f_192 f_193 f_194 f_195 f_196 f_197 f_198 f_199 f_200 f_201 f_202 f_203 f_204 f_205 f_206 f_207 f_208 f_209 f_210 f_211 f_212 f_213 f_214 f_215 f_216 f_217 f_218 f_219 f_220 f_221 f_222 f_223 f_224 f_225 f_226 f_227 f_228 f_229 f_230 f_231 f_232 f_233 f_234 f_235 f_236 f_237 f_238 f_239 f_240 f_241 f_242 f_243 f_244 f_245 f_246 f_247 f_248 f_249 f_250 f_251 f_252 f_253 f_254 f_255
+feature_infos=[0.00017192754603456706:0.29974421858787537] [0.00013818791194353253:0.29992979764938354] none [0.00020460311498027295:0.29990461468696594] [0.00016305666940752417:0.29987090826034546] [4.003235517302528e-05:0.97980475425720215] [8.3576225733850151e-05:0.94872355461120605] [0.15055708587169647:0.99997943639755249] [0.00015611272829119116:0.949981689453125] [7.0043002779129893e-05:0.29956072568893433] [2.7633997888187878e-05:0.29995885491371155] [0.00033379456726834178:0.29904851317405701] [4.8533187509747222e-05:0.29986995458602905] [0.00017772997671272606:0.29998001456260681] [5.5079839512472972e-05:0.29986527562141418] [1.2118503946112469e-05:0.29973340034484863] [9.7052216005977243e-05:0.29993316531181335] [0.00028691257466562092:0.29971000552177429] [1.1153251762152649e-05:0.29992642998695374] [0.00016469803813379258:0.29988265037536621] [0.00063626986229792237:0.29976031184196472] [5.7827091950457543e-05:0.29992210865020752] [0.00059391540708020329:0.29966661334037781] [3.82038633688353e-05:0.29993534088134766] [5.3689527703681961e-05:0.29992076754570007] [0.00030607162625528872:0.2998473048210144] [2.4884098820621148e-05:0.29950755834579468] [3.9842325350036845e-05:0.29982432723045349] [0.00023317070736084133:0.29983535408973694] [2.6328860258217901e-05:0.29972749948501587] [5.0960911721631419e-06:0.29994741082191467] [0.00027265149401500821:0.29964214563369751] [0.00036280712811276317:0.29966723918914795] [9.4339055067393929e-05:0.29989749193191528] [8.6619766079820693e-05:0.29975530505180359] [8.3128084952477366e-05:0.29993659257888794] [0.00059790158411487937:0.299854576587677] [8.9033128460869193e-05:0.29963436722755432] [0.00022604042897000909:0.29982516169548035] [4.5480694097932428e-05:0.29968863725662231] [2.5598906177037861e-06:0.29991152882575989] [4.1421859350521117e-05:0.29958507418632507] [0.0001923259551404044:0.29997804760932922] [0.00012172332935733721:0.29989993572235107] [0.00012620179040823132:0.29998829960823059] [3.9602287870366126e-05:0.29982316493988037] [2.924767613876611e-05:0.29980692267417908] [6.8011184339411557e-05:0.29996815323829651] [8.9146808022633195e-05:0.29996892809867859] [2.5229135644622147e-05:0.29967477917671204] [3.6562141758622602e-05:0.29983758926391602] [2.6137109671253711e-05:0.29984518885612488] [0.00015597246238030493:0.29994922876358032] [0.00035126146394759417:0.29995507001876831] [4.133558104513213e-05:0.29988971352577209] [5.611494998447597e-05:0.29984453320503235] [0.00016973550373222679:0.29993951320648193] [5.7702240155776963e-05:0.29987809062004089] [0.00023101682018022984:0.29961311817169189] [6.3814484747126698e-05:0.29999607801437378] [3.4243334084749222e-05:0.29985338449478149] [8.16308383946307e-05:0.29979738593101501] [0.0002646721841301769:0.2999090850353241] [5.0443242798792198e-05:0.29990658164024353] [4.6043147449381649e-05:0.29981130361557007] [0.00012054900435032323:0.29988890886306763] [5.5151860578916967e-05:0.29977703094482422] [8.6926571384537965e-05:0.29991912841796875] [2.7129446607432328e-05:0.29992932081222534] [1.9003991837962531e-06:0.29996711015701294] [0.00019777161651290953:0.29990160465240479] [3.1216324714478105e-05:0.29993918538093567] [0.000573397905100137:0.29993540048599243] [3.6036191886523739e-05:0.29985132813453674] [5.8871260989690199e-05:0.29999387264251709] [2.6734318453236483e-05:0.29999607801437378] [3.5364289942663163e-05:0.29979532957077026] [0.0002513181243557483:0.29980340600013733] [1.4944130271032918e-05:0.29995480179786682] [0.00014564981393050402:0.29983028769493103] [0.00045438902452588081:0.9998699426651001] [0.00027993359253741801:0.99979650974273682] [0.00067539716837927699:0.99999117851257324] [0.00012122635234845802:0.99999380111694336] [4.6198147174436599e-05:0.9998708963394165] [0.00022910920961294323:0.99960440397262573] [0.00027903396403416991:0.99995595216751099] [3.9163634937722236e-05:0.99981588125228882] [0.00012775651703123003:0.29987367987632751] [0.00078929879236966372:0.29998931288719177] [0.00023724896891508251:0.29997080564498901] [4.8742407670943066e-05:0.29980990290641785] [6.1805789300706238e-05:0.29999470710754395] [2.2671176338917576e-05:0.29962939023971558] [0.00035421948996372521:0.29975384473800659] [7.3708586569409817e-05:0.29999563097953796] [8.0083045759238303e-05:0.29994863271713257] [0.00011505048314575106:0.29987236857414246] [0.00022191308380570263:0.29987123608589172] [0.00010202447447227314:0.29979312419891357] [9.8183045338373631e-05:0.29996234178543091] [2.2159834770718589e-05:0.29961836338043213] [6.6090760810766369e-05:0.29995477199554443] [0.00013397833390627056:0.29998135566711426] [5.1929371693404391e-05:0.29962548613548279] [6.3484701968263835e-05:0.29997128248214722] [2.3106971639208496e-05:0.29978379607200623] [0.00017831372679211199:0.29985392093658447] [8.2574260886758566e-05:0.29998627305030823] [0.000486263248603791:0.29984521865844727] [1.2721905477519613e-05:0.89982116222381592] [4.9620612116996199e-05:0.89849704504013062] [2.4178290914278477e-05:0.8986656665802002] [8.5774467152077705e-05:0.89941287040710449] [0.0003577927709557116:0.89976519346237183] [9.6992996986955404e-05:0.29944580793380737] [5.5205622629728168e-05:0.29990625381469727] [1.6800860976218246e-05:0.29995289444923401] [4.4667835027212277e-05:0.29998743534088135] [3.7331759813241661e-05:0.29985570907592773] [0.00012499223521444947:0.29988521337509155] none [6.3998260884545743e-05:0.29985761642456055] [2.7432066417532042e-05:0.29954022169113159] [7.0811751356814057e-05:0.29994261264801025] [0.0002704979560803622:0.29994189739227295] [3.1422376196132973e-05:0.29988259077072144] [0.00010637444938765839:0.29997047781944275] [4.6127952373353764e-05:0.29994344711303711] [0.00017520025721751153:0.29936939477920532] [0.00014615015243180096:0.29990553855895996] [9.8454125691205263e-05:0.29999619722366333] [0.00034124936792068183:0.29949027299880981] [3.6721714423038065e-05:0.29993465542793274] [5.4513416216650512e-06:0.29986795783042908] [0.00010164880222873762:0.29958987236022949] [0.00012653287558350712:0.29995197057723999] [0.00016345930634997785:0.29984486103057861] [4.144516060478054e-05:0.29972144961357117] [9.8899945442099124e-05:0.29979786276817322] [0.00037969619734212756:0.29980418086051941] [9.6320152806583792e-05:0.29990106821060181] [0.00029138411628082395:0.29983749985694885] [3.9522510633105412e-05:0.29986864328384399] [4.3239400838501751e-05:0.29989758133888245] [0.00014495247160084546:0.29993459582328796] [1.6366304407711141e-05:0.29995766282081604] [1.01422765510506e-05:0.29991370439529419] [6.3149855122901499e-05:0.29988914728164673] [0.00035235442919656634:0.29947629570960999] [0.00046747468877583742:0.29998207092285156] [2.0909606973873451e-05:0.29976290464401245] [2.0372204744489864e-05:0.29978889226913452] [7.3884788434952497e-05:0.29975885152816772] [9.5064169727265835e-05:0.29966369271278381] [5.3163475968176499e-05:0.29988664388656616] [0.00015463476302102208:0.29997751116752625] [4.9317088269162923e-05:0.29988998174667358] [1.5806568626430817e-05:0.29991152882575989] [0.00038727937499061227:0.29991188645362854] [6.0045658756280318e-05:0.29992124438285828] [0.00014117799582891166:0.29997256398200989] [2.7981912353425287e-05:0.29989838600158691] [0.00015902095765341073:0.29984065890312195] [7.2095608629751951e-05:0.29957154393196106] [4.4658143451670185e-05:0.29992279410362244] [3.5718287108466029e-05:0.29988434910774231] [1.1751435522455722e-05:0.29987210035324097] [0.00016703541041351855:0.29999017715454102] [7.0438283728435636e-05:0.2996755838394165] [0.00014290174294728786:0.2997291088104248] [0.00011843745596706867:0.29988420009613037] [5.9654863434843719e-05:0.29996302723884583] [5.1823622925439849e-05:0.29999485611915588] [7.4574032623786479e-05:0.29987329244613647] [0.00029372950666584074:0.29987356066703796] [7.8793309512548149e-05:0.29994046688079834] [0.00028993721934966743:0.29995080828666687] [0.00010440975893288851:0.29971998929977417] [0.00044239754788577557:0.29997700452804565] [0.00041152010089717805:0.29994162917137146] [0.00016689000767655671:0.29996952414512634] [0.0002172598906327039:0.29974076151847839] [1.9799992514890619e-05:0.29980745911598206] [0.00041071994928643107:0.29998427629470825] [7.2186645411420614e-05:0.29992091655731201] [0.00019706894818227738:0.29994446039199829] [0.00011507292947499081:0.29994481801986694] [0.00014407692651730031:0.29984566569328308] [2.7151421818416566e-05:0.29990610480308533] [1.0679713341232855e-05:0.29992035031318665] [2.6158993932767771e-05:0.29968914389610291] [4.0491959225619212e-06:0.29981821775436401] [0.00013293456868268549:0.29980987310409546] [8.1655409303493798e-05:0.29998138546943665] [0.00039520434802398086:0.29968947172164917] [9.53318813117221e-05:0.29994142055511475] [9.9716155091300607e-05:0.29984885454177856] [0.00040071964031085372:0.29992720484733582] [6.7216351453680545e-05:0.29979237914085388] [1.8183249267167412e-05:0.29986149072647095] [3.3089763746829703e-05:0.29996371269226074] [2.0686402422143146e-06:0.29999455809593201] [0.00038675984251312912:0.29997670650482178] [0.00018691322475206107:0.29990026354789734] [0.00022535123571287841:0.2997899055480957] [0.00026382083888165653:0.29988887906074524] [0.00039279466727748513:0.29989135265350342] [0.0004000734188593924:0.29991695284843445] [0.00011865617125295103:0.29995140433311462] [0.00024909753119572997:0.29962578415870667] [0.0001321367162745446:0.29987344145774841] [0.00041521823732182384:0.29993748664855957] [9.3231195933185518e-05:0.29992055892944336] [2.6159616481891135e-06:0.29982808232307434] [0.00045719367335550487:0.2999858558177948] [4.3332151108188555e-05:0.29945886135101318] [0.00031130816205404699:0.2999875545501709] [3.8090478483354673e-05:0.29994630813598633] [4.4902131776325405e-05:0.2999783456325531] [0.00029194095986895263:0.2999744713306427] [0.00018277813796885312:0.2998771071434021] [0.00035535503411665559:0.2999451756477356] [4.4219636038178578e-05:0.29999938607215881] [0.00014499748067464679:0.29995235800743103] [0.00011847682617371902:0.29999127984046936] [0.0003645741380751133:0.29998663067817688] [9.8686206911224872e-05:0.29949766397476196] [7.1296045689450693e-07:0.29974818229675293] [3.1197432690532878e-05:0.29987654089927673] [8.530596096534282e-05:0.29986244440078735] [2.2564761820831336e-05:0.29991063475608826] [0.00040289032040163875:0.29999995231628418] [0.00013490444689523429:0.29992234706878662] [0.00025039227330125868:0.2998630702495575] [0.00043236120836809278:0.2999243438243866] [3.6956378608010709e-05:0.29995507001876831] [4.2221639887429774e-05:0.29983800649642944] [7.5829899287782609e-05:0.29998782277107239] [4.2480558477109298e-05:0.29994297027587891] [0.00029887096025049686:0.29971656203269958] [9.7801876108860597e-06:0.29978641867637634] [0.00046476433635689318:0.29983863234519958] [5.0252714345333516e-07:0.29996505379676819] [0.0003242095117457211:0.29998618364334106] [0.00039106482290662825:0.29979845881462097] [7.6763324614148587e-05:0.29993411898612976] [0.00015552582044620067:0.29967415332794189] [7.6392549090087414e-05:0.29996401071548462] [0.00030576184508390725:0.29992210865020752] [1.4799484233662952e-05:0.29997009038925171] [6.5490115957800299e-05:0.29987621307373047] [0.0002149401989299804:0.29993155598640442] [0.00049593148287385702:0.29995903372764587] [0.00021718224161304533:0.29977506399154663] [0.00026108167367056012:0.29985031485557556]
+tree_sizes=778 1521
+
+Tree=0
+num_leaves=6
+num_cat=0
+split_feature=113 5 0 0 0
+split_gain=1591.48 0.196393 1.13687e-13 1.13687e-13 2.84217e-14
+threshold=0.29828098416328436 0.65724179148674022 0.28638622164726263 0.083198722451925292 0.011058719363063576
+decision_type=2 2 2 2 2
+left_child=-1 -2 3 4 -3
+right_child=1 2 -4 -5 -6
+leaf_value=-0.38248887071232818 0.0013495094285121689 0.02155152943592481 0.02155152943592481 0.02155152943592481 0.02155152943592481
+leaf_weight=217.30500209331512 4.9500000476837149 5.1975000500679007 8.6625000834465009 116.07750111818314 42.817500412464142
+leaf_count=878 20 21 35 469 173
+internal_value=-0.200974 0.0209888 0.0215515 0.0215515 0.0215515
+internal_weight=395.01 177.705 172.755 164.093 48.015
+internal_count=1596 718 698 663 194
+is_linear=0
+shrinkage=1
+
+
+Tree=1
+num_leaves=13
+num_cat=0
+split_feature=111 54 102 122 45 166 3 14 55 0 94 0
+split_gain=1298.65 0.170106 0.00128751 4.82584e-05 8.99236e-05 4.72434e-05 6.23314e-05 2.29582e-05 1.84281e-05 2.2987e-05 9.01135e-06 1.13687e-13
+threshold=0.45048326253890997 0.0046055156271904716 0.29246804118156439 0.025002873502671722 0.14448667317628863 0.27987943589687353 0.1819420009851456 0.28404833376407629 0.019920052029192451 0.17113484442234042 0.27895134687423712 0.24715521186590197
+decision_type=2 2 2 2 2 2 2 2 2 2 2 2
+left_child=1 -1 11 4 -2 7 -7 8 9 -5 -10 -3
+right_child=3 2 -4 5 -6 6 -8 -9 10 -11 -12 -13
+leaf_value=-0.14927144173644566 0.19841265366672622 -0.16821615383017799 -0.16986812529921577 0.19816752276332494 0.1978679088763291 0.19786790887632918 0.19836725957994253 0.19806120934807814 0.19786790887632913 0.1978679088763291 0.19796534542727517 -0.16821615383017799
+leaf_weight=4.8303921818733206 5.4995348453521711 164.65408873558044 4.8304210901260367 4.9995061755180341 6.7492162585258484 4.9994194507598859 4.999563992023468 7.7491868734359732 128.48507988452911 5.2493904232978821 10.2488676905632 37.848743677139282
+leaf_count=20 22 683 20 20 27 20 20 31 514 21 41 157
+internal_value=-0.000465259 -0.167822 -0.168255 0.197921 0.198112 0.197907 0.198118 0.197893 0.197885 0.198014 0.197875 -0.168216
+internal_weight=391.143 212.164 207.333 178.98 12.2488 166.731 9.99898 156.732 148.983 10.2489 138.734 202.503
+internal_count=1596 880 860 716 49 667 40 627 596 41 555 840
+is_linear=0
+shrinkage=0.1
+
+
+end of trees
+
+feature_importances:
+f_0=5
+f_3=1
+f_5=1
+f_14=1
+f_45=1
+f_54=1
+f_55=1
+f_94=1
+f_102=1
+f_111=1
+f_113=1
+f_122=1
+f_166=1
+
+parameters:
+[boosting: gbdt]
+[objective: binary]
+[metric: auc,binary_logloss]
+[tree_learner: serial]
+[device_type: cpu]
+[data_sample_strategy: bagging]
+[data: ]
+[valid: ]
+[num_iterations: 100]
+[learning_rate: 0.1]
+[num_leaves: 31]
+[num_threads: 0]
+[seed: 42]
+[deterministic: 0]
+[force_col_wise: 0]
+[force_row_wise: 0]
+[histogram_pool_size: -1]
+[max_depth: 6]
+[min_data_in_leaf: 20]
+[min_sum_hessian_in_leaf: 0.001]
+[bagging_fraction: 0.8]
+[pos_bagging_fraction: 1]
+[neg_bagging_fraction: 1]
+[bagging_freq: 5]
+[bagging_seed: 400]
+[bagging_by_query: 0]
+[feature_fraction: 0.9]
+[feature_fraction_bynode: 1]
+[feature_fraction_seed: 30056]
+[extra_trees: 0]
+[extra_seed: 12879]
+[early_stopping_round: 0]
+[early_stopping_min_delta: 0]
+[first_metric_only: 0]
+[max_delta_step: 0]
+[lambda_l1: 0]
+[lambda_l2: 0]
+[linear_lambda: 0]
+[min_gain_to_split: 0]
+[drop_rate: 0.1]
+[max_drop: 50]
+[skip_drop: 0.5]
+[xgboost_dart_mode: 0]
+[uniform_drop: 0]
+[drop_seed: 17869]
+[top_rate: 0.2]
+[other_rate: 0.1]
+[min_data_per_group: 100]
+[max_cat_threshold: 32]
+[cat_l2: 10]
+[cat_smooth: 10]
+[max_cat_to_onehot: 4]
+[top_k: 20]
+[monotone_constraints: ]
+[monotone_constraints_method: basic]
+[monotone_penalty: 0]
+[feature_contri: ]
+[forcedsplits_filename: ]
+[refit_decay_rate: 0.9]
+[cegb_tradeoff: 1]
+[cegb_penalty_split: 0]
+[cegb_penalty_feature_lazy: ]
+[cegb_penalty_feature_coupled: ]
+[path_smooth: 0]
+[interaction_constraints: ]
+[verbosity: -1]
+[saved_feature_importance_type: 0]
+[use_quantized_grad: 0]
+[num_grad_quant_bins: 4]
+[quant_train_renew_leaf: 0]
+[stochastic_rounding: 1]
+[linear_tree: 0]
+[max_bin: 255]
+[max_bin_by_feature: ]
+[min_data_in_bin: 3]
+[bin_construct_sample_cnt: 200000]
+[data_random_seed: 175]
+[is_enable_sparse: 1]
+[enable_bundle: 1]
+[use_missing: 1]
+[zero_as_missing: 0]
+[feature_pre_filter: 1]
+[pre_partition: 0]
+[two_round: 0]
+[header: 0]
+[label_column: ]
+[weight_column: ]
+[group_column: ]
+[ignore_column: ]
+[categorical_feature: ]
+[forcedbins_filename: ]
+[precise_float_parser: 0]
+[parser_config_file: ]
+[objective_seed: 16083]
+[num_class: 1]
+[is_unbalance: 0]
+[scale_pos_weight: 1]
+[sigmoid: 1]
+[boost_from_average: 1]
+[reg_sqrt: 0]
+[alpha: 0.9]
+[fair_c: 1]
+[poisson_max_delta_step: 0.7]
+[tweedie_variance_power: 1.5]
+[lambdarank_truncation_level: 30]
+[lambdarank_norm: 1]
+[label_gain: ]
+[lambdarank_position_bias_regularization: 0]
+[eval_at: ]
+[multi_error_top_k: 1]
+[auc_mu_weights: ]
+[num_machines: 1]
+[local_listen_port: 12400]
+[time_out: 120]
+[machine_list_filename: ]
+[machines: ]
+[gpu_platform_id: -1]
+[gpu_device_id: -1]
+[gpu_use_dp: 0]
+[num_gpu: 1]
+
+end of parameters
+
+pandas_categorical:null

train_metrics.json

@@ -0,0 +1,8 @@
+{
+  "roc_auc": 1.0,
+  "pr_auc": 1.0,
+  "train_samples": 2000,
+  "val_samples": 500,
+  "best_iteration": 2,
+  "passed": true
+}

yara_rules/packer_indicators.yar

@@ -0,0 +1,12 @@
+rule Custom_Packer_Indicator {
+  meta:
+    author = "Aria AI Threat Research"
+    description = "Additional packer section name indicator"
+    severity = "high"
+    category = "packer"
+  strings:
+    $sec = ".packed" ascii
+    $upx = "UPX!" ascii
+  condition:
+    any of them
+}