---
license: mit
tags:
  - malware
  - lightgbm
  - static-analysis
  - ember
  - cybersecurity
library_name: lightgbm
---

# EMBER Malware Triage — LightGBM Classifier

Binary classifier for static PE malware triage using EMBER-inspired 256-dimensional feature vectors.

## Intended Use

- **Primary:** SOC Tier-1 static triage of unknown PE files
- **Secondary:** Research and benchmarking on EMBER-style features
- **Out of scope:** Malware execution, sandbox detonation, exploit generation

## Model Details

| Property | Value |
|----------|-------|
| Architecture | LightGBM gradient boosted trees |
| Features | 256-dim EMBER-inspired vector |
| Output | Malware probability (0–1) |
| Calibration | Isotonic regression on holdout |
| Training data | Synthetic reproducible benchmark |

## Limitations

- Trained on synthetic features — fine-tune for production
- Static analysis cannot detect runtime-only behavior
- Not a substitute for sandbox analysis on high-risk samples

## Bias & Safety

- No real malware samples in training bundle
- Defensive use only
- Human analyst review required for enforcement actions