EMBER Malware Triage — LightGBM Classifier
Binary classifier for static PE malware triage using EMBER-inspired 256-dimensional feature vectors.
Intended Use
- Primary: SOC Tier-1 static triage of unknown PE files
- Secondary: Research and benchmarking on EMBER-style features
- Out of scope: Malware execution, sandbox detonation, exploit generation
Model Details
| Property | Value |
|---|---|
| Architecture | LightGBM gradient boosted trees |
| Features | 256-dim EMBER-inspired vector |
| Output | Malware probability (0–1) |
| Calibration | Isotonic regression on holdout |
| Training data | Synthetic reproducible benchmark |
Limitations
- Trained on synthetic features — fine-tune for production
- Static analysis cannot detect runtime-only behavior
- Not a substitute for sandbox analysis on high-risk samples
Bias & Safety
- No real malware samples in training bundle
- Defensive use only
- Human analyst review required for enforcement actions