LightGBM specialist for python. Member of the Azoth routed ensemble; bundle root: ../...
Level labels use the shared pool-adjusted FP allowance: L0 allows zero observed calibration FPs; L1 allows one; L25 adds an estimated 24 FP/100M beyond the initial FP.
Routed ensemble (general + filegroup + filetype where applicable) on the python slice of the locked test partition: 2,626 malware / 85,335 benign (87,961 rows).
| PR AUC | ROC AUC | F1 | Recall @ L25 | Brier |
|---|---|---|---|---|
| 0.951566 | 0.995435 | 0.803815 | 67.40% | - |
filetypes/python specialist scored alone on the same held-out slice, using its saved thresholds.
| PR AUC | ROC AUC | F1 | Recall @ L25 | Brier | Δ vs EMBER 2024 |
|---|---|---|---|---|---|
| 0.950927 | 0.996534 | 0.765798 | 62.07% | 0.0058 | — |
Each curve plots recall at the route's pool-adjusted FP level. L0 allows zero observed calibration FPs; positive L allows 1 + (L - 1) * N / 100_000_000 for N benigns. See the shared level definition. The vertical dashed line marks the L25 deploy operating point.
Files matching python are scored by filegroups/scripts, filetypes/python, general. The ensemble's decisions apply the saved routing policy, including every level at or below the requested level. Ranking metrics use the signed distance from that policy's decision boundary. See route_policies.md.
| Parameter | Value |
|---|---|
| Algorithm | LightGBM binary classifier |
| Train rows | 530,176 (16,735 mal / 513,441 ben) |
| Feature spec | 1634 features (route_specific) |
| n_estimators | 400 |
| num_leaves | 96 |
| max_depth | 12 |
| min_child_samples | 100 |
| learning_rate | 0.05 |
| subsample / colsample | 0.8 / 0.8 |
| reg_alpha / reg_lambda | 0.0 / 1.0 |
| early_stopping_rounds | 25 |
| device | auto |