LightGBM specialist for pyc, python-bytecode, python_bytecode. Member of the Azoth routed ensemble; bundle root: ../...
Level labels use the shared pool-adjusted FP allowance: L0 allows zero observed calibration FPs; L1 allows one; L25 adds an estimated 24 FP/100M beyond the initial FP.
Routed ensemble (general + filegroup + filetype where applicable) on the python_bytecode slice of the locked test partition: 403 malware / 154,295 benign (154,698 rows).
| PR AUC | ROC AUC | F1 | Recall @ L25 | Brier |
|---|---|---|---|---|
| 0.940567 | 0.998587 | 0.825911 | 75.93% | - |
filetypes/python_bytecode specialist scored alone on the same held-out slice, using its saved thresholds.
| PR AUC | ROC AUC | F1 | Recall @ L25 | Brier | Δ vs EMBER 2024 |
|---|---|---|---|---|---|
| 0.921612 | 0.996893 | 0.668863 | 50.37% | 0.0027 | — |
Each curve plots recall at the route's pool-adjusted FP level. L0 allows zero observed calibration FPs; positive L allows 1 + (L - 1) * N / 100_000_000 for N benigns. See the shared level definition. The vertical dashed line marks the L25 deploy operating point.
Files matching python_bytecode are scored by filegroups/portable, filetypes/python_bytecode, general. The ensemble's decisions apply the saved routing policy, including every level at or below the requested level. Ranking metrics use the signed distance from that policy's decision boundary. See route_policies.md.
| Parameter | Value |
|---|---|
| Algorithm | LightGBM binary classifier |
| Train rows | 931,348 (2,534 mal / 928,814 ben) |
| Feature spec | 12009 features (route_specific) |
| n_estimators | 250 |
| num_leaves | 96 |
| max_depth | 12 |
| min_child_samples | 100 |
| learning_rate | 0.05 |
| subsample / colsample | 0.8 / 0.8 |
| reg_alpha / reg_lambda | 0 / 1 |
| early_stopping_rounds | 25 |
| device | auto |