Create README.md

README.md

@@ -0,0 +1,86 @@
+license: apache-2.0
+language: []
+tags: [arm64, aarch64, malware-detection, AV, EDR, XDR, Rust, security, binary-analysis]
+pipeline_tag: other
+library_name: none
+base_model: null
+new_version: v0.0.1
+model-index:
+- name: WinnCore ARM64 AV Baseline
+  results:
+  - task: {type: binary-classification, name: Malware detection}
+    dataset: {name: WinnCore ARM64 Corpus v0, type: winncore/arm64-corpus, split: test}
+    metrics:
+    - {name: ROC-AUC, type: roc-auc, value: 0.000}
+    - {name: Average Precision, type: average_precision, value: 0.000}
+    - {name: FPR@TPR=95%, type: fpr_at_tpr_95, value: 0.000}
+    - {name: FPR@TPR=99%, type: fpr_at_tpr_99, value: 0.000}
+---
+# WinnCore ARM64 AV Baseline
+
+An ARM64-first malware detection baseline. Features a Rust-based extractor for generating JSONL features, followed by LightGBM training and ONNX export.
+
+**Important:** No live malware binaries are included in this repository. Only hashes, feature rows, code, and reports are shared.
+
+## Scope & Safety
+
+- **Do not upload samples.** Share only SHA-256 hashes and feature rows.
+- Perform training and evaluation in an isolated environment.
+- This is an R&D baseline only—not intended for production EDR use.
+
+## Repository Layout
+
+```
+extractor/   # Rust feature extractor (AArch64 disassembly, headers, n-grams)
+training/    # Python scripts for training and ONNX export
+models/      # Exported models (e.g., gbm_v0.onnx)
+datasets/    # Manifests and features (no binaries)
+eval/        # Metrics tables, plots, and write-ups
+```
+
+## Quick Start
+
+```bash
+# Build the extractor
+cd extractor && cargo build --release
+
+# Extract features from binaries
+./target/release/arm64_extractor /path/to/binaries datasets/features.jsonl
+
+# Train LightGBM and export to ONNX
+python training/train_lightgbm.py \
+  --features datasets/features.jsonl \
+  --out models/gbm_v0.onnx \
+  --report eval/report_v0.md
+```
+
+## Metrics Protocol
+
+Report the following metrics and optimize for low false positives:
+
+- ROC-AUC
+- PR-AUC (Average Precision)
+- FPR@TPR=95%
+- FPR@TPR=99%
+
+Targets for future improvements: FPR@TPR=95% ≤ 1%, FPR@TPR=99% ≤ 5% on unseen data.
+
+## Dataset Manifest (Example)
+
+Located at `datasets/manifest.jsonl`:
+
+```json
+{"sha256": "<hash>", "label": 1, "arch": "aarch64", "source": "internal_sandbox", "ts": "2025-11-02"}
+```
+
+## Reproducibility Tips
+
+- Use small, atomic commits.
+- Leverage Git LFS for large files like *.onnx, *.pt, *.bin, *.pkl.
+- Pin dependency versions in `training/requirements.txt` and `rust-toolchain.toml`.
+- Evaluate performance at fixed thresholds, not just AUC scores.
+
+## Legal
+
+Licensed under Apache-2.0. No redistribution of malware binaries is permitted. Use at your own risk.
+```