---
license: apache-2.0
---
license: apache-2.0
language: [none]
tags:
  - arm64
  - aarch64
  - malware-detection
  - AV
  - EDR
  - XDR
  - Rust
  - security
  - binary-analysis
pipeline_tag: other
library_name: none
base_model: null
new_version: v0.0.1
model-index:
  - name: WinnCore ARM64 AV Baseline
    results:
      - task:
          type: binary-classification
          name: Malware detection
        dataset:
          name: WinnCore ARM64 Corpus v0
          type: winncore/arm64-corpus
          split: test
        metrics:
          - {name: ROC-AUC,           type: roc-auc,          value: 0.000}
          - {name: Average Precision, type: average_precision, value: 0.000}
          - {name: FPR@TPR=95%,       type: fpr_at_tpr_95,    value: 0.000}
          - {name: FPR@TPR=99%,       type: fpr_at_tpr_99,    value: 0.000}
---

# WinnCore ARM64 AV Baseline

ARM64-first malware detection baseline. Rust extractor → JSONL features → LightGBM → ONNX.  
No live malware binaries in this repo. Only hashes, feature rows, code, and reports.

**Important:** No live malware binaries are included in this repository. Only hashes, feature rows, code, and reports are shared.

## Scope & Safety

- **Do not upload samples.** Share only SHA-256 hashes and feature rows.
- Perform training and evaluation in an isolated environment.
- This is an R&D baseline only—not intended for production EDR use.

## Repository Layout

```
extractor/   # Rust feature extractor (AArch64 disassembly, headers, n-grams)
training/    # Python scripts for training and ONNX export
models/      # Exported models (e.g., gbm_v0.onnx)
datasets/    # Manifests and features (no binaries)
eval/        # Metrics tables, plots, and write-ups
```

## Quick Start

```bash
# Build the extractor
cd extractor && cargo build --release

# Extract features from binaries
./target/release/arm64_extractor /path/to/binaries datasets/features.jsonl

# Train LightGBM and export to ONNX
python training/train_lightgbm.py \
  --features datasets/features.jsonl \
  --out models/gbm_v0.onnx \
  --report eval/report_v0.md
```

## Metrics Protocol

Report the following metrics and optimize for low false positives:

- ROC-AUC
- PR-AUC (Average Precision)
- FPR@TPR=95%
- FPR@TPR=99%

Targets for future improvements: FPR@TPR=95% ≤ 1%, FPR@TPR=99% ≤ 5% on unseen data.

## Dataset Manifest (Example)

Located at `datasets/manifest.jsonl`:

```json
{"sha256": "<hash>", "label": 1, "arch": "aarch64", "source": "internal_sandbox", "ts": "2025-11-02"}
```

## Reproducibility Tips

- Use small, atomic commits.
- Leverage Git LFS for large files like *.onnx, *.pt, *.bin, *.pkl.
- Pin dependency versions in `training/requirements.txt` and `rust-toolchain.toml`.
- Evaluate performance at fixed thresholds, not just AUC scores.

## Legal

Licensed under Apache-2.0. No redistribution of malware binaries is permitted. Use at your own risk.
```