Update scoring_engine.py

scoring_engine.py

@@ -14,20 +14,28 @@ def compute_final_score(
     attachment_findings: list,
     auth_results: dict,
 ):
-    """
-    Correlation-based scoring engine
-    Behavioral analysis has authority over all other signals
-    """
-
     reasoning = []
 
+    # -------------------------
+    # NORMALIZE INPUTS (🔥 FIX)
+    # -------------------------
+    attack = (behavior_attack or "").strip().lower()
+
+    # -------------------------
+    # 🔥 HARD BEHAVIOR OVERRIDE
+    # -------------------------
+    if attack == "sextortion":
+        reasoning.append("Sextortion behavior detected → authoritative override")
+        reasoning.append("Behavioral confidence supersedes heuristics")
+        return 90, "🚨 Malicious", reasoning
+
     # -------------------------
     # BASE WEIGHTED SCORE
     # -------------------------
     final_score = (
         header_score * 0.20 +
         body_score * 0.25 +
-        behavior_score * 0.30 +   # 🔥 dominant signal
+        behavior_score * 0.30 +
         url_score * 0.15 +
         attachment_score * 0.10
     )
@@ -39,47 +47,20 @@ def compute_final_score(
     reasoning.append(f"Attachment contribution: {attachment_score * 0.10:.1f}")
 
     # -------------------------
-    # AUTHENTICATION BOOSTS
+    # AUTHENTICATION BOOST
     # -------------------------
     if auth_results.get("dmarc") == "fail":
         final_score += 10
-        reasoning.append("DMARC failed → +10 risk")
+        reasoning.append("DMARC failed → +10")
 
     if auth_results.get("spf") == "fail":
         final_score += 5
-        reasoning.append("SPF failed → +5 risk")
+        reasoning.append("SPF failed → +5")
 
-    # -------------------------
-    # CORRELATION RULES
-    # -------------------------
-    if behavior_score >= 40 and header_score >= 20:
-        final_score += 10
-        reasoning.append("Behavior + Header correlation → +10")
-
-    if behavior_score >= 40 and url_score > 0:
-        final_score += 10
-        reasoning.append("Behavior + URL correlation → +10")
-
-    # -------------------------
-    # 🔥 BEHAVIORAL AUTHORITY (HARD RULES)
-    # -------------------------
-    if behavior_score >= 70:
-        final_score = max(final_score, 70)
-        reasoning.append(
-            "High-confidence behavioral attack → minimum score enforced (70)"
-        )
-
-    if behavior_attack.lower() == "sextortion":
-        final_score = max(final_score, 85)
-        reasoning.append("Sextortion detected → forced score ≥ 85")
-
-    # -------------------------
-    # CLAMP SCORE
-    # -------------------------
     final_score = min(int(final_score), 100)
 
     # -------------------------
-    # FINAL VERDICT
+    # VERDICT
     # -------------------------
     if final_score >= 70:
         verdict = "🚨 Malicious"