Update scoring_engine.py

scoring_engine.py

@@ -7,90 +7,66 @@ def compute_final_score(
     url_score: int,
     attachment_score: int,
     behavior_score: int,
+    behavior_attack: str,
     header_findings: list,
     body_findings: list,
     url_findings: list,
     attachment_findings: list,
-    behavior_findings: list,
     auth_results: dict,
 ):
     """
-    Correlation-based scoring engine (Phase 4.2)
-    Returns: final_score, verdict, reasoning[]
+    Correlation-based scoring engine with behavioral authority
     """
 
     reasoning = []
 
     # -------------------------
-    # BASE SCORE
+    # BASE WEIGHTED SCORE
     # -------------------------
     final_score = (
         header_score * 0.20 +
         body_score * 0.25 +
-        behavior_score * 0.30 +   # 🔥 highest weight
+        behavior_score * 0.30 +
         url_score * 0.15 +
         attachment_score * 0.10
     )
 
-    reasoning.append(f"Header score contribution: {header_score * 0.20:.1f}")
-    reasoning.append(f"Body score contribution: {body_score * 0.25:.1f}")
-    reasoning.append(f"Behavior score contribution: {behavior_score * 0.30:.1f}")
-    reasoning.append(f"URL score contribution: {url_score * 0.15:.1f}")
-    reasoning.append(f"Attachment score contribution: {attachment_score * 0.10:.1f}")
+    reasoning.append(f"Header contribution: {header_score * 0.20:.1f}")
+    reasoning.append(f"Body contribution: {body_score * 0.25:.1f}")
+    reasoning.append(f"Behavior contribution: {behavior_score * 0.30:.1f}")
+    reasoning.append(f"URL contribution: {url_score * 0.15:.1f}")
+    reasoning.append(f"Attachment contribution: {attachment_score * 0.10:.1f}")
 
     # -------------------------
-    # AUTH OVERRIDES
+    # AUTHENTICATION BOOST
     # -------------------------
     if auth_results.get("dmarc") == "fail":
         final_score += 10
-        reasoning.append("DMARC failed → +10 risk")
+        reasoning.append("DMARC failed → +10")
 
     if auth_results.get("spf") == "fail":
         final_score += 5
-        reasoning.append("SPF failed → +5 risk")
+        reasoning.append("SPF failed → +5")
 
     # -------------------------
-    # CORRELATION RULES
+    # 🔥 BEHAVIORAL HARD OVERRIDE
     # -------------------------
-    if behavior_score >= 40 and header_score >= 20:
-        final_score += 10
-        reasoning.append("Behavior + Header correlation → +10")
-
-    if behavior_score >= 40 and url_score > 0:
-        final_score += 10
-        reasoning.append("Behavior + URL correlation → +10")
-
-    if behavior_score >= 50:
-        final_score += 15
-        reasoning.append("High-confidence behavioral attack → +15")
-
-    # -------------------------
-    # BEHAVIORAL HARD OVERRIDES
-    # -------------------------
-    if any("sextortion" in f.lower() for f in behavior_findings):
-        final_score = max(final_score, 75)
-        reasoning.append("Sextortion behavior detected → force score ≥ 75")
-
-    elif behavior_score >= 70:
-        final_score = max(final_score, 65)
-        reasoning.append("Strong behavioral attack detected → force score ≥ 65")
-
-
-
-    
-    # -------------------------
-    # CLAMP SCORE
-    # -------------------------
-    final_score = min(int(final_score), 100)
-
-    # -------------------------
-    # VERDICT
-    # -------------------------
-    if final_score >= 70:
+    if behavior_attack.lower() == "sextortion":
+        final_score = max(final_score, 85)
         verdict = "🚨 Malicious"
-    elif final_score >= 40:
-        verdict = "⚠️ Suspicious"
+        reasoning.append("Sextortion detected → forced score ≥ 85")
     else:
-        verdict = "✅ Safe"
+        # -------------------------
+        # NORMAL VERDICT LOGIC
+        # -------------------------
+        final_score = min(int(final_score), 100)
+
+        if final_score >= 70:
+            verdict = "🚨 Malicious"
+        elif final_score >= 40:
+            verdict = "⚠️ Suspicious"
+        else:
+            verdict = "✅ Safe"
 
+    final_score = min(int(final_score), 100)
     return final_score, verdict, reasoning