# [ML-OPS] Build Positive Control Malware Library & XGBoost Regression Pipeline #96

🛑 Problem Statement

Recent architectural upgrades to the core optical sensors and structural signature dictionaries have altered the feature matrices generated during Phase 1 ingestion. Because our XGBoost threat inference model (security_auditor.py) relies on these precise structural weights to classify malware (Trojans, Stealers, Droppers, etc.), there is a high probability of data/concept drift.

Currently, we lack a deterministic testing mechanism to confirm if the ML weights have shifted. Until verified, the XGBoost classifications must be treated with high suspicion.

🎯 Objective

Create a "Positive Control" Malware Library to serve as an immutable baseline for the ML engine. Integrate this library into the CI/CD pipeline to mathematically guarantee that GitGalaxy successfully detects known threats before any core sensor updates are merged.

🛠️ Proposed Implementation

1. The Positive Control Sandbox

• Create an isolated, safe directory containing defanged or mock malware samples that perfectly mimic the structural signatures of real-world threats.
• Samples must map 1:1 with the CLASS_NAMES taxonomy in SecurityAuditor:
  • Class 1: Botnet / DDoS
  • Class 2: Stealer / Trojan
  • Class 3: Dropper / Webshell
  • Class 4: Native Infector

2. CI/CD Regression Pipeline (The Golden Crucible)

• Integrate a new GitHub Action workflow that runs galaxyscope against the Positive Control Sandbox on every PR.
• Assertion: The pipeline must strictly assert that the XGBoost model flags these specific files with a confidence score >= AI_THREAT_THRESHOLD.
• If the model fails to flag the control samples, the pipeline fails, preventing silent regressions in our threat detection.

3. Model Recalibration (If Drift is Confirmed)

• Once the pipeline is established, evaluate the current model (gitgalaxy_malware_xgb_multiclass.json).
• If the new core sensors have skewed the outputs, generate a new training matrix and retrain the XGBoost weights to align with the upgraded structural heuristics.

✅ Acceptance Criteria

• Positive Control Malware Library is committed to a safe, isolated testing directory.
• CI/CD pipeline is updated to run regression tests against the control library.
• Pipeline explicitly fails if the ML model misses a known positive control.
• Current XGBoost model is tested against the new library; drift is either confirmed or denied.
• (If necessary) XGBoost model is retrained and the new .json weights are committed.