This is an XGBoost model trained on the EMBER 2018 dataset to detect malicious Windows Portable Executables (PE files).
This model is specifically designed to be used alongside SHAP (SHapley Additive exPlanations) to provide local and global forensic blueprints. It maps arbitrary feature indices to human-readable MITRE ATT&CK behaviors, moving away from "black-box" detection.
1import xgboost as xgb
2model = xgb.XGBClassifier()
3model.load_model("baseline_xgboost.json")