← All detection heuristics · Machine Learning
high
ML_NYX_PDF_MALICIOUS
What it means
Gradient-boosted classifier scored the PDF above the suspicious threshold.
Why it fires
The Nyx classifier is a LightGBM model trained on byte-level structural features (keyword counts, filter histograms, entropy, object/stream balance) of hundreds of thousands of malicious and benign PDFs. Severity is graded by score: medium >= 0.25, high >= 0.5, critical >= 0.9. The model is complementary to the rule-based heuristics — it can catch families with no individual indicator that trips an explicit rule but whose overall shape matches the malicious training distribution.