Expert guidance for working with Zorro's dual ICN/AMIL malware detection framework for package ecosystems. Provides context on architecture, training pipelines, benchmarking, and development workflows.
This skill provides expert guidance for working with the Zorro malware detection framework, a comprehensive system for detecting malicious packages in software ecosystems using two complementary approaches: ICN (Intent Convergence Networks) and AMIL (Attention-based Multiple Instance Learning).
Assists developers and security researchers working with the Zorro framework by providing:
When the user asks about Zorro, first identify which component they're working with:
For setup questions:
1. **Check environment variables** needed:
- `GITHUB_TOKEN` - Required for advisory scraping
- `OPENROUTER_API_KEY` - Optional, for LLM benchmarking
- `WANDB_API_KEY` - Optional, for experiment tracking
2. **Verify package management** - Zorro uses `uv` (not pip):
```bash
uv sync # Install dependencies
uv add <package> # Add new dependency
uv lock --upgrade # Update dependencies
```
3. **Check data paths** are correctly set:
- `malicious-software-packages-dataset/` - Primary dataset
- `data/` - Processed training data
- `checkpoints/` - Model checkpoints
- `logs/` - Training logs
- `test_results/` - Benchmark results
For ICN-related tasks:
**Architecture Components:**
**Training Pipeline (4-stage curriculum):**
```bash
python train_icn.py
python test_icn_structure.py
python verify_icn_pipeline.py
```
**Training Stages:**
1. Intent Pretraining - Learn intent classification on benign packages
2. Convergence Training - Train stable convergence on benign packages
3. Malicious Training - Introduce real malware, train divergence detection
4. Robustness Training - Adversarial examples and obfuscated code
**Key Files:**
For AMIL-related tasks:
**Architecture Components:**
**Training Pipeline (3-stage curriculum):**
```bash
python amil_demo.py
python -m amil.trainer --config-file amil_config.json
python -m amil.evaluator --model-path checkpoints/amil_model.pth --test-data data/test_samples/
python amil_benchmark_integration.py
```
**Training Stages:**
1. Stage A - Balanced (5:1 benign:malicious, clean samples)
2. Stage B - Augmented (add obfuscation variants)
3. Stage C - Realistic (10:1 ratio for production calibration)
**Key Files:**
**Success Criteria:**
For benchmarking tasks:
**Quick Tests:**
```bash
python test_benchmark_framework.py
python icn/evaluation/test_granularity.py
```
**Full Benchmark Study:**
```bash
python run_icn_benchmark.py \
--include-llms \
--include-huggingface \
--include-baselines
```
**Comparison Targets:**
**Evaluation Modes:**
**Metrics:**
For data-related tasks:
```bash
python extract_malicious_samples.py
python icn_demo.py
python icn_phase2_demo.py
```
**Package Manager Support:**
**ICN Configuration (`icn/training/config.py`):**
**AMIL Configuration (`amil/config.py`):**
**Intent Vocabulary (ICN):**
**Import Errors:**
**GPU Requirements:**
**API Access:**
**Module Structure:**
**Example 1: User wants to train ICN model**
```
User: "How do I train the ICN model?"
Agent:
1. Verify GPU is available and environment is set up
2. Check data is prepared in malicious-software-packages-dataset/
3. Run: python train_icn.py
4. Monitor training through 4 curriculum stages
5. Check logs/ for training progress and checkpoints/ for saved models
```
**Example 2: User wants to benchmark AMIL against ICN**
```
User: "How do I compare AMIL performance to ICN?"
Agent:
1. Train both models if not already done
2. Run: python amil_benchmark_integration.py
3. Review metrics: F1, ROC-AUC, speed, interpretability
4. Check test_results/ for detailed comparison reports
```
**Example 3: User asks about intent vocabulary**
```
User: "What intents does ICN detect?"
Agent:
ICN uses dual intent system:
```
1. **Always run scripts from project root** - Relative imports assume this
2. **Use `uv` not `pip`** - Project uses uv for dependency management
3. **GPU recommended for ICN** - Training requires CUDA-capable GPU
4. **OpenRouter API key optional** - Only needed for LLM benchmarking
5. **Statistical significance** - Benchmark results include significance testing for research publication
6. **Both models support same ecosystems** - ICN and AMIL work with npm, PyPI, and planned Cargo support
7. **Virtual environment** - Always activate `.venv/` before running scripts
8. **Cross-ecosystem evaluation** - Tests generalization between package managers
Leave a review
No reviews yet. Be the first to review this skill!
# Download SKILL.md from killerskills.ai/api/skills/zorro-malware-detection-framework-assistant/raw