Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Malware Archive Verdict Conclusion Takes Max Instead of Sum of Scores #271

Open
jflowers00 opened this issue Sep 25, 2024 · 0 comments
Open
Assignees
Labels
assess We still haven't decided if this will be worked on or not bug Something isn't working

Comments

@jflowers00
Copy link

Describe the bug
When a file is in the Malware Archive, the verdict is calculated from the max of all scores in the services. Files in the Submissions will have the verdict determined from the added scores from each service, as documented here: https://cybercentrecanada.github.io/assemblyline4_docs/user_manual/verdicts/

"Service scores for a single file are added together to create a total score for that file."

To Reproduce
Steps to reproduce the behavior:

  1. Submit malware sample 0000f08c93fda4efc62866b51d73efabb2103cb373d1db144cf3250e7615b18b
  2. Observe Malicious Verdict with scores added together
  3. Archive the file
  4. Final Verdict will be different

Expected behavior
The verdict should be consistent between the submissions and archive.

Environment (please complete the following information if pertinent):

  • Assemblyline Version: 4.5.stable release channel
@jflowers00 jflowers00 added assess We still haven't decided if this will be worked on or not bug Something isn't working labels Sep 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
assess We still haven't decided if this will be worked on or not bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants