{
  "meshsafe_target_version": "v0.2.1",
  "generated_at": "2026-10-29T11:32:38.543046",
  "csv_source": "用例.csv",
  "samples": [
    {
      "filename": "L0-001_jpg_normal.jpg",
      "case_id": "L0-001",
      "category": "L0",
      "expected_verdict": "pass",
      "expected_rules": [
        "identify_type"
      ],
      "description": "正常文件幻数识别-JPG"
    },
    {
      "filename": "L0-002_png_normal.png",
      "case_id": "L0-002",
      "category": "L0",
      "expected_verdict": "pass",
      "expected_rules": [
        "identify_type"
      ],
      "description": "正常文件幻数识别-PNG"
    },
    {
      "filename": "L0-003_docx_normal.docx",
      "case_id": "L0-003",
      "category": "L0",
      "expected_verdict": "pass",
      "expected_rules": [
        "identify_type"
      ],
      "description": "正常文件幻数识别-DOCX"
    },
    {
      "filename": "L0-004_pdf_normal.pdf",
      "case_id": "L0-004",
      "category": "L0",
      "expected_verdict": "pass",
      "expected_rules": [
        "identify_type"
      ],
      "description": "正常文件幻数识别-PDF"
    },
    {
      "filename": "L0-005_pe_clean.exe",
      "case_id": "L0-005",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExtension",
        "UnsignedExecutable"
      ],
      "description": "正常文件幻数识别-干净PE"
    },
    {
      "filename": "L0-006_disguise_jpg_pe.jpg",
      "case_id": "L0-006",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "ExtensionMismatch"
      ],
      "description": "jpg 后缀 + 实际 PE MZ 头"
    },
    {
      "filename": "L0-007_disguise_txt_pdf.txt",
      "case_id": "L0-007",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "ExtensionMismatch"
      ],
      "description": "后缀伪装：txt后缀，实际PDF幻数"
    },
    {
      "filename": "L0-008_disguise_png_zip.png",
      "case_id": "L0-008",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "ExtensionMismatch"
      ],
      "description": "后缀伪装：png后缀，实际ZIP幻数"
    },
    {
      "filename": "L0-009_double_ext_pdf_exe.pdf.exe",
      "case_id": "L0-009",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "DoubleExtension",
        "DangerousExtension"
      ],
      "description": "双扩展名伪装：report.pdf.exe"
    },
    {
      "filename": "L0-010_double_ext_txt_ps1.txt.ps1",
      "case_id": "L0-010",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "DoubleExtension",
        "DangerousExtension"
      ],
      "description": "双扩展名伪装：data.txt.ps1"
    },
    {
      "filename": "L0-011_double_ext_docx_js.docx.js",
      "case_id": "L0-011",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "DoubleExtension",
        "DangerousExtension"
      ],
      "description": "双扩展名伪装：note.docx.js"
    },
    {
      "filename": "L0-012_double_ext_xlsx_bat.xlsx.bat",
      "case_id": "L0-012",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "DoubleExtension",
        "DangerousExtension"
      ],
      "description": "双扩展名伪装：log.xlsx.bat"
    },
    {
      "filename": "L0-013_clean.ps1",
      "case_id": "L0-013",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExtension"
      ],
      "description": "干净 ps1 文件"
    },
    {
      "filename": "L0-014_clean.bat",
      "case_id": "L0-014",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExtension"
      ],
      "description": "干净 bat 文件"
    },
    {
      "filename": "L0-015_clean.cmd",
      "case_id": "L0-015",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExtension"
      ],
      "description": "干净 cmd 文件"
    },
    {
      "filename": "L0-016_clean.vbs",
      "case_id": "L0-016",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExtension"
      ],
      "description": "干净 vbs 文件"
    },
    {
      "filename": "L0-017_clean.js",
      "case_id": "L0-017",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "DangerousExtension"
      ],
      "description": "干净 js 文件"
    },
    {
      "filename": "L0-018_zip_traversal.zip",
      "case_id": "L0-018",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "PathTraversal"
      ],
      "description": "ZIP单级路径穿越：../test.txt"
    },
    {
      "filename": "L0-019_zip_deep_traversal.zip",
      "case_id": "L0-019",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "PathTraversal"
      ],
      "description": "ZIP多级路径穿越：../../a.txt"
    },
    {
      "filename": "L0-020_zip_bomb.zip",
      "case_id": "L0-020",
      "category": "L0",
      "expected_verdict": "reject",
      "expected_rules": [
        "ArchiveBombSuspect"
      ],
      "description": "ZIP炸弹42.zip"
    },
    {
      "filename": "L0-022_3layer_nested.zip",
      "case_id": "L0-022",
      "category": "L0",
      "expected_verdict": "pass",
      "expected_rules": [
        "recursive_ok"
      ],
      "description": "3层无害嵌套ZIP"
    },
    {
      "filename": "L0-024_encrypted.zip",
      "case_id": "L0-024",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "EncryptedArchive"
      ],
      "description": "加密 ZIP（标记待验证）"
    },
    {
      "filename": "L0-025_corrupt_zip.zip",
      "case_id": "L0-025",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "ArchiveBroken"
      ],
      "description": "截断损坏 ZIP 头"
    },
    {
      "filename": "L0-026_corrupt_direntry.zip",
      "case_id": "L0-026",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "ArchiveBroken"
      ],
      "description": "损坏ZIP目录项"
    },
    {
      "filename": "L0-029_zero_byte_exe.exe",
      "case_id": "L0-029",
      "category": "L0",
      "expected_verdict": "review",
      "expected_rules": [
        "ZeroByteFile",
        "DangerousExtension"
      ],
      "description": "空文件（0字节）后缀exe"
    },
    {
      "filename": "L1-001_eicar.txt",
      "case_id": "L1-001",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "ClamAV:EICAR"
      ],
      "description": "EICAR标准测试串文本"
    },
    {
      "filename": "L1-002_eicar_in_zip.zip",
      "case_id": "L1-002",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "ClamAV:EICAR"
      ],
      "description": "EICAR放入zip压缩包"
    },
    {
      "filename": "L1-004_eicar_in_docx.docx",
      "case_id": "L1-004",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "ClamAV:EICAR"
      ],
      "description": "EICAR放入docx内嵌（OLE）"
    },
    {
      "filename": "L1-005_eicar_modified.txt",
      "case_id": "L1-005",
      "category": "L1",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "修改 1 字节 EICAR，ClamAV 不应命中"
    },
    {
      "filename": "L0-001_jpg_normal.jpg",
      "case_id": "L1-006",
      "category": "L1",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "干净jpg图片（对照负样本）"
    },
    {
      "filename": "L0-003_docx_normal.docx",
      "case_id": "L1-007",
      "category": "L1",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "干净docx文档（对照负样本）"
    },
    {
      "filename": "L0-005_pe_clean.exe",
      "case_id": "L1-008",
      "category": "L1",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "干净hello PE（对照负样本）"
    },
    {
      "filename": "L1-011_eicar_in_3layer.zip",
      "case_id": "L1-011",
      "category": "L1",
      "expected_verdict": "reject",
      "expected_rules": [
        "ClamAV:EICAR"
      ],
      "description": "EICAR放在多层嵌套zip"
    },
    {
      "filename": "L1-012_eicar_base64.txt",
      "case_id": "L1-012",
      "category": "L1",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "base64 编码 EICAR，ClamAV 不解码"
    },
    {
      "filename": "L3-001_001_sample.ps1",
      "case_id": "L3-001",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "RemoteDownloadPowerShell"
      ],
      "description": "PS1明文：Invoke-WebRequest下载"
    },
    {
      "filename": "L3-002_002_sample.ps1",
      "case_id": "L3-002",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "ReverseShellNetcat"
      ],
      "description": "PS1明文：反弹shell nc"
    },
    {
      "filename": "L3-003_003_sample.bat",
      "case_id": "L3-003",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "RemoteDownloadUnix"
      ],
      "description": "bat明文：curl下载payload"
    },
    {
      "filename": "L3-004_004_sample.txt",
      "case_id": "L3-004",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "CredentialStealer"
      ],
      "description": "文本包含mimikatz关键字"
    },
    {
      "filename": "L3-005_005_sample.txt",
      "case_id": "L3-005",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "CredentialExport"
      ],
      "description": "文本包含reg save导出注册表"
    },
    {
      "filename": "L3-006_006_sample.txt",
      "case_id": "L3-006",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "RemoteSessionHijack"
      ],
      "description": "文本包含rdp、tscon劫持关键字"
    },
    {
      "filename": "L3-007_007_sample.txt",
      "case_id": "L3-007",
      "category": "L3",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "高危串base64编码放在txt"
    },
    {
      "filename": "L3-008_008_sample.ps1",
      "case_id": "L3-008",
      "category": "L3",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "Powershell字符串拆分拼接绕过"
    },
    {
      "filename": "L3-010_010_sample.ps1",
      "case_id": "L3-010",
      "category": "L3",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "高危串插入注释分割（powershell #注释）"
    },
    {
      "filename": "L3-011_011_sample.js",
      "case_id": "L3-011",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "RemoteDownloadUnix"
      ],
      "description": "高危串放js脚本内"
    },
    {
      "filename": "L3-012_012_sample.bat",
      "case_id": "L3-012",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "pass（内网白名单对照）"
      ],
      "description": "正常内网运维curl（白名单对照）"
    },
    {
      "filename": "L3-016_016_sample.ps1",
      "case_id": "L3-016",
      "category": "L3",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "空脚本文件（负样本）"
    },
    {
      "filename": "L3-017_017_sample.txt",
      "case_id": "L3-017",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "ReverseShellNetcat",
        "CredentialStealer"
      ],
      "description": "多条高危特征同文件复合"
    },
    {
      "filename": "L3-018_018_sample.txt",
      "case_id": "L3-018",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "RemoteDownloadPowerShell"
      ],
      "description": "高危字符串大小写混写"
    },
    {
      "filename": "L3-021_021_sample.eml",
      "case_id": "L3-021",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "RemoteDownloadPowerShell"
      ],
      "description": "高危字符串放在eml邮件正文"
    },
    {
      "filename": "L3-024_024_sample.txt",
      "case_id": "L3-024",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "RemoteDownloadPowerShell"
      ],
      "description": "超长单行文本（10万字符）包含高危串"
    },
    {
      "filename": "L3-014_l3001_in_zip.zip",
      "case_id": "L3-014",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "RemoteDownloadPowerShell"
      ],
      "description": "高危字符串放在zip内部txt"
    },
    {
      "filename": "L3-015_keyword_in_docx.docx",
      "case_id": "L3-015",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "RemoteDownloadPowerShell"
      ],
      "description": "高危字符串放在docx文本正文"
    },
    {
      "filename": "L3-019_unicode_obfuscated.txt",
      "case_id": "L3-019",
      "category": "L3",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "同形字混淆，L3 默认不命中"
    },
    {
      "filename": "L3-020_log_with_keyword.log",
      "case_id": "L3-020",
      "category": "L3",
      "expected_verdict": "reject",
      "expected_rules": [
        "ReverseShellNetcat"
      ],
      "description": "日志文件混杂正常日志+高危串"
    },
    {
      "filename": "L3-023_keyword_in_encrypted.zip",
      "case_id": "L3-023",
      "category": "L3",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "加密 zip 内容无法扫描（标记）"
    },
    {
      "filename": "L4-001_001_sample.txt",
      "case_id": "L4-001",
      "category": "L4",
      "expected_verdict": "reject",
      "expected_rules": [],
      "description": "YARA正向命中占位（需对应规则）"
    },
    {
      "filename": "L4-002_002_sample.txt",
      "case_id": "L4-002",
      "category": "L4",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "干净对照"
    },
    {
      "filename": "L4-005_005_sample.txt",
      "case_id": "L4-005",
      "category": "L4",
      "expected_verdict": "unknown",
      "expected_rules": [],
      "description": "热加载测试占位"
    },
    {
      "filename": "L4-008_in_zip.zip",
      "case_id": "L4-008",
      "category": "L4",
      "expected_verdict": null,
      "expected_rules": [],
      "description": "压缩包内文件匹配YARA规则"
    },
    {
      "filename": "L4-010_010_sample.txt",
      "case_id": "L4-010",
      "category": "L4",
      "expected_verdict": "unknown",
      "expected_rules": [],
      "description": "正则 YARA 测试占位"
    },
    {
      "filename": "L5-001_clean_hello.exe",
      "case_id": "L5-001",
      "category": "L5",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "原生干净HelloWorld PE（无壳）"
    },
    {
      "filename": "L5-002_upx_shell.exe",
      "case_id": "L5-002",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "UPXPackerDetected",
        "HighEntropySection"
      ],
      "description": "UPX0/UPX1 节名"
    },
    {
      "filename": "L5-003_double_upx.exe",
      "case_id": "L5-003",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "UPXPackerDetected"
      ],
      "description": "UPX加壳PE，二次压缩"
    },
    {
      "filename": "L5-004_rwx_section.exe",
      "case_id": "L5-004",
      "category": "L5",
      "expected_verdict": "reject",
      "expected_rules": [
        "RWXSectionDetected"
      ],
      "description": "节属性 RWX"
    },
    {
      "filename": "L5-007_garbage_section.exe",
      "case_id": "L5-007",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "AbnormalSectionName"
      ],
      "description": "节名乱码"
    },
    {
      "filename": "L5-010_bad_mz.exe",
      "case_id": "L5-010",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "PeParseFailed"
      ],
      "description": "PE 头非法"
    },
    {
      "filename": "L5-011_truncated.exe",
      "case_id": "L5-011",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "PeParseFailed"
      ],
      "description": "截断 PE"
    },
    {
      "filename": "L5-012_pe32.exe",
      "case_id": "L5-012",
      "category": "L5",
      "expected_verdict": "pass",
      "expected_rules": [
        "PEArchInfo"
      ],
      "description": "32 位识别"
    },
    {
      "filename": "L5-013_pe64.exe",
      "case_id": "L5-013",
      "category": "L5",
      "expected_verdict": "pass",
      "expected_rules": [
        "PEArchInfo"
      ],
      "description": "64 位识别占位"
    },
    {
      "filename": "L5-014_clean_tool.exe",
      "case_id": "L5-014",
      "category": "L5",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "PE导入表大量系统API（正常工具）"
    },
    {
      "filename": "L5-016_zero_section.exe",
      "case_id": "L5-016",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [],
      "description": "零节 PE 占位"
    },
    {
      "filename": "L5-017_upx_rwx.exe",
      "case_id": "L5-017",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "UPXPackerDetected",
        "RWXSectionDetected"
      ],
      "description": "UPX壳 + RWX节复合特征"
    },
    {
      "filename": "L5-018_debug_info.exe",
      "case_id": "L5-018",
      "category": "L5",
      "expected_verdict": "review",
      "expected_rules": [
        "DebugInformationPresent"
      ],
      "description": "调试信息占位"
    },
    {
      "filename": "NEG-001_clean.jpg",
      "case_id": "NEG-001",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务标准JPG图片"
    },
    {
      "filename": "NEG-002_clean.png",
      "case_id": "NEG-002",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务PNG图片"
    },
    {
      "filename": "NEG-003_clean.mp4",
      "case_id": "NEG-003",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务MP4视频"
    },
    {
      "filename": "NEG-004_clean.docx",
      "case_id": "NEG-004",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务正常docx报表"
    },
    {
      "filename": "NEG-005_clean.xlsx",
      "case_id": "NEG-005",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务正常xlsx表格"
    },
    {
      "filename": "NEG-006_clean.pdf",
      "case_id": "NEG-006",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务正常PDF报告"
    },
    {
      "filename": "NEG-007_clean.java",
      "case_id": "NEG-007",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务源码java文件"
    },
    {
      "filename": "NEG-008_clean.py",
      "case_id": "NEG-008",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "业务源码python脚本"
    },
    {
      "filename": "NEG-009_clean.zip",
      "case_id": "NEG-009",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常业务压缩包zip"
    },
    {
      "filename": "NEG-010_clean.exe",
      "case_id": "NEG-010",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常业务安装包（干净开源）"
    },
    {
      "filename": "NEG-011_clean.log",
      "case_id": "NEG-011",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常日志文件"
    },
    {
      "filename": "NEG-012_clean.csv",
      "case_id": "NEG-012",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常csv业务数据文件"
    },
    {
      "filename": "NEG-013_clean.eml",
      "case_id": "NEG-013",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常eml业务邮件（无附件、无外联恶意）"
    },
    {
      "filename": "NEG-014_clean.dll",
      "case_id": "NEG-014",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常dll（系统干净dll）"
    },
    {
      "filename": "NEG-015_clean.ttf",
      "case_id": "NEG-015",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常字体文件ttf"
    },
    {
      "filename": "NEG-016_clean.dwg",
      "case_id": "NEG-016",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常CAD图纸"
    },
    {
      "filename": "NEG-017_4layer_nested.zip",
      "case_id": "NEG-017",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "多层嵌套干净zip（无风险）"
    },
    {
      "filename": "NEG-018_clean.bat",
      "case_id": "NEG-018",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常bat运维脚本（内网备份）"
    },
    {
      "filename": "NEG-019_clean.ps1",
      "case_id": "NEG-019",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常ps1运维脚本（内网查询）"
    },
    {
      "filename": "NEG-020_clean.odt",
      "case_id": "NEG-020",
      "category": "NEG",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常odt文档"
    }
  ]
}