New Master candidate

utils/hashfunctions.py

@@ -90,28 +90,38 @@ def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publ
 
     df = aug_df.copy()
 
-    def reputationtool(row, threat_tolerance):
-        if row["reputation_scannermatch"] == "N/A":
-            return True
+    def reputationtool(row):
+        val = row["reputation_scannermatch"]
+        if pd.isna(val) or val == "N/A":
+            return row["publisher_y"] == "Not Signed"
         try:
             return int(val) > threat_tolerance
         except (ValueError, TypeError):
             return row["publisher_y"] == "Not Signed"
 
-    mask_needsreview = (df["publisher_y"] == "Not Signed") & df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)
+    df["reputation_flag"] = df.apply(reputationtool, axis=1)
 
-    mask_approved = (
-    ((df["publisher_y"] != "Not Signed") & (~df["publisher_y"].isin(untrusted_publishers))) &
-    (df["publisher_y"] != "Not Signed")  # explicitly signed
-    ) | (
-    (df["publisher_y"] == "Not Signed") &
-    (~df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)) &
-    (~df["publisher_y"].isin(untrusted_publishers))  # exclude untrusted even if unsigned
+    mask_needsreview = (
+        ((df["publisher_y"] == "Not Signed") & df["reputation_flag"]) |
+        (df["reputation_status"] == "UNKNOWN")
     )
 
+    mask_approved = (
+        (
+            (df["publisher_y"] != "Not Signed") &
+            ~df["publisher_y"].isin(untrusted_publishers) &
+            ~df["reputation_status"].isna()
+        ) |
+        (
+            (df["publisher_y"] == "Not Signed") &
+            ~df["reputation_flag"] &
+            ~df["publisher_y"].isin(untrusted_publishers) &
+            ~df["reputation_status"].isna()
+        )
+    )
 
     needsreview_df = df[mask_needsreview]
     approved_df = df[mask_approved]
-    remaining_df = df[~(mask_needsreview | mask_approved)]
+    unapproved_df = df[~(mask_needsreview | mask_approved)]
 
-    return needsreview_df, approved_df, remaining_df
+    return needsreview_df, approved_df, unapproved_df