nx_pamp.nx

nx_pamp.nx -- Pathogen-Associated Molecular Pattern recognition. Biology: PAMPs are conserved molecular signatures of pathogens (LPS on gram-negative bacteria, flagellin on motile bacteria, viral dsRNA) that TLRs and NOD-like receptors detect to mount the innate immune response. The patterns are recognizable because they're conserved -- pathogens can't change them without losing function. Software substrate: certain byte/structural patterns are similarly conserved across attack classes. Detecting them is cheap and high-signal. nx_pamp ships a sealed enum of pattern KINDS + a scanner over caller-supplied byte buffers. PAMP kinds shipped V1: - TROJAN_SOURCE_HOMOGLYPH -- Cyrillic-Latin homograph in code - ENTROPY_ANOMALY -- shellcode-class entropy spikes - BUILD_INJECTION_HINT -- known build-toolchain backdoor sig - KNOWN_BAD_EGRESS_HEADER -- C2 protocol leading bytes - MICROCODE_INJECT_HINT -- known microcode-patch markers - ROOTKIT_PERSIST_HINT -- known rootkit boot-hook bytes - SHELLCODE_NOPSLED -- 0x90 NOP sled detection - DECOY_INVALID_METHYL_HINT -- our own decoy markers (so we recognize OUR leak fingerprint if it appears upstream) THIS IS THE FIRST-LINE DETECTION. nx_pamp tells "is something suspicious here?". nx_crispr remembers signatures of confirmed threats. nx_restriction (queued) gates IO using both. nx_xenocell records the event into the forensic ledger. V1 ships a scanner over byte buffers with a hardcoded pattern DB. V2 makes the pattern DB content-addressed peer-sharable so the community can extend coverage without recompiling substrate. Gap list (V1 honest perf verdict): - pattern DB hardcoded (V2 makes it data-driven) - no fuzzy / regex matching (exact-byte and entropy only) - no positional context (a pattern in mainline code is same verdict as same pattern in a comment string) - false-positive rate not measured against corpus