Auto Learning Pipeline

Auto-Learning Pipeline

How It Works

Every scan and cleanup action automatically records to a local SQLite threat database. No manual steps needed - the system learns from every operation.

┌──────────────────┐
│  wp_quarantine    │──┐
│  wp_scan_themes   │  │    ┌─────────────────────┐     ┌──────────────────────┐
│  wp_scan_hidden   │  ├───>│  _record_to_threat_db│────>│  cleanup_records      │
│  wp_clean_core    │  │    │  (best-effort)       │     │  known_malicious_files│
│  wp_delete_opts   │  │    └─────────────────────┘     └──────────────────────┘
│  wp_revoke_app    │──┘
│  wp_complete      │
│  wp_scan_mu       │
└──────────────────┘

What Gets Recorded

Tool	Action Type	What's Stored
wp_quarantine_file	quarantine	File hash, path, quarantine location. Also adds hash to known_malicious_files
wp_scan_hidden_plugins	hidden_plugin_detected	Plugin slug, risk flags (self-hiding, user-hiding, self-healing)
wp_scan_themes	malware_theme_detected	Theme slug, detection reasons
wp_clean_core_injections	core_injection_deleted	File path of each deleted injection
wp_delete_malware_options	malware_option_deleted	Option name + its value
wp_revoke_app_passwords	app_password_revoked	User ID + username
wp_complete_cleanup	complete_cleanup	Summary with total steps completed
wp_scan_mu_plugins	mu_plugin_user_hiding	MU-plugin filenames with user-hiding hooks

Cross-Site Hash Recognition

This is the key intelligence feature:

1. You quarantine a malicious file on Site A
2. The file's MD5 hash is stored in known_malicious_files
3. When scanning Site B, wp_threat_check_file recognizes the same hash
4. The file is flagged immediately - no signature matching needed

This means the system gets better the more sites you clean.

Best-Effort Design

All threat DB recording is wrapped in a try/except. If the database is unavailable or a write fails:

• The cleanup continues normally
• No error is shown to the user
• The action is still logged to the plaintext log file

This ensures the learning pipeline never blocks actual security operations.

Checking the Pipeline

# View database stats
wp_threat_db_stats()

Look for:

• cleanup_records - should grow after every scan/cleanup
• known_malicious_files - should grow after quarantine operations
• signatures - community + locally added detection patterns

Database Location

The threat database is stored at:

~/.wp-malware-cleanup/threat_intel.db

This is a SQLite file. Back it up - it contains your accumulated threat intelligence.

Contributing Discoveries

After building up local threat intelligence, share it with the community:

# Export your signatures and hashes
wp_threat_export()

# Then submit a PR to the community repository