Add SigTree ML classification docs and update slides with cross-references

New documentation and slide deck for the SIG_TREE on-device ML
decision tree system (33,428 trees across 3 signature types). Updates
existing markdown and slide decks (00, 03, 08, 09, 13) with SigTree
cross-references, updated SIGTREE engine descriptions, and !MTB/!ml
suffix documentation.

Author: HackingLZ

md/00_overview.md

@@ -210,6 +210,16 @@ File/Buffer Input
          │
          ▼
 ┌──────────────────────────────────────────────────────────────────┐
+│  CROSS-CUTTING: SigTree ML Classification (§14)                  │
+│  33,428 decision trees evaluate sigattr boolean features.        │
+│  JIT-compiled into native x86 for speed. Produces !ml/!MTB.     │
+│  String: "sigtree" @ 0x109C80B0                                 │
+│          "SIGNATURE_TYPE_SIGTREE" @ 0x10986C88                   │
+│          "sigattr_head" @ 0x1097D710                              │
+└────────┬─────────────────────────────────────────────────────────┘
+         │
+         ▼
+┌──────────────────────────────────────────────────────────────────┐
 │  STAGE 12: MAPS Cloud Lookup (§12)                               │
 │  Lowfi match → Bond serialize → HTTPS POST → parse response.    │
 │  Delivers FASTPATH dynamic signatures (SDN, TDN, DATA).         │
@@ -249,6 +259,7 @@ File/Buffer Input
 | Virtual files | 144 | VDM VFILE entries |
 | DBVARs (config entries) | 547 | VDM DBVAR entries |
 | FOP behavioral rules | 4,601 | VDM FOP entries |
+| SIG_TREE ML trees | 33,428 | VDM SIG_TREE + EXT + BM |
 | Threat name prefixes | 504 | VDM prefix table |
 | TLV entries | 9.3M | Across 4 VDM files |
 | Signature types | 158+ | TLV type constants |

md/03_static_engine_cascade.md

@@ -60,9 +60,9 @@ of the primary engines rather than standalone stages:
 | **NID**               | `SIGNATURE_TYPE_NID`                   | `0x10986AD0`  | Network Inspection Detection          |
 | **NID64**             | `SIGNATURE_TYPE_NID64`                 | `0x10987174`  | 64-bit NID variant                    |
 | **BM_INFO**           | `SIGNATURE_TYPE_BM_INFO`               | `0x10986C58`  | Behavioral monitoring info records    |
-| **SIGTREE**           | `SIGNATURE_TYPE_SIGTREE`               | `0x10986C88`  | Hierarchical signature tree           |
-| **SIGTREE_EXT**       | `SIGNATURE_TYPE_SIGTREE_EXT`           | `0x10987008`  | Extended signature tree               |
-| **SIGTREE_BM**        | `SIGNATURE_TYPE_SIGTREE_BM`            | `0x109871D4`  | BM-specific signature tree            |
+| **SIGTREE**           | `SIGNATURE_TYPE_SIGTREE`               | `0x10986C88`  | ML decision tree classifier (~14,926 trees). See [SigTree ML (SS14)](14_sigtree_ml_classification.md) |
+| **SIGTREE_EXT**       | `SIGNATURE_TYPE_SIGTREE_EXT`           | `0x10987008`  | Extended ML decision tree (~3,771 trees). See [SS14](14_sigtree_ml_classification.md) |
+| **SIGTREE_BM**        | `SIGNATURE_TYPE_SIGTREE_BM`            | `0x109871D4`  | Behavioral monitoring ML trees (~14,731 trees). See [SS14](14_sigtree_ml_classification.md) |
 
 ---
 

md/08_script_deobfuscation.md

@@ -200,8 +200,9 @@ JavaScript interpreter evaluates expressions to resolve obfuscation.
 ## JScript Feature Attributes
 
 The engine extracts detailed structural features from JavaScript content for
-ML-based classification. These attributes are set during parsing and made
-available to Lua scripts and BRUTE matching:
+ML-based classification. These boolean attributes are deposited into the sigattr log
+and evaluated by the [SigTree ML decision tree ensemble (SS14)](14_sigtree_ml_classification.md)
+to produce `!ml` and `!MTB` detections. They are also available to Lua scripts and BRUTE matching:
 
 | Attribute | Address | Purpose |
 |-----------|---------|---------|

md/09_brute_matching.md

@@ -622,7 +622,7 @@ BRUTE-deposited attributes participate in AAGG boolean expressions:
 BRUTE complements the static engines by providing:
 - Raw-data matching that static engines skip
 - Post-transformation matching
-- Feature extraction for ML classification
+- Feature extraction for ML classification (BRUTE:*:Feature:* attributes feed into SigTree decision trees — see [SigTree ML (SS14)](14_sigtree_ml_classification.md))
 
 ---
 

md/13_verdict_resolution.md

@@ -280,8 +280,8 @@ Components:
 
 | Suffix | Meaning |
 |--------|---------|
-| `!MTB` | Machine Learning / Tree-Based model |
-| `!ml` | Machine Learning detection |
+| `!MTB` | Machine Learning / Tree-Based model — produced by SigTree decision tree ensemble. See [SigTree ML (SS14)](14_sigtree_ml_classification.md) |
+| `!ml` | Machine Learning detection — produced by SigTree classification. See [SS14](14_sigtree_ml_classification.md) |
 | `!dha` | Dynamic Heuristic Analysis |
 | `!pz` | Pattern-based heuristic |
 | `!rfn` | Real-time File Notification |