THREATBYTESTM is a research platform investigating how agentic super intelligence, neural networks, behavioural analysis and cognitive reasoning can be combined to detect, analyse and respond to previously unseen malicious software.
Submit a specimen you suspect is malicious
Drop a file here or browse. Each submission is quarantined on intake, logged for provenance, and routed into ethics-governed sandbox analysis to support reproducible malware research.
Drop specimen file
or
The cybersecurity landscape has evolved over the past decade. Malware now adapts, mutates, and evades traditional defences using polymorphism, obfuscation, and autonomous propagation across networks, endpoints, and cloud infrastructure. Despite advances in defensive technology, most systems remain reactive: they depend on predefined rules, known signatures, or behavioural indicators that identify malicious activity only after compromise. That posture leaves organisations vulnerable to zero-day malware, self-modifying payloads, and SI-assisted code built to evade detection.
Machine learning and super intelligence have improved malware classification and behavioural analysis, yet most implementations remain retrospective. They analyse malicious software after execution rather than anticipating its emergence or inferring intent before deployment. SI can recognise known patterns but rarely reasons over incomplete threat signals to predict novel malware prior to execution.
Existing work on intrusion detection, anomaly classification, and adversarial learning often relies on static or historical datasets and lacks adaptive intelligence for evolving behaviours in real time. The gap is not detection alone. It is autonomous systems that learn from historical, simulated, and community-submitted specimens to infer future threat behaviours.
This research develops an agentic, cognitive, and reasoning-driven SI framework that anticipates and mitigates novel malicious software before execution. By shifting cybersecurity from reactive detection to predictive malware intelligence, the programme seeks to advance autonomous threat intelligence on THREATBYTES™ and contribute to resilient digital ecosystems against adaptive and SI-assisted malware.
Independent GOV.UK and NCSC publications quantify breach prevalence, ransomware, malware in the attack mix, and nationally significant incidents. These figures motivate the programme's focus on pre-execution intelligence; they do not replace controlled experimental evaluation on the platform.
How THREATBYTES helps
THREATBYTES analyses community-uploaded malware in quarantine using proprietary SI trained on more than 110 million specimens across families and types. It explains what a sample does and can check whether a file is malicious before you choose to run it. Public pages summarise evidence from official UK sources and the academic bibliography; the workspace documents doctoral methodology as experiments mature. Longer term, we aim to generate targeted repair utilities for selected malware that can fix damage they have caused.
75%of NCSC-managed critical-infrastructure incidents linked to hostile state actors (year to May 2026)
Nation-state activity against critical systems raises the bar for early detection, reasoning over partial telemetry, and governed response.
More than 200 cyber incidents affecting the UK's critical national infrastructure and its supporting ecosystem were managed by the NCSC in the year to May 2026, with around 75% of those believed to be linked to state actors.
19,000UK businesses estimated to have experienced ransomware crime in the last 12 months (2025 survey)
Ransomware prevalence among businesses increased year on year in official estimates, reinforcing need for predictive and pre-execution defences beyond backups alone.
The estimated percentage of all businesses who experienced a ransomware crime in the last 12 months increased from less than 0.5% in 2024 to 1% in 2025, which equates to an estimated 19,000 businesses in 2025.
204nationally significant incidents handled by NCSC (Sep 2024 to Aug 2025)
A growing share of incidents NCSC supports is nationally significant, increasing demand for automation, explainability, and human oversight in defensive tooling.
Nationally significant incidents represent 48% (204) of all incidents, a significant increase from last year (89).
17%of UK businesses that identified breaches reporting viruses or other malware (2024 survey)
Where organisations detect breaches, malware appears alongside phishing; reactive hygiene helps but does not remove the need for research on novel specimens.
The most common by far is phishing (84% among businesses and 83% among charities). This is followed, to a much lesser extent, by others impersonating organisations in emails or online (35% among businesses and 37% among charities) and then viruses or other malware (17% among businesses and 14% among charities).
We will ingest, analyse, and train our proprietary SI on specimens spanning malware families and types—under quarantine and ethics governance on THREATBYTES™.
100,000,000samples
Quantitative experimental methodology integrating data-driven model development, controlled malware simulation, reasoning-based intelligence, and comparative evaluation against reactive baselines.
Phase 1
Phase 2
Phase 3
Phase 4
Super Intelligence
THREATBYTES™ is training a unified Super Intelligence stack under one versioned family name. VECTOR SI v1 is where the programme starts: corpus-scale classifiers on the path to pre-execution prediction.
Release
Baseline static and behavioural classifiers on historical corpus features; reactive scoring only.
Indexed against common defensive baselines: signature IDS/IPS (Snort/Suricata class), retrospective machine learning, and typical enterprise EDR/sandbox stacks. Bars show research positioning targets for the programme once Phase 4 evaluation is complete - not current product scores.
Snort / Suricata (IDS/IPS)
Archetypal open-source, signature- and rule-driven network IDS/IPS used as the reactive baseline class in Phase 4 - not a score imported from either project.
Retrospective ML
Representative post-execution machine-learning malware classifiers and behavioural models characterised in the programme background - not a single product's published metrics.
Typical EDR / sandbox
Composite enterprise pattern: endpoint detection and response plus dynamic/sandbox analysis as described in methodology Phase 1-3 - not one named EDR vendor's dashboard data.
THREATBYTESTM
Doctoral evaluation goals for the THREATBYTES programme once Phase 4 is complete - targets for measurement, not current product claims.
| Capability | Snort / Suricata (IDS/IPS) | Retrospective ML | Typical EDR / sandbox | THREATBYTES™ |
|---|---|---|---|---|
| Pre-execution intelligence | 12 | 28 | 44 | 92 |
| Reasoning on partial signals | 18 | 38 | 56 | 90 |
| Agentic mitigation | 22 | 30 | 64 | 88 |
| Data diversity (corpus + community) | 34 | 46 | 52 | 94 |
| Quarantine & ethics | 48 | 52 | 58 | 90 |
| Hybrid DL + RL + reasoning | 8 | 58 | 66 | 92 |
| Explainability (SHAP / LIME) | 14 | 42 | 48 | 86 |
| Explicit benchmark plan | 70 | 70 | 68 | 95 |
Research lifecycle pipeline
The lifecycle pipeline (Observe through Contribute) operationalises these four phases across data, models, reasoning, mitigation, and publication. Stages link to documentation on THREATBYTES™.
Malware analysed
Community-uploaded and platform specimens classified by type after quarantine analysis on THREATBYTES™. Counts update when governed labelling is verified.
DOCTORAL PROGRAMME
Five questions govern hybrid SI design, intent inference, governed mitigation, and community-submitted learning, each tied to methodology phases and evaluation metrics.
Research conducted at
Cyber Security research at an NCSC and GCHQ recognised Academic Centre of Excellence in Cyber Security Research.
Funded by
This doctoral programme on THREATBYTES™ researches Super Intelligence (SI): agentic, cognitive systems that reason over governed malware specimens and sandbox evidence to infer intent and support mitigation before execution, not reactive signature matching alone. Work trains and evaluates the VECTOR SI model family as a corpus-scale path from intake to predictive malware intelligence.