Pre-execution threat prediction

Most defences act after execution: an alert fires once damage has begun. Pre-execution prediction moves the decision earlier. From static structure and learned experience it estimates the behaviour a file would show, so it can be blocked or contained before it runs. This is the central aim of the THREATBYTES™ programme.

Models learn the link between static evidence and later behaviour from specimens that were both inspected and executed in a sandbox. For a new file only the static evidence is available, and the model infers likely behaviour and intent from it. Reasoning layers combine these partial signals into a hypothesis with a confidence.

RQ-001 asks whether hybrid models can predict unseen behaviour before execution. RQ-002 asks how intent can be inferred from incomplete indicators. Both are tested by holding out whole families and later time periods, so predictions are made on malware the models could not have memorised.

Blocking before execution means acting on less evidence, which raises the cost of false positives. Useful systems report calibrated confidence, explain their reasoning, and pair prediction with safe containment rather than outright deletion when confidence is moderate.