Documentation index
Agentic, cognitive SI for predictive malware intelligence. Documentation aligned with the doctoral research programme.
Scholarly and technical literature consulted while designing and building the THREATBYTES™ research platform, spanning malware analysis, machine learning, agentic workflows, and ethics-governed research engineering. (554 entries).
Modern malware evades reactive defences; this programme shifts cybersecurity from post-compromise detection to predictive, pre-execution malware intelligence using agentic, cognitive SI.
To design and develop an agentic, cognitive, and reasoning-driven SI framework capable of predicting, detecting, analysing, and autonomously mitigating novel malicious software, using historical, simulated, and community-submitted malware data for proactive intelligence and pre-execution prevention.
Objectives translate the aim into measurable outcomes: critical review of prior SI defences, integrated malware corpora, hybrid agentic architecture, automated simulation and mitigation, and rigorous benchmarking against reactive baselines.
Five research questions govern experiments, datasets, and evaluation, covering predictive accuracy, intent inference, hybrid SI design, governed mitigation, and community-submitted learning.
Quantitative experimental methodology across four phases: data collection and preparation, hybrid model design, proactive defence implementation on the THREATBYTES™ platform, and evaluation with comparative benchmarking.
THREATBYTES™ separates the public research site, authenticated application, Python analysis engine, and shared API contracts, integrating trained models for ingestion, reasoning, and governed mitigation at scale.
Research data spans a large historical malware corpus, sandbox-derived behavioural features, synthetic attack scenarios, and governed community submissions via the THREATBYTES™ platform.
One unified Super Intelligence model family, VECTOR SI: v1 is in development; v2-v6 are on the public roadmap as coming soon.
Agentic components propose analysis steps and pre-emptive mitigation (sandbox containment, isolation, traffic controls) under permission matrices, reasoning outputs, and human approval for high-impact actions.
Cognitive and reasoning layers infer malware intent from incomplete or evolving behavioural indicators, enabling prediction of previously unseen behaviours rather than opaque scores alone.
Experiments encode hypotheses across the four methodology phases, linking datasets, hybrid models, sandbox simulations, and red-team validation with full lifecycle documentation.
Evaluation quantifies predictive accuracy, pre-execution detection, false positives, mitigation effectiveness, and latency, using confusion matrices, ROC and precision-recall curves, behavioural sequence analysis, and explainable SI.
Results summarise experiment outcomes with provenance from specimens through models, reasoning traces, and mitigation actions, supporting publication and reproducibility.
Limitations include concept drift, label noise, incomplete sandbox coverage, and the risk of collateral disruption from autonomous mitigation. Each documented to maintain research integrity.
Reproducibility requires versioned datasets, experiment configurations, model artefacts, container definitions, and published processing scripts when licensing permits.
Malware research involving real and submitted specimens follows institutional ethics requirements, quarantine policies, and responsible disclosure. Approval references are published when formally assigned.
Governance covers access reviews, data retention, submission intake, and approval workflows for agentic mitigation, ensuring autonomous actions remain accountable.
Security design isolates analysis in sandboxes, protects credentials, and routes responsible disclosure through documented channels. Public forms do not accept exploit delivery.
Outputs include publications, datasets, software releases, and thesis chapters, documenting contribution to predictive malware intelligence and autonomous defence knowledge.
Publications list scholarly and technical works derived from evaluated results, with bibliographic metadata and DOIs when formally assigned.
Dataset documentation covers historical corpora, sandbox-derived features, synthetic scenarios, and community submissions, with methodology, licensing, and experiment linkage.
Software encompasses the THREATBYTES™ platform, analysis engine clients, and reproducible experiment tooling released under appropriate research licences.
The public programme domain is threatbytes.ac.uk, used for research dissemination, documentation, and governed specimen intake workflows.
The programme follows methodology phases from large-scale data preparation through hybrid model development, platform-integrated defence, and comparative evaluation.
