THREATBYTESTM research
Cognitive reasoning
Cognitive and reasoning layers infer malware intent from incomplete or evolving behavioural indicators, enabling prediction of previously unseen behaviours rather than opaque scores alone.
Reasoning research produces traceable rationale linking observations to hypotheses and mitigation options, evaluated with explainable SI techniques for analyst trust.
Inputs: static features, any behavioural observations, similarity to known families, and model predictions with their confidence.
Outputs: ranked hypotheses about what the specimen does and why, the evidence for and against each, a calibrated confidence, and the mitigation options each hypothesis would justify.
- Generate hypotheses from partial signals, such as an import pattern suggesting credential theft.
- Weigh evidence, including evidence that is missing but expected.
- Keep uncertainty explicit rather than collapsing it into one score.
- Record each step as a trace that can be reviewed and scored.
The engine currently produces rule-based rationale text from static analysis. Learned reasoning over incomplete signals, the subject of RQ-002, is developed and evaluated in phase 2.