How Does Cylance Detect Malware Using Mathematics?

TL;DR

Cylance distinguishes malicious from benign files by extracting millions of features, vectorizing the resulting data, and training machine-learning models on known good and bad samples. It converts the trained model into a compact mathematical formula deployed to endpoints, where files can be blocked or allowed with very little performance overhead and without signatures, heuristics, or sandboxing.

Transcript

Cylance, with the tagline, "The Sound of Security." Please join me in welcoming Stuart McClure. All right. Well, welcome everybody. I'm Stuart McClure, CEO and founder of Cylance. I left a multi-billion dollar security company a couple years ago with this nagging feeling, you know, as CTO, that there has to be a better way to do this security thing... Read More

Key Insights

• Cylance is designed to distinguish malicious files from benign ones through mathematics rather than signatures, heuristics, or sandboxing. Its founders started from knowledge of hacking practices and sought to address malicious execution directly instead of focusing primarily on the symptoms produced by an attack.
• The detection process is built on collecting as many files as possible and extracting millions of features from them. Those features are transformed into vectors that machine-learning algorithms can evaluate to identify the characteristics that are most probabilistically useful for distinguishing good files from bad ones.
• The trained system produces a mathematical formula that can be miniaturized and deployed to an endpoint. The endpoint applies that formula to determine whether an item should be blocked or allowed, placing the decision at the execution layer where malicious code would otherwise run.
• Endpoint control makes the original delivery path less important because the system evaluates content where execution occurs. According to the presentation, an attack may arrive through email, the web, an open TCP port, an open UDP port, or another route without changing the core detection approach.
• Training data is initially labeled using historical industry judgments about known good and bad files, including information from software vendors. Cylance also adds its own understanding of hacking into a preliminary filtering stage before machine-learning models identify patterns that support classification decisions.
• A highly accurate and predictable model can be produced with approximately 5,000–10,000 properly seeded samples, according to the presentation. The accuracy depends on suitable initial labeling and on the training models identifying meaningful differences between malicious and benign examples.
• Ensemble modeling allows Cylance to apply multiple models in succession, moving from broad good-or-bad decisions toward more descriptive classification and clustering. The company discussed a possible separate model for software vulnerabilities, while clarifying that its system at that time focused specifically on malicious intent.
• The mathematical approach can also evaluate documents, PDFs, and JavaScript rather than being limited to conventional executable files. Its effectiveness across these formats depends on the number of extracted features, the selected algorithms, and the ability to vectorize the data quickly while maintaining similar accuracy.

Questions & Answers

Q: How does Cylance use mathematics to detect malware?

Cylance collects large numbers of files, extracts millions of features, and transforms the resulting information into vectors. Machine-learning algorithms are trained on examples identified as good or bad and select the most probabilistically useful features. Classification and clustering then produce a compact mathematical formula that is sent to endpoints, where it determines whether a file should be blocked or allowed.

Q: Does Cylance require signatures, heuristics, or sandboxing?

Cylance presents its method as an alternative to signatures, heuristics, and sandboxing. Instead of matching a file against a known signature or observing it inside a sandbox, the system evaluates mathematical features learned from good and bad samples. The resulting formula runs at the endpoint and classifies an item before deciding whether to permit or block its execution.

Q: How is the Cylance machine-learning model trained?

The model begins with files labeled through historical industry knowledge about what is good and what is bad, including judgments obtained from software vendors such as Microsoft. Cylance supplements those labels with its own knowledge of hacking, tools, tactics, and procedures. The data is then vectorized and processed through training models that identify useful features and classification patterns.

Q: How many samples does Cylance need to train a model?

According to Stuart McClure, Cylance needs approximately 5,000–10,000 samples to create a highly accurate and predictable model when the data is seeded properly. Proper seeding means beginning with credible distinctions between good and bad files and incorporating the company's knowledge of hacking before the machine-learning process derives its own classification patterns.

Q: Can Cylance detect threats in PDFs and JavaScript?

Cylance says its mathematical approach can work with documents, PDFs, and JavaScript as well as executable and file-based malware. The process still depends on extracting relevant features, selecting appropriate algorithms, and converting the information into vectors efficiently. McClure said these capabilities provide the same kind of accuracy, although the presentation did not provide a numerical accuracy rate.

Q: How does Cylance handle vulnerable but nonmalicious software?

Cylance distinguishes malicious intent from software that merely contains exploitable vulnerabilities. Its ensemble approach can run multiple models in succession, including more descriptive classification and clustering models. McClure said a model could be created from software containing CVEs to identify vulnerability exposure, but clarified that the product at that time evaluated maliciousness rather than vulnerability status.

Q: Why does Cylance evaluate threats at the endpoint?

Cylance evaluates threats at the endpoint because that is where execution ultimately occurs. Controlling the execution element means the system does not need a different core approach for every delivery route. A malicious item may arrive through email, the web, an open TCP port, an open UDP port, or another path, but it can still be classified before execution.

Q: What benefits did Cylance claim for its security approach?

Cylance claimed protection against advanced threats, zero-day attacks, and advanced persistent threats encountered by its customers. It also identified operational efficiency, cost savings from reducing security agents, low performance overhead because detection uses a mathematical formula, and patch mitigation as benefits. The presentation said customers in beta represented many different industry verticals but did not name them.

Summary & Key Takeaways

• Cylance was founded to develop a simpler, quieter approach to security grounded in knowledge of hackers, their tools, tactics, and procedures. The company focused on execution because many existing security products addressed attack symptoms rather than determining directly whether an executable item was malicious or benign at the endpoint.

• Its system collects large quantities of files, extracts millions of distinguishing features, transforms those features into vectors, and processes them through machine-learning algorithms. Classification and clustering produce a mathematical formula that is miniaturized for endpoint deployment, where it makes allow-or-block decisions without relying on signatures, heuristics, or sandbox analysis.

• Cylance said its endpoint-centered method works regardless of whether an attack arrives through email, the web, or an open TCP or UDP port. The company reported applications across many industries, including advanced threat detection, operational efficiency, agent reduction, performance improvement, and patch mitigation, while identifying model expansion as a future possibility.