Docs / Surface / detection-deep-dive

How Surface Detects Threats

Surface takes a layered approach to threat detection. Instead of betting on a single technique, it runs multiple independent detection engines in parallel and merges their results into one safety score. No single engine has to be perfect, since they back each other up, and the combined signal is far stronger than any individual check.

This page walks through each detection layer, explains how scoring works, and gives you honest numbers on what Surface catches well and where its limits are.

The Multi-Engine Approach#

Most security tools lean heavily on one method: signature matching, heuristics, or ML. Each has blind spots. Surface sidesteps this by running multiple engines concurrently and combining their findings into a single weighted safety score. When multiple engines independently flag the same content, confidence goes up. When only one engine fires on a borderline signal, the system stays cautious before raising an alarm.

The engines are organized into five layers, each targeting a different class of threat.

Layer 1: Known Threat Signatures#

Surface maintains a large database of malware hash signatures. If an incoming file matches a known threat, the result comes back immediately, typically in single-digit milliseconds.

The hash database is backed by threat intelligence feeds that are refreshed continuously, covering known malware signatures, phishing URLs, and malicious IP infrastructure.

Layer 2: Pattern Matching with YARA#

Hash lookups catch exact matches, but attackers routinely modify files just enough to change their hash while preserving malicious behavior. YARA rules bridge that gap by matching on structural patterns inside file content rather than the file's overall hash.

Surface ships with a curated YARA ruleset, a combination of in-house rules and vetted community rulesets. These rules describe byte sequences, string patterns, and structural characteristics that appear across entire malware families.

Each rule carries a confidence weight based on its historical precision, so high-confidence rules have more influence on the final score than broad, generic patterns.

Layer 3: Machine Learning#

When a file does not match any known signature or YARA rule, machine learning models provide the next line of defense. Surface embeds purpose-built classification models directly in the scanner, so inference runs entirely in-process with no external API calls.

The models are format-specific, meaning different file types get analyzed by dedicated classifiers:

Scripts are handled by dedicated Python and JavaScript classifiers, plus a single combined script classifier for everything else. Earlier per-language script models were withdrawn in 2026-08 when the combined model beat them; the JavaScript model was retrained in 2026-09 on real malicious JavaScript against npm-sourced benign JavaScript and reinstated after it beat the combined model on false positives. PowerShell, VBScript and batch remain on the combined model. Each model is trained on large labeled datasets and uses format-specific features to distinguish legitimate usage patterns from malicious ones. Inference stays under 100 milliseconds per file.

Layer 4: Behavioral Analysis#

Layers 1 through 3 look at what a file is. Layer 4 looks at what a file does, or more precisely, what it appears designed to do.

Surface extracts indicators of compromise (IOCs) such as URLs, IP addresses, domains, and suspicious API calls from scanned content, then cross-references them against its threat intelligence feeds in real time.

The behavioral engines also include format-specific analysis: inspecting Office documents for macro-based threats and embedded objects, examining PDFs for hidden actions and obfuscated content, and analyzing scripts across all supported languages for encoded commands and suspicious execution patterns.

Layer 5: Variant Detection#

Malware authors frequently release slightly modified versions of existing threats, such as repacked binaries, re-encoded scripts, or files with shuffled sections. Layer 5 catches these variants even when the exact bytes have changed.

Fuzzy hashing computes similarity-preserving hashes so that structurally similar files can be matched against known threats, even after modification.

Packer detection identifies when a file has been processed by obfuscation or packing tools. Packed files are not automatically malicious, but packing is a strong signal when combined with other findings.

Deobfuscation applies multiple techniques to recover hidden indicators, such as encoded URLs, domain names, or command strings, that malware uses to evade simple pattern matching.

Payload-Specific Engines#

In addition to traditional file scanning, Surface includes engines tailored for API and AI agent security. These are particularly relevant if you are using Surface to protect LLM-powered applications or webhook endpoints.

These engines use a combination of pattern matching and lightweight ML classifiers, following the same scoring and weighting system as the file-oriented engines.

How Scoring Works#

Each engine that fires produces a weighted contribution to the overall safety score. The weights reflect each engine's historical precision: engines with lower false-positive rates carry more influence.

When multiple engines independently flag the same content, the system amplifies the signal. Independent agreement from different detection methods is one of the strongest indicators available.

Surface also applies anti-noise heuristics to reduce false positives, accounting for file types that commonly trigger generic rules and boosting confidence when files match known-safe patterns.

The final safety score maps to a verdict:

Informational sits between Clean and Suspicious: low-severity signals were noted but the content is still recommended for Allow. It lets you surface minor flags without blocking.

Confidence Calculation#

The safety score tells you what the system thinks. The confidence level tells you how sure it is.

Confidence depends on two factors: how many engines were able to analyze the content, and whether they agree. A scan where eight engines all report clean is high confidence. A scan where only two engines ran (because the file type limited applicability) is lower confidence, even if both said clean.

Engine coverage is one input among several. Having four or more engines analyze the content contributes toward the score but is not enough on its own to reach High; agreement between engines and a clear signature/feed result also matter.

A clean result from threat feed lookups provides an additional confidence boost, since it confirms the content has no known associations with threat infrastructure.

For an honest breakdown of what Surface catches well and where its limits are, see Detection Coverage.

Performance#

The multi-layer architecture uses early exits and caching aggressively, so repeat content resolves in milliseconds. A cold executable scan is a different matter: it fans out across ClamAV, YARA, unpackers and CVE lookups, and you should budget seconds for it rather than milliseconds.

Throughput scales automatically with your infrastructure. Cache hits are the common case in production: once a file or payload has been scanned, subsequent identical requests return instantly from cache.

← Back to Surface docs