Docs / Surface / detection-deep-dive

How Surface Detects Threats

Surface takes a layered approach to threat detection. Instead of betting on a single technique, it runs multiple independent detection engines in parallel and merges their results into one safety score. No single engine has to be perfect, since they back each other up, and the combined signal is far stronger than any individual check.

This page walks through each detection layer, explains how scoring works, and gives you honest numbers on what Surface catches well and where its limits are.

The Multi-Engine Approach

Most security tools lean heavily on one method: signature matching, heuristics, or ML. Each has blind spots. Surface sidesteps this by running multiple engines concurrently and combining their findings into a single weighted safety score. When multiple engines independently flag the same content, confidence goes up. When only one engine fires on a borderline signal, the system stays cautious before raising an alarm.

The engines are organized into five layers, each targeting a different class of threat.

Layer 1: Known Threat Signatures

Surface maintains a large database of malware hash signatures. If an incoming file matches a known threat, the result comes back immediately, typically in single-digit milliseconds.

The hash database is backed by threat intelligence feeds that refresh every 30 minutes, covering known malware signatures, phishing URLs, and malicious IP infrastructure.

Layer 2: Pattern Matching with YARA

Hash lookups catch exact matches, but attackers routinely modify files just enough to change their hash while preserving malicious behavior. YARA rules bridge that gap by matching on structural patterns inside file content rather than the file's overall hash.

Surface ships with a curated YARA ruleset, a combination of in-house rules and vetted community rulesets. These rules describe byte sequences, string patterns, and structural characteristics that appear across entire malware families.

Each rule carries a confidence weight based on its historical precision, so high-confidence rules have more influence on the final score than broad, generic patterns.

Layer 3: Machine Learning

When a file does not match any known signature or YARA rule, machine learning models provide the next line of defense. Surface embeds purpose-built classification models directly in the scanner, so inference runs entirely in-process with no external API calls.

The models are format-specific, meaning different file types get analyzed by dedicated classifiers:

Each model is trained on large labeled datasets and uses format-specific features to distinguish legitimate usage patterns from malicious ones. Inference stays under 100 milliseconds per file.

Layer 4: Behavioral Analysis

Layers 1 through 3 look at what a file is. Layer 4 looks at what a file does, or more precisely, what it appears designed to do.

Surface extracts indicators of compromise (IOCs) such as URLs, IP addresses, domains, and suspicious API calls from scanned content, then cross-references them against its threat intelligence feeds in real time.

The behavioral engines also include format-specific analysis: inspecting Office documents for macro-based threats and embedded objects, examining PDFs for hidden actions and obfuscated content, and analyzing scripts across all supported languages for encoded commands and suspicious execution patterns.

Layer 5: Variant Detection

Malware authors frequently release slightly modified versions of existing threats, such as repacked binaries, re-encoded scripts, or files with shuffled sections. Layer 5 catches these variants even when the exact bytes have changed.

Fuzzy hashing computes similarity-preserving hashes so that structurally similar files can be matched against known threats, even after modification.

Packer detection identifies when a file has been processed by obfuscation or packing tools. Packed files are not automatically malicious, but packing is a strong signal when combined with other findings.

Deobfuscation applies multiple techniques to recover hidden indicators, such as encoded URLs, domain names, or command strings, that malware uses to evade simple pattern matching.

Payload-Specific Engines

In addition to traditional file scanning, Surface includes engines tailored for API and AI agent security. These are particularly relevant if you are using Surface to protect LLM-powered applications or webhook endpoints.

These engines use a combination of pattern matching and lightweight ML classifiers, following the same scoring and weighting system as the file-oriented engines.

How Scoring Works

Each engine that fires produces a weighted contribution to the overall safety score. The weights reflect each engine's historical precision: engines with lower false-positive rates carry more influence.

When multiple engines independently flag the same content, the system amplifies the signal. Independent agreement from different detection methods is one of the strongest indicators available.

Surface also applies anti-noise heuristics to reduce false positives, accounting for file types that commonly trigger generic rules and boosting confidence when files match known-safe patterns.

The final safety score maps to a verdict:

Informational sits between Clean and Suspicious: low-severity signals were noted but the content is still recommended for Allow. It lets you surface minor flags without blocking.

Confidence Calculation

The safety score tells you what the system thinks. The confidence level tells you how sure it is.

Confidence depends on two factors: how many engines were able to analyze the content, and whether they agree. A scan where eight engines all report clean is high confidence. A scan where only two engines ran (because the file type limited applicability) is lower confidence, even if both said clean.

Engine coverage is one input among several. Having four or more engines analyze the content contributes toward the score but is not enough on its own to reach High; agreement between engines and a clear signature/feed result also matter.

A clean result from threat feed lookups provides an additional confidence boost, since it confirms the content has no known associations with threat infrastructure.

For an honest breakdown of what Surface catches well and where its limits are, see Detection Coverage.

Performance

Surface is designed to sit in the request path without adding noticeable latency. The multi-layer architecture uses early exits and caching aggressively so that most requests resolve quickly.

Throughput scales automatically with your infrastructure. Cache hits are the common case in production: once a file or payload has been scanned, subsequent identical requests return instantly from cache.

← Back to Surface docs