Scope

These publications explain defensive file, archive and URL assessment using conceptual and harmless synthetic examples. They do not measure the accuracy of a production malware detector unless expressly documented.

Evidence and uncertainty

File identity is not file trust. Static observations are not behavioral proof. Reputation reports need provenance and timestamps. When evidence is insufficient, uncertainty is an appropriate outcome.

Publication status

These are original notes published by the MalGuard project. They have not been independently peer-reviewed or certified. No guarantee of product security is claimed.

Corrections

Propose corrections or improvements through the public repository.