MalGuard Original technical note · 21 October 2026 · Not independently peer-reviewed. No real-world detector performance or security guarantee is claimed.
Level one: observations
Start with direct facts such as file size, digest, format signature, archive inventory or URL components. A fact about content is not automatically a safety assessment.
Level two: corroboration
Connect observations to attributable, dated evidence such as distribution provenance or independent reputation sources. Multiple reports copied from one origin are not independent confirmation.
Level three: interpretation
Only then offer a conclusion, with confidence and limitations. An unknown outcome is essential when the tool has not collected sufficient evidence.
Avoid misleading certainty
A single colored badge can conceal conflicting signals. Explain the supporting facts and unexamined areas. This proposed ladder is a reporting framework, not a validated detection model.