Classless-based and activity-class-based scoring

Although

Cylance

TcpService has replaced TcpShim and InfinityTcpService, it still supports the activity-class-based scoring supported by the legacy applications; however, the newer and more flexible classless-based scoring is highly preferred. In TcpShim, the command was the fully-qualified name of the class that should process the file (for example

Cylance.Infinity.Activity.SampleScoring.SampleScoringPEActivity

). This meant that the client application needed to know the kind of file (in this case, PE) before calling TcpShim to process the file. Processing archive files makes this challenge even greater, because a given archive file can contain multiple different file types, each requiring a possibly different activity class.

The InfinityTcpService introduced classless-based scoring, in which the class name field in the request was replaced by a command, such as ScoreFile, ScoreArchive, ExplainFile, or ExplainArchive. In turn, these commands were further reduced in the

Cylance

TcpService to just Score and Explain. The client application no longer needs to know beforehand what kind of file it is; the

Cylance

TcpService scores or explains it against all applicable models, and returns zero or more results.

While the Score and Explain commands are highly recommended, the ScoreFile, ScoreArchive, ExplainFile, and ExplainArchive commands still work; however, ScoreFile and ExplainFile return an error if the file given is an archive, while ScoreArchive and ExplainArchive return an error if the file is not an archive.

Additionally, the class-based scoring still works but the ClassName entry in the activity section(s) of the

Cylance

TcpService.ini configuration file are not populated by default. The class name has also became arbitrary and no longer maps to a name of an activity class in

Cylance

TcpService; it just needs to be a unique string for each activity.