Skip Navigation
  1. BlackBerry Docs
  2. Cylance Engine
  3. Cylance Engine Integration Guide
  4. How the Cylance Engine analyzes a file
  5. Scoring and threat indicators
  6. Score generated by the Cylance Engine

Score generated by the
Cylance Engine

The score represents the confidence the
Cylance Engine
 has that a file is good or bad. Scores returned by the
Cylance Engine
 are decimal numbers ranging from -1.0 to +1.0. A negative value indicates that the file has been classified as a potentially bad file and a positive value indicates that the file has been classified as a potentially good file. The numerical value indicates the confidence in this file being identified as a risk or not.
For example:
Score
Meaning
-0.6
There is a 60% confidence level that the file is bad.
+0.6
There is a 60% confidence level that the file is good.
The numerical value represents the confidence in a file being identified as a risk or not; it is not an indication of the harmfulness of a file.
If an error occurs during the processing of the file, the score may be NaN (not a number) to indicate that a score was not generated. In this case, the result should contain more information on the error.

Suggested implementation

As a guideline, the following conventions serve to classify the files.
Score
Meaning
Less than -0.6
Malware
-0.6 to 0
Suspicious
Greater than 0
Safe
Scoring considers not only the threat indicators, but also the relationships between these and many other characteristics of the file. Because the scoring uses complex mathematical models that operate directly on the features of the file, it is not possible to determine the score only from the threat indicators.