S12 Bonus: Fusing AI-Powered Predictive Malware Inference with Content Disarmament and Reconstruction (CDR) to Neutralize Silent File Attacks with Dr. Aqib Rashid, Applied AI Lead at Glasswall

Episode Summary

Executive Summary: Dr. Akib Rashid explains how Glasswall evolved from researching CDR-based malware detection into a production-grade product that cleans files and predicts maliciousness using deep structural telemetry. He describes building the ML pipeline, balancing accuracy, latency, explainability, and scalability, and stresses that trust, repeatability, and domain curiosity were key to success.

Main Topics: CDR telemetry as the basis for malware detection (Priority: 5/5): Glasswall first proved that deep structural telemetry extracted during file cleaning could distinguish malicious from benign files. The team validated the science before productizing it, showing CDR data can support reliable ML-based malware prediction. From research MVP to commercially viable product (Priority: 5/5): The MVP phase focused on whether the signal was discriminative and whether detection performance, false positives, inference time, and deployment constraints could meet enterprise needs. Productization required balancing technical feasibility with customer utility. ML/SW engineering roadmap and production rigor (Priority: 5/5): Rashid describes moving from hypothesis to production discipline by adding an ML development lifecycle, automated experimentation, model assurance, drift monitoring, and user-friendly software around the model. Scalability and repeatable training pipelines (Priority: 4/5): A key early step was building an end-to-end ML pipeline from scratch that could ingest millions of files, run feature analysis and training in hours, and remain cost-effective and maintainable over time. Team building around curiosity and standards (Priority: 4/5): He hired people for curiosity, domain knowledge, engineering skill, and high standards—valuing learners who could contribute to solving a hard, evolving security problem. Trust, zero trust, and long-term resilience (Priority: 5/5): Glasswall’s philosophy is to reconstruct files into clean, deterministic outputs that are safe regardless of origin, and to build models that remain effective against shifting malware threats and in offline environments. Lessons, mistakes, and future direction (Priority: 3/5): Rashid notes that early assumptions about which features would be most useful did not always hold, requiring iteration. Looking ahead, he advises founders to build trust-worthy systems that are hard to copy rather than flashy features alone.

Key Arguments: CDR structural telemetry can meaningfully distinguish malware from benign files, providing a strong signal for ML models. A research result is not enough; a usable product must also satisfy enterprise constraints like false-positive rates, latency, explainability, and deployment flexibility. Building a robust ML pipeline early enables repeatable, scalable, and cost-controlled model development. Model performance must be monitored over time because threats and malware patterns evolve, causing drift. A product in cybersecurity should be designed for trust and resilience first, since that is harder to replicate than surface-level capabilities. Hiring curious people with domain understanding and high standards is essential when solving difficult, ambiguous technical problems. Early assumptions about useful telemetry/features can be wrong, so R&D must remain iterative and hypothesis-driven.

Data Points: Joined Glasswall: September 2023 - Rashid says he joined the company in September 2023 to help build malware-detection capability. PhD focus: 2023 - He was completing a PhD in 2023 on securing ML-based malware detection and prediction models. Pipeline throughput: Millions and millions of files - Glasswall’s ML pipeline can ingest very large file volumes for feature analysis, selection, and model training. Training turnaround: A matter of hours - He says the pipeline can train models and complete post-training activities within hours for the file types they care about. Model performance target: High true positive rates and low false positive rates - Commercial viability depended on hitting acceptable detection and false-alarm thresholds for customers. Deployment modes: Air-gapped/offline and SaaS/enterprise - Rashid says the models must work both without internet access and in enterprise SaaS environments.

Pivotal Quotes: "we wanted to first prove out that end-to-end process" — Dr. Akib Rashid: Describing the MVP stage for validating CDR telemetry as a basis for malware detection. "build something that deserves trust before you build something that is that seems to be impressive" — Dr. Akib Rashid: His advice to young entrepreneurs on what to prioritize in cybersecurity and AI products. "we have proved out that yes you can build capable models for this problem" — Dr. Akib Rashid: Summarizing Glasswall’s achievement in building durable malware-detection models from structural telemetry.

Implications: The episode suggests that durable cybersecurity AI depends on trustworthy data signals, strong engineering discipline, and ongoing drift management. For founders, it argues for products that are hard to copy because they are built on deep technical trust and operational rigor.