"AI should not be a soloist, but part of a multi-layered ensemble"

It is true that traditional signature-based anti-virus programs do not provide reliable protection against modern malware. The cybercriminals have now learned their lesson and carry out quality assurance by checking whether the known virus scanners recognize their new malware during malware development. They then modify it until no virus scanner is able to detect it. The criminals then have a time window of a few minutes to hours in which they can successfully spread the malware.

Cybercriminals also use AI

This is to be remedied by so-called NextGen Endpoint Security solutions with machine learning technologies, which no longer detect malware on the basis of similarity with known malware signatures, but by analyzing the properties of a file.

Only - no one is stopping the cybercriminals from also buying licenses of the NextGen endpoint solutions with machine learning and manipulating the malware until the new malware is no longer detected by these solutions either. This is exactly what, for example, the developers of NotPetya did, a sophisticated malware that got onto computers of all companies doing business with Ukraine via the update mechanism of a Ukrainian tax program. Neither traditional anti-malware solutions nor machine learning-based solutions reliably detected the malware initially.

Advanced NextGen endpoint solutions like Sophos's Intercept X, which not only inspect files before execution but also monitor software during execution, identified and stopped NotPetya's malicious intent via behavioral detection - in this case, the attempt to maliciously encrypt the hard drive caught the eye and was prevented by Intercept X.

DeepLearning is more performant

Nevertheless, the use of machine learning - preferably in the very fast and effective Deep Learning variant - can improve security in companies. A good Deep Learning model is much faster than a traditional signature-based anti-virus, so it noticeably reduces the system load. At the same time, many unknown threats are also detected. The basic prerequisite for a high detection rate on the one hand and a low false positive rate on the other is not only a powerful AI model (deep learning models are best suited in practice) but also a large amount of training data. Sophos trains its Deep Learning model with virtually all examples of malware, as well as harmless software, from the last 30 years to minimize false positives. New players in the NextGen endpoint security market also use machine learning models, but have much less training data available, which can have a negative impact on false positives.

There are also bad AI models

A bad AI model can be easily identified if the manufacturer proposes a test scenario in which either "malware samples" specified by the manufacturer are to be used or if the model first has to be trained on the customer environment. This is an indication of an AI model that is not generally applicable and that practically first has to generate exceptions (de facto signatures) for a specific customer environment - which makes the approach of a signatureless technology absurd. In addition, there are AI models that scale poorly and become very large and performance-hungry over time, requiring them to be offloaded to a dedicated scanning environment in the cloud or a scanning appliance. A good AI model is one that is compact, fast, and universally usable, meaning it can be deployed immediately at the customer's site without specific training.

AI as a building block in modern multilayered security systems

It is important to note, however, that the examination of certain file types prior to execution - whether with or without artificial intelligence methods - is only one building block in a multi-layered endpoint security. Only about half of all malware today enters the enterprise as executable files (and can thus be examined with artificial intelligence methods); the other half of threats today comes in the form of document and media malware, as well as completely fileless through infected websites or via exploit.

Therefore, it is important to implement multiple layers of security:

1. Layer - Control of malware entry paths: this includes web filtering, device control, application control and desktop/gateway firewall with network intrusion prevention.
2. Layer - pre-execution examination: here files are examined with signatures, machine learning or heuristics.
3. Layer - Behavior Detection: This is where malicious behavior is detected such as ransomware/encryption detection, exploit prevention, protection against hacker technologies such as password theft protection.
4. Layer - Automatic Response: In addition to traditional threat quarantine and cleanup, this now includes automatic recovery of files encrypted by ransomware and communication with other components to automatically contain threats.
5. Layer - Analysis: Downstream root cause analysis can identify how the malware entered, how/if/where it spread, and which company resources may still be affected and need to be cleaned up.

Attackers will always manage to overcome individual mechanisms, but this effort increases exponentially with multiple layers of protection. Therefore, a multi-layer approach to IT security and the communication of security components with the ability to automatically respond to threats (for example, by the firewall or WLAN access point automatically isolating an infected endpoint in the network) are key to modern and effective IT security.

To the author: Michael Veit is a security specialist at Sophos