Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 837197" data-attributes="member: 32260">WD offline detection c.d.Fragment from MS article:[URL unfurl=&quot;true&quot;]https://www.microsoft.com/security/blog/2018/02/14/how-artificial-intelligence-stopped-an-emotet-outbreak/[/URL]&quot;When the client-based machine learning model predicts a high probability of maliciousness, a rich set of feature vectors is then prepared to describe the content. These feature vectors include:<ul>
<li data-xf-list-type="ul">Behavior during emulation, such as API calls and executed code</li>
<li data-xf-list-type="ul">Similarity fuzzy hashes</li>
<li data-xf-list-type="ul">Vectors of content descriptive flags optimized for use in ML models</li>
<li data-xf-list-type="ul">Researcher-driven attributes, such as packer technology used for obfuscation</li>
<li data-xf-list-type="ul">File name</li>
<li data-xf-list-type="ul">File size</li>
<li data-xf-list-type="ul">Entropy level</li>
<li data-xf-list-type="ul">File attributes, such as number of sections</li>
<li data-xf-list-type="ul">Partial file hashes of the static and emulated content</li>
</ul>This set of features form a signal sent to the Windows Defender AV cloud protection service, which runs a wide array of more complex models in real-time to instantly classify the signal as malicious or benign.&quot;</blockquote>

[QUOTE="Andy Ful, post: 837197, member: 32260"] WD offline detection c.d. Fragment from MS article: [URL unfurl="true"]https://www.microsoft.com/security/blog/2018/02/14/how-artificial-intelligence-stopped-an-emotet-outbreak/[/URL] "[I]When the client-based machine learning model predicts a high probability of maliciousness, a rich set of feature vectors is then prepared to describe the content. These feature vectors include:[/I] [LIST] [*][I]Behavior during emulation, such as API calls and executed code[/I] [*][I]Similarity fuzzy hashes[/I] [*][I]Vectors of content descriptive flags optimized for use in ML models[/I] [*][I]Researcher-driven attributes, such as packer technology used for obfuscation[/I] [*][I]File name[/I] [*][I]File size[/I] [*][I]Entropy level[/I] [*][I]File attributes, such as number of sections[/I] [*][I]Partial file hashes of the static and emulated content[/I] [/LIST] [I]This set of features form a signal sent to the Windows Defender AV cloud protection service, which runs a wide array of more complex models in real-time to instantly classify the signal as malicious or benign.[/I]" [/QUOTE]

Verification