Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 978534" data-attributes="member: 32260">Here is an example of a possible enhancement of the SRP approach (includes a nice video) via deep learning:[URL unfurl=&quot;false&quot;]https://ai.sophos.com/presentations/learning-from-context-a-multi-view-deep-learning-architecture-for-malware-detection/[/URL]In standard SRP solutions, the paths of executables are blocked or whitelisted. This can be overridden by hash or certificate rules. One can enhance this simplistic approach in many ways. Some of these possibilities are included in the above presentation. Another way is used in the H_C by creating smart rules integrated with Forced Smartscreen. This approach is kinda similar to the approach used in Microsoft Defender Application Control with Microsoft ISG (file reputation lookup). In Windows 11, Microsoft announced adding ISG reputation feature to Defender&#039;s Security Center:[URL unfurl=&quot;true&quot;]https://www.windowslatest.com/2022/03/05/windows-11-22h2-feature-promises-significant-protection-from-malware/amp/[/URL]Of course, this new Defender setting will be also beneficial to SWH if one will be able to live with many false positives.SWH does not protect against PE malware (EXE, DLL, etc.) and ISG just does it.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />For now, similar protection can be applied by SWH + Defender with ConfigureDefender MAX settings.</blockquote>

[QUOTE="Andy Ful, post: 978534, member: 32260"] Here is an example of a possible enhancement of the SRP approach (includes a nice video) via deep learning: [URL unfurl="false"]https://ai.sophos.com/presentations/learning-from-context-a-multi-view-deep-learning-architecture-for-malware-detection/[/URL] In standard SRP solutions, the paths of executables are blocked or whitelisted. This can be overridden by hash or certificate rules. One can enhance this simplistic approach in many ways. Some of these possibilities are included in the above presentation. Another way is used in the H_C by creating smart rules integrated with Forced Smartscreen. This approach is kinda similar to the approach used in Microsoft Defender Application Control with Microsoft ISG (file reputation lookup). In Windows 11, Microsoft announced adding ISG reputation feature to Defender's Security Center: [URL unfurl="true"]https://www.windowslatest.com/2022/03/05/windows-11-22h2-feature-promises-significant-protection-from-malware/amp/[/URL] Of course, this new Defender setting will be also beneficial to SWH if one will be able to live with many false positives. SWH does not protect against PE malware (EXE, DLL, etc.) and ISG just does it.:) For now, similar protection can be applied by SWH + Defender with ConfigureDefender MAX settings. [/QUOTE]

Verification