Reply to thread

Message

<blockquote data-quote="vtqhtr413" data-source="post: 724418" data-attributes="member: 65229">From Dan, VoodooShield Dev, 4/5/18Source, <a href="https://calendarofupdates.org/index.php?topic=770.405" target="_blank">VoodooShield v4 STABLE Thread</a>ML/Ai will always have some false positives, although they are extremely uncommon for commonly downloaded files (at lease for VoodooAi they are).&nbsp; Someone once said that VoodooAi would not do so well with the top 100 files from a major download site.&nbsp; If they would have tested instead of speculated, they would have found that it does extremely well .Here is the Cuckoo analysis of that file: <a href="http://voodooshield.ddns.net:8080/analysis/12417/" target="_blank">http://voodooshield.ddns.net:8080/analysis/12417/</a>So that file certainly has a lot of characteristics and features of a malicious file, even though it is not.&nbsp; The funny thing is that I cannot tell you exactly what triggered our Ai algos to believe it was malicious.&nbsp; I could get an idea of what features triggered the false positive, but there is simply no way the human mind will ever be able to understand all of the extremely complex interconnected relationships between features in an Ai model.Just for the heck of it, I digitally signed the file and reanalyzed the file with VoodooAi, and the result was 17/100 (Safe).&nbsp; Sometimes just signing the file makes all of the difference in the world, and sometimes it makes hardly no difference at all.&nbsp; It all depends on the complex relationships between features in the Ai model.ML/Ai engines will always have false positives and false negatives.&nbsp; In real world performance, it is essentially mathematically impossible to achieve anything greater than a 95% or so efficacy with ML/Ai models alone.&nbsp; If we were able to achieve an efficacy that approached 100%, we would not need to lock our computers when they are at risk .</blockquote>

[QUOTE="vtqhtr413, post: 724418, member: 65229"] From Dan, VoodooShield Dev, 4/5/18 Source, [URL="https://calendarofupdates.org/index.php?topic=770.405"]VoodooShield v4 STABLE Thread[/URL] ML/Ai will always have some false positives, although they are extremely uncommon for commonly downloaded files (at lease for VoodooAi they are). Someone once said that VoodooAi would not do so well with the top 100 files from a major download site. If they would have tested instead of speculated, they would have found that it does extremely well . Here is the Cuckoo analysis of that file: [URL]http://voodooshield.ddns.net:8080/analysis/12417/[/URL] So that file certainly has a lot of characteristics and features of a malicious file, even though it is not. The funny thing is that I cannot tell you exactly what triggered our Ai algos to believe it was malicious. I could get an idea of what features triggered the false positive, but there is simply no way the human mind will ever be able to understand all of the extremely complex interconnected relationships between features in an Ai model. Just for the heck of it, I digitally signed the file and reanalyzed the file with VoodooAi, and the result was 17/100 (Safe). Sometimes just signing the file makes all of the difference in the world, and sometimes it makes hardly no difference at all. It all depends on the complex relationships between features in the Ai model. ML/Ai engines will always have false positives and false negatives. In real world performance, it is essentially mathematically impossible to achieve anything greater than a 95% or so efficacy with ML/Ai models alone. If we were able to achieve an efficacy that approached 100%, we would not need to lock our computers when they are at risk . [/QUOTE]

Verification