TECH

Microsoft Defender uses AI to defend against attacks

Microsoft has unveiled an AI-based ransomware detection system for Defender. The system complements cloud protection by further assessing blocking risks and threats.

Human-controlled ransomware is characterized by a specific set of methods and behavior markers, so Microsoft decided to use the potential of artificial intelligence to detect attacks of this type. Typically, an attack starts with the injection of a file that provides remote access to the victim's computer. However, not all files used in attacks are known to be malicious – some of them are not malicious at all. Therefore, tokens generated by these files can be considered low priority and ignored by antivirus software. Additional adaptive AI-based protection that can detect the unusual behavior of standard programs can play a decisive role.

Unlike traditional cloud-based protection, which is manually configured, the new system is adaptable – it can automatically increase or decrease the aggressive nature of blocking decisions provided by the cloud based on real-time data and predictions from the machine learning platform . Even if the algorithm fails to estimate the real magnitude of the threat and the attacker achieves its goal, the system will still become an obstacle to the attack: when the machine is already compromised, the system can switch to more aggressive mode and block malware payload, avoiding the encryption of data and important files.

AVnews