How is machine learning used in anti-malware applications?

The challenge to staying on top of malware attacks is identifying when they’re happening in the first place.

In the past, users may have been content to run a scan on their hard drive once a week or so, but with the internet, malware attacks spread quickly. Security software makers are increasingly turning to artificial intelligence to detect and stop malware attacks.

Antivirus software scanning tools are generally based on virus behavior signatures. The problem is that with so many computers out there, it’s hard to keep track of when a new virus outbreak is occurring.

With many anti-virus makers moving to the cloud, this gives them an opportunity to analyze real-time data coming from computers around the world. Anti-virus developers can see an outbreak, issue updates and stop the virus in a matter of hours, when it would have taken days in the past. It’s artificial intelligence that makes this possible. An AI-based anti-virus can analyze unusual behavior for signs of a virus.

One example of an AI anti-virus is Microsoft’s Windows Defender on Windows 10. Defender looks at system activity and flags unusual activity, such as Microsoft Word using a lot of memory. This might clue developers in that they’re dealing with a new piece of malware.

Machine learning programs learn what is normal behavior first, and look for anything that might be out of line.

With major ransomware attacks like WannaCry, malware has the potential to cost businesses a lot of money, both in attempting to pay the ransoms and in lost data and productivity.

Malware developers are more professionalized and they’re engaged in an arms race with anti-virus developers. Using AI and machine learning can give anti-virus developers an edge in keeping systems safe.

With the combination of the cloud and AI, anti-malware programs can move much more quickly to stop attacks than they have in the past.