When you\u2019ve been fighting black-hat hackers for decades, you learn a thing or two about them. Obviously, they are bad, and they like to play with code. But most importantly, they\u2019re continually learning and you need to keep up if you want to protect your customers\u2019 businesses from their sticky fingers.<\/p>\n
Now, if we were a post-truth security vendor<\/a>, we would talk a lot about how our machine learning makes us fit for the fight, or how mathematics can predict an attacker\u2019s every move. We would also try to downplay the fact that even advanced technologies can be fooled by adversaries.<\/p>\n \u201cNo matter how smart a machine learning algorithm is, it has a narrow focus and learns from a specific data set.\u201d<\/span><\/p>\n But at ESET, we value the truth. No matter how smart a machine learning algorithm is, it has a narrow focus and learns from a specific data set. By contrast, attackers possess so-called general intelligence and are able to think outside of the box. They can learn from context and benefit from inspiration, which no machine or algorithm can predict.<\/p>\n Take self-driving cars as an example. These smart machines learn how to drive in an environment with road signs and pre-set rules.<\/p>\n But what if someone covers all the signs or manipulates them<\/a>? Without such a vital component, the cars start to make wrong decisions that can end in a fatal crash, or simply immobilize the vehicle.<\/p>\n In cyberspace, malware writers specialize in such malicious behavior. They try to hide the true purpose of their code, by \u201ccovering\u201d it with obfuscation or encryption. If the algorithm cannot look behind this mask, it can make a wrong decision, labeling a malicious item as clean \u2013 causing a potentially dangerous miss.<\/p>\n However, recognizing the mask doesn\u2019t always reveal the code\u2019s true nature, and without executing the sample there is no way of knowing what is under the hood. To do this ESET uses a simulated environment \u2013 known as sandboxing \u2013 deprecated by many of the post-truth vendors. They claim their technology can recognize malice simply by looking at a sample and doing the \u201cmath\u201d.<\/p>\n How would that work in real life? Try and determine a house\u2019s price just by looking at a picture of it. You can use some features, such as the number of windows or floors to get a rough estimate. But without knowing where the house is located, what is inside, and other details, there is a high probability of error.<\/p>\n On top of that, the mathematics itself contradicts these post-truth claims \u2013 by referring to what\u2019s known as an \u201cundecidable problem\u201d, i.e. determining whether a program will behave maliciously according to its external appearance \u2013 as demonstrated by the computer scientist who formulated the definition of computer virus, Fred Cohen<\/a>.<\/p>\n Moreover, in cybersecurity, some problems require so much computational capacity \u2013 or are so time-consuming \u2013 that even a machine learning algorithm would be ineffective in solving them \u2013 making them practically undecidable.<\/p>\n Now put all this information into an equation with a smart, dynamic opponent and your endpoints can end up infected.<\/p>\n ESET has considerable experience with intelligent adversaries and knows that machine learning alone is not enough to protect endpoints. We have been using this technology for years and have fine-tuned it to work with a variety of other layers of protection that are under the hood of our security solutions.<\/p>\n Moreover, our detection engineers and malware researchers constantly supervise \u201cthe machine\u201d to avoid unnecessary errors along the way, ensuring that detection runs smoothly without bothering ESET business customers with false positives.<\/p>\n The whole series:<\/p>\n\n