Microsoft and Intel may have found a new way to detect computer viruses: training an antivirus program to “see” signs of malicious behavior in the computer code.
The approach works by first converting a malware’s programming into 2D images, which can reveal visual patterns in the computer code. An AI-powered program can then inspect the images for traits indicating malicious behavior.
“If malware binaries are plotted as grayscale images, the textural and structural patterns can be used to effectively classify binaries as either benign or malicious, as well as cluster malicious binaries into respective threat families,” Microsoft wrote in a blog post.
Credit: Microsoft-Intel
To pull this off, the companies converted the malware’s programing into a one-dimensional stream of digital pixels. As their study explains, each byte in the malware’s code can be imaged to correspond to a different level pixel intensity.
The researchers then expanded the pixel streams into 2D images by using the malware’s file size after the conversion to determine the width and height. This allowed the Microsoft-Intel antivirus program to see the malware’s characteristics and train itself to discern them.
The approach, dubbed STAMINA, is showing some promising results. In a test using real-world malware samples, the antivirus program achieved 99.07 percent accuracy with a false-positive rate of 2.87 percent.
The companies developed STAMINA to address drawbacks in today’s antivirus scanning technology. The detection approaches can also involve disassembling a piece of malware into metadata to find trace signs of dangerous behavior. However, hackers are routinely coming up with ways to mask the malicious processes, making computer virus detection akin to a cat-and-mouse game.
STAMINA could potentially add a new tool to ferret out malware. "This joint research is a good starting ground for more collaborative work," Microsoft said. "For example, the researchers plan to collaborate further on platform acceleration optimizations that can allow deep learning models to be deployed on client machines with minimal performance impact. Stay tuned."
However, the company notes the approach does have a key limitation: it has trouble dealing with large file sizes. Converting them into a 2D image would require billions of pixels, making the detection method less practical if the malware comes bundled in a big program.
Further Reading
- Thunderbolt Flaw Allows Your Data to Be Stolen in 5 Minutes
- Most Americans Don't Trust Tech Industry in COVID-19 Contact-Tracing Efforts
- 'Hobby Project' Botnet Downloaded Anime for 8 Years
- Wii Hacker: Leaked Source Code for Nintendo Gaming Systems Is 'Nonsense'
- More in Security
Security Reviews
- Avira Free Antivirus for Mac
- Spybot - Search & Destroy +AV Home Edition
- Kaspersky Password Manager
- Avira Free Security
- Surfshark VPN