How Artificial Intelligence Is Taking On Ransomware

Twice in the space of six weeks, the world has faced major attacks of ransomware — malicious software that locks up photos and other files stored on your computer, then demands money to release them. Despite those risks, many people just aren’t good at updating security software. In the early days, identifying malicious programs such as viruses involved matching their code against a database of known malware. [...] a program that starts encrypting files without showing a progress bar on the screen could be flagged for surreptitious activity, said Fabian Wosar, chief technology officer at New Zealand security company Emsisoft. An even better approach identifies malware using observable characteristics usually associated with malicious intent — for instance, by quarantining a program disguised with a PDF icon to hide its true nature. For that, security researchers turn to machine learning, a form of artificial intelligence. The security system analyzes samples of good and bad software and figures out what combination of factors is likely to be present in malware. On the flip side, malware writers can obtain these security tools and tweak their code to see if they can evade detection. Some websites already offer to test software against leading security systems. Dmitri Alperovitch, co-founder and chief technology officer at Irvine vendor CrowdStrike, said that even if a particular system offers 99 percent protection, “it’s just a math problem of how many times you have to deviate your attack to get that 1 percent.” Though Cylance plans to release a consumer version in July, it says it’ll be a tough sell — at least until someone gets attacked personally or knows a friend or family member who has.