Deep Instinct brings AI to cybersecurity
March 2016 – At the RSA Conference 2016 in San Francisco, Deep Instinct was showing their new cybersecurity system that is built around an advanced Artificial Intelligence (AI) engine. The AI system in place is a deep learning neural network methodology that self learns about malware and threats in an enterprise. The product was developed by Israeli Defense Force Cybersecurity veterans and has development and support offices in Tel Aviv and Silicon Valley.
Deep Instinct AI Based Cybersecurity
The Advanced Persistent Threats (APT) are becoming a bigger problem for business and their transformation through adaptive code. These threats are becoming zero day attacks from the mutations, which are very difficult to defend and neutralize with existing technology. They require the emergence of the threat and the determination of a profile & signature before they can be addressed. These mutating malware programs typically only require 1% of the code base to change in order to require a new signature. The Deep Instinct system can address these with their deep learning code that scans files for heuristically good and bad code and data sets or structures.
The machine learning system that is being used is fast, typically sub 5ms to detect when used as an agent, which makes the solution applicable for real time applications. The solution is currently implemented as an appliance and as a cloud application. This method is significantly faster than other techniques such as sandboxing, in isolating this mutating code.
This methodology allows for the detection and abatement of active malware as well as the detection of structures that are embedded in standard business files such as .doc and .pdf files. The system has been used and tested on standard transactional and business data quite successfully. As the methodology is based on the content of files and data structures the solution works with any transport protocols and existing enterprise configurations. In the briefing, they did not have information on the use and performance of the solution on long run content data or media files.
