AI-based Endpoint Defender (ABED)

Existing endpoint defense solutions often rely on file signature blacklists and patterns derived from static analysis. These techniques, while proficient at mitigating the specific threats they are designed to detect, offer little protection against modern file and document formats that allow for the embedding of arbitrary data.AIS proposes ABED to detect and prevent malware and exploits in less than five minutes by extending upon proven Machine Learning enabled exploit and malware detection techniques previously developed by AIS under Air Force contract TAFFI (FA8750-15-C-0017). By leveraging existing research, ABED will have out-of-the-box capability to detect threats embedded in various common file types that can be used as a foundation for endpoint defense.ABED research will focus both on improving the pre-existing TAFFI detector, and on using it to build an enterprise ready endpoint defense solution. We will develop a self-learning and continuous training capability for the detector, allowing it to quickly learn how to detect malware and exploits in new file formats. This self-learning detector will serve as the foundation of our approach, and around it we will design an endpoint defender that can use scalable enterprise computing resources when available but which can still defend endpoints in their absence.