Artificial Intelligence-based Endpoint Defender Phase II (ABED Phase II)

Existing endpoint defense solutions often rely on file signature blacklists and patterns derived from static analysis. These techniques, while proficient at mitigating the specific threats they are designed to detect, offer little protection against modern file and document formats that allow for the embedding of arbitrary data. AIS has developed ABED to detect and prevent malware and exploits by extending upon proven Machine Learning enabled exploit and malware detection techniques previously developed by AIS under Air Force contract TAFFI (FA8750-15-C-0017). ABED, when completed, will serve as an out-of-the-box capability to detect threats embedded in various common file types that can be used as a foundation for endpoint defense. ABED Phase I research has focused both on improving the pre-existing TAFFI detector, and on using it to build an enterprise ready endpoint defense solution. We have developed a self-learning and continuous training capability for the detector, allowing it to quickly learn how to detect malware and exploits in new file formats. Phase II will focus on maturing this capability into a scalable, enterprise ready endpoint defender.