Nearly everyone owns an endpoint. We generally call them smartphones or personal computers, but they can also be smart watches or smart TVs. In short, anything you own that can connect to the internet is a potential endpoint. However, they only reach the status of an endpoint when they become part of a network. Endpoint protection, then, refers to securing phones, computers, and smart devices that are connected to enterprise networks. The cybersecurity architecture that the enterprise deploys to detect and respond to cyberattacks at these endpoints is called EDR, which is short for ‘Endpoint Detection and Response’.
As you may expect, most of these cyber defense systems are based on the detection of known threats. This means that, in order to be effective, these systems have to be frequently updated to detect the source code for new malware. Unfortunately, once detected, malware designers will change their code to bypass such protection in an ongoing spiral of attack and defend.
The biggest problem for such traditional systems is a zero-day attack. These are attacks that have not been previously seen so they cannot be stopped based on malware code databases. There are novel endpoint protection architectures that can avoid zero-day attacks. Inzero’s hardware separation approach, for example, factors in irresponsible user behavior and zero-day exploits by, in effect, making one phone into two phones at the hardware level. Such an architecture produces a barrier that blocks malware from a network. Other endpoint protection is behavior-based. Algorithms try to identify an attack by analyzing unusual behavior at endpoints on its network. Some systems use an AI approach to accomplish much the same results. Both the algorithm-based and AI systems attempt to identify unusual behavior at an endpoint and take some action in response to it. The response component of EDR is important because decisions on what action to take, if any, must be made quickly before the malware is deployed. Misidentifying malicious behavior in a network can lead to additional problems. Benign processes can be shut down, for example. Shutting down one process may stimulate a cascading effect across a network and, in the end, cause more problems than the malware would have.
A recent research paper explored solutions to the AI malware identification dilemma. The researchers used the basic AI formula known as Q-learning, which is diagrammed below.
Simply put, the neural network takes an action on a suspicious process, looks at the result, and determines if the result was beneficial to the network. If the action was considered as beneficial, it reinforces this action, if not, it does not perform the action again. In short, the neural network will then upgrade itself based on the observed outcome of its actions. Over time, a viable AI system will develop that can identify previously unseen attacks, or, at least that’s the hope. Good AI architecture, then, can predict the outcome of its actions even before it performs them; even if it has never performed these actions before.
There are a number of problems that must be overcome for AI protection to work well. In order to understand the operation of a particular malware strain, it is beneficial for the AI to let it run. However, doing so could result in damage to the network. Another problem is that some malware uses benign processes to operate. For example, some forms of malware will incorporate the operation of Microsoft Word. Blocking the use of Word across the network would be counter productive, so relationships between the malware and the benign processes it incorporates must be understood holistically. Not only that, the system must block the progress of the malware before any benign processes are called up. In other words, good AI detection must work as quickly as possible.
The researchers were especially interested in how quickly AI could detect and stop a ransomware attack. Their experiments found that 82% of such malware could be detected and, during the interval between detection and killing, only 8% of the files were encrypted or lost. The researchers, however, do not find this good enough to deploy AI as a network protection tool, although they believe they are on the right track. It seems the main problem that still exists is response time, and this is measured at a magnitude of far less than a second. Response time is also dependent on the number of processes the malware uses. This can be seen on the following chart, with the black line delineating the total time used in detection.
In some cases, even a 0.1 second time lag before a response may be enough time for the malware to destroy the endpoint, even though most of the network can be saved. In other cases, the AI system may be overly sensitive and quickly shut down any processes it believes may be related to the incoming malware. DDoS attackers could use this sensitivity to launch attacks that bring down entire networks.
AI endpoint protection may prove to have some benefits that other types of endpoint protection do not. More sophisticated malware has the ability to detect if it is being directed to a VM for analysis. AI systems don’t depend on the use of VMs. So, even though the researchers don’t feel these newer AI systems are good enough for the moment, because of such positive attributes, AI may be used in conjunction with other endpoint protection systems to improve cyberattack defense architecture.
The Holy Grail of AI endpoint protection would be to automatically stop all attacks before they can begin to deploy. This would need to be done without human intervention, because human intervention would slow down response time. For the moment, this goal is far off. To the lay person, stopping 92% of attacks sounds quite good, however, this means some attacks are still getting through and, after all, it only takes one good attack to bring down a network or subject an enterprise to extortion by ransomware groups. In addition, having only 8% of a network’s files encrypted in such an attack sounds good, until you learn that hackers have taken the most valuable files first or encrypted files that make the network inoperable.
That said, incorporating the use of AI may open the door to hybrid EDR systems which could detect and destroy more malware than can currently be neutralized. Unfortunately, these approaches to endpoint protection, no matter how modernized they may be, will never block all malware attacks on endpoints. They, in effect, are traditional approaches to the problem. This sad fact alone could focus attention on systems which don’t rely on traditional EDR. Of course, moving from these more traditional approaches to endpoint protection to more creative solutions would be a huge paradigm shift. The benefit of such a shift would be to place malware designers on the back foot. Simply rewriting malware source code to bypass protection would not work. AI-based protection may have its place, but only time will tell if its benefits will outweigh the problems it creates.