Microsoft introduces Project Ire — AI that independently classifies malware
Microsoft has launched an autonomous AI agent that can independently analyze and classify software to detect malware.
Microsoft has launched an autonomous AI agent that can independently analyze and classify software to detect malware.
The autonomous malware classification system based on LLM, which is currently a prototype, has been codenamed Project Ire, The Hacker News reports .
“The system automates a process that is considered the ‘gold standard’ in malware classification: the complete reverse engineering of a software file without any clues as to its origin or purpose,” Microsoft said. “It uses decompilers and other tools, examines their output, and determines whether the software is malicious or safe.”
Project Ire will help classify malware in large volumes, respond to threats faster, and minimize manual work for analysts, who will no longer have to manually examine samples to determine whether they are dangerous.
In particular, the system uses specialized tools for reverse engineering software, conducting analysis at different levels: from low-level binary analysis and control flow reconstruction to high-level interpretation of code behavior.
"The tooling API allows the system to continuously obtain new data about a file using various reverse engineering tools," Microsoft explains. "These can include Microsoft's memory analysis sandboxes (based on Project Freta), custom and open tools, as well as documentation searches and various decompilers."
The Project Ire team tested the classifier on publicly available Windows drivers. The system correctly identified 90% of all files and only 2% of times falsely labeled safe files as threats. In a second test, which included nearly 4,000 “hard targets,” the system correctly identified nearly 9 out of 10 such files as malicious, with a false positive rate of just 4%.
"We aim to increase the speed and accuracy of the system so that it can correctly classify files, regardless of their origin, even on first contact. In the future, we want to train it to detect new viruses directly in memory, and do so on a large scale."
Microsoft surpasses $4 trillion in market capitalization: company is growing rapidly amid AI boom
Microsoft surpasses $4 trillion in market capitalization: company is growing rapidly amid AI boom
Microsoft blocked the email of a LibreOffice developer who criticized the company: failed to appeal
Microsoft blocked the email of a LibreOffice developer who criticized the company: failed to appeal
Microsoft admits it cannot guarantee digital data sovereignty in the EU
Microsoft admits it cannot guarantee digital data sovereignty in the EU
Read the country's main IT news in our Telegram
Read the country's main IT news in our Telegram
