Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

vice.com

Post reply on HN
Print view View original

21–30 of 60 posts

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#21

Post by Barrin92 »

solveit wrote: post #10
sqldba wrote: post #7

The idea that some brogrammers can come along and bang out a disruptor in this area - which has a few decades of extremely complex learning, patents, and optimisation - just because they can cobble together some ML... It'd be sad if it wasn't so naive.

Many ML successes look exactly like that.

that's mostly because the bar is so unbelievably low that "it works 95% of the time" is good enough to please consumers. In security or anything that requires engineering rigor where catching the exception is exactly what matters ML is virtually useless, or even worse actively harmful.

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#23

Post by [deleted] »

Barrin92 wrote: post #21
solveit wrote: post #10

Earlier quoted context omitted.

Many ML successes look exactly like that.

that's mostly because the bar is so unbelievably low that "it works 95% of the time" is good enough to please consumers. In security or anything that requires engineering rigor where catching the exception is exactly what matters ML is virtually useless, or even worse actively harmful.

[deleted]

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#25

Post by jonathanstrange »

Hitton wrote: post #20

That's what you get when you hype Machine Learning as AI. But you can't really blame the "AI antivirus" much more than regular ones, they can be fooled similarly easily. Antivirus can't generally protect you against anything else than old malware, with new one you are always on your own. That said, making old malware undetectable again takes more effort against regular antiviruses.

Modern antivirus programs tend to have some heavy heuristic real-time virus detection, too. The problem is if you set the heuristic detection levels very high, then the number of false positives skyrockets.

In some environments the best solution is to use a whitelisting approach and there are several solutions for Windows on the market. Unfortunately, I don't know of any easy to use whitelisting solution for Linux.

My personal experience with one of these solutions on my gaming PC was that for normal end-users whitelisting is too much work for everyday use, and at the same time I was never really confident that the mechanisms the program used to block non-whitelisted software couldn't be fooled easily. Those mechanisms are proprietary and even seemingly reputable companies make claims on their web pages that look like snake-oil to me. If someone talks about "military grade protection", then you can count me skeptic. In the end, the success of such software mostly depends on whether the malware author tests against the particular vendor or not, so there is some high level of security by obscurity involved that might actually help against most attacks, especially if you're using some obscure vendor as I did. Probably not worth the effort for everyday use, though.

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#26

Post by jonathanstrange »

eps wrote: post #17

And to "trick" it into thinking something is malware when it's not you just need to pack it with UPX.

It's a shame. People have even stopped using certain niche programming languages because their non-standard compilers create executables that are often flagged by antivirus software.

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#28

Post by xorcist »

Heuristics based antivirus has been around since the 90s. Vendors have pushed it significantly more during the past five years or so. Supposedly, it has become much better. The promise has always been to detect future malware.

However there has always been a fundamental problem with them. Malware authors have access to them too. They won't release anything that's detected by the tools they care about. Heuristics gets improved, but the end user ends up with a patch cycle anyway.

That doesn't mean they are useless, just oversold. Machine learning antivirus sounds like more of the same.

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#29

Post by skocznymroczny »

xorcist wrote: post #28

Heuristics based antivirus has been around since the 90s. Vendors have pushed it significantly more during the past five years or so. Supposedly, it has become much better. The promise has always been to detect future malware. However there has always been a fundamental problem with them. Malware authors have access to them too. They won't release anything that's detected by the tools they care about. Heuristics gets…

Skynet was also deployed as an AI antivirus...

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#30

Post by jointpdf »

Barrin92 wrote: post #21
solveit wrote: post #10

Earlier quoted context omitted.

Many ML successes look exactly like that.

that's mostly because the bar is so unbelievably low that "it works 95% of the time" is good enough to please consumers. In security or anything that requires engineering rigor where catching the exception is exactly what matters ML is virtually useless, or even worse actively harmful.

That’s not true, there’s an entire subfield of stats/ML dedicated to anomaly detection.
Post reply on HN