Protecting identity ranks high on most CISOs’ priority lists yet tried-and-true malware attacks continue to be a go-to vector for those looking to ransom or exfiltrate data and take over accounts. That’s not because email and security providers take malware detection lightly — some have infrastructures that scan billions of files every day — it’s because malware attacks and evasion techniques keep getting smarter and faster.
AI will catapult this risk to new heights. Malware represents a greater threat than ever, and conventional detection pipelines simply aren’t built to keep up.
Scale is just the beginning
Though perceived as somewhat of a commodity (in other words ‘boring’), malware detection plays a vital role in protecting email communications, file transfers, and other critical communications.
In this article, we’ll take a quick look at how the rise and evolution of AI that can generate or modify malware on the fly turns some accepted principles of today’s load-bearing anti-malware defenses inside-out.
Detection experts at Varist predict the inversion of these three assumptions will drive organizations to modernize their detection pipelines within the next 18 months.
Inversion #1: Scanning every file will become ‘table stakes’
We’d like to think that our email and security service providers scan every file as it enters their environment, before it gets delivered to their customers’ inboxes. This doesn’t happen. Even the fastest conventional scanners struggle to keep pace with the eternal rise in traffic volumes, and AI-led communications will only make matters worse.
What changes with AI
Conventional malware detection will fall quickly and hopelessly farther behind, making file transfer security even more of a moving target than it has been up ‘til now. AI-enabled malware will widen the detection gap with zero-dwell-time attacks overwhelming and outpacing signature-based defenses. Not just because matching threats to signatures in known threat databases takes too long, but because looking only for known threats misses the whole point of AI.
Inversion #2: Signature-sharing will make us slower not faster
Maintaining threat databases and documenting new variants and IOCs still makes sense from a “strength in numbers” perspective, but much of what we do today is hash- and IOC-centric. Someone verifies the risk associated with a signature, hash, or IOC, and adds it to public repositories.
What changes with AI
With AI-generated polymorphism, the shared-signature model stops being a force multiplier and becomes more of a treadmill. Defenders run faster and faster, doing what they’ve always done and getting the same results they’ve always gotten, but much too slowly.
In one well-known example, using AI accelerated the process of creating 88,000 lines of functional malware code from what once was deemed a 30-week effort down to just one week.i AI-generated malware can also exist in many variants at the same time, and use complex evasive capabilities instantaneously.
Under the best of circumstances, leaving it to analysts to look at hashes one at a time burns too many analyst cycles.
Collaboration still matters
All this is not to say that we should stop sharing behaviors, intent patterns, infrastructure tells, and other red flags, but we must build on that foundation of sharing insights on known threats to improve detection of unknown threats.
Inversion #3: Validating new threats in a sandbox doesn’t scale
After flagging unusual behavior, defenders’ go-to step has been to move the investigation to the sandbox and detonate a file or suspicious-looking elements turned up during the initial scan to see what it does.
The premise is: Detonation shows the real risks. This assumption also must change. Sandboxing elements the static stack couldn’t decide worked well in the past because the adversary tempo allowed it to.
What changes with AI
As the volume of threats to be detonated grows — and the static stack begins missing the majority of the new variants instead of just a few — behavior-focused tools like the sandbox become more and more outdated. The sandboxing window to detonate a file averages 7-10 minutes. That’s way too slow to handle the growth as AI generates new variants in seconds.
The pipeline capacity needed to sandbox inline (before delivery) becomes physically impossible to sustain as the latency created by asynchronous processing pushes the sandboxing process well beyond its scalability limits, and economic feasibility. Evasion tips the scales even more as, the smarter malware gets, the more likely it is to detect when it’s been detected or is operating inside a sandbox.
Defenders’ catch rate at the edge plummets as sandboxes grapple with volumes they aren’t designed to handle inline. Predictive (dynamic) analysis must do what static sandboxes used to do but without detonating files, and the industry hasn’t built the muscle for it.
The Takeaways for AI-scale Malware Detection
Here’s what needs to change from a practical standpoint
- Every file must be scanned in real time
- Detection must evolve beyond signatures to find unknown threats—also in real time
- Defenders need greater ability to predict the likelihood of a file exhibiting malicious behaviors
Tools like Varist’s Hybrid Detection Engine™ (HDE) automatically simulate threats lurking within the files based on very granular behavioral indicators. Analysis concludes within seconds and culminates in the assignment of a well-explained maliciousness or probability rating that shows the likelihood of the file containing malware.
Scanning a file to see if it’s dangerous takes just a few seconds. Holding our own against AI-scale malware takes a village.
The analyst/automation balance must shift
Defenders and threat actors both expect AI to play a greater role in detecting and understanding new threats in real time. That’s essential because, while requiring human intervention helps some analysts retain control, failing to automate validation and response becomes exponentially more dangerous, particularly when it comes to detecting never-before-seen threats.
The race to AI is on and only time will tell who wins. One thing is sure: its role in launching and scaling attacks will continue to grow, and defenses will need to pre-act, right now, to maintain a technological advantage.
