In an interview with ZDNet earlier this month, Tanmay Ganacharya, Director for Security Research of Microsoft Threat Protection, said that Microsoft now heavily relies on machine learning for detecting emerging threats, and this system uses a different machine learning modules that are being deployed on customer systems or Microsoft servers. However, this most likely doesn't matter, as the project could be used for small files only, with excellent results. 'For bigger size applications, STAMINA becomes less effective due to limitations in converting billions of pixels into JPEG images and then resizing them,' Microsoft said in a blog post last week. Microsoft said that while STAMINA was accurate and fast when working with smaller files, it faultered with larger ones. Deep learning is a subset of machine learning (ML), a branch of artificial intelligence (AI), which refers to intelligent computer networks that are capable of learning on their own from input data that is stored in an unstructured or unlabeled format - in this case, a random malware binary. STAMINA used a technique called deep learning. The research is part of Microsoft's recent efforts of improving malware detection using machine learning techniques. Microsoft's investment in machine learning 'The results certainly encourage the use of deep transfer learning for the purpose of malware classification,' said Jugal Parikh and Marc Marino, the two Microsoft researchers who participated in the research on behalf of the Microsoft Threat Protection Intelligence Team. The research team said STAMINA achieved an accuracy of 99.07% in identifying and classifying malware samples, with a false positives rate of 2.58%. Researchers used 60% of the known malware samples to train the original DNN algorithm, 20% of the files to validate the DNN, and the other 20% for the actual testing process. Microsoft says it provided a sample of 2.2 million infected PE (Portable Executable) file hashes to serve as a base for the research. The resized images were then fed into a pre-trained deep neural network (DNN) that scanned the image (2D representation of the malware strain) and classified it as clean or infected. The Intel and Microsoft team said that resizing the raw image did not 'negatively impact the classification result,' and this was a necessary step so that the computational resources won't have to work with images consisting of billions of pixels, which would most likely slow down processing. The height was dynamic, and resulted from dividing the raw pixel stream by the chosen width value.ДЄfter assembling the raw pixel stream into a normal-looking 2D image, researchers then resized the resulting photo to a smaller dimension. The width of the image was selected based on the input file's size, using the table below. Researchers then took this one-dimensional (1D) pixel stream and converted it into a 2D photo so that normal image analysis algorithms can analyze it. The first consisted of taking an input file and converting its binary form into a stream of raw pixel data. The Intel-Microsoft research team said the entire process followed a few simple steps. Microsoft and Intel have recently collaborated on a new research project that explored a new approach to detecting and classifying malware.Д¬alled STAMINA ( STAtic Malware-as- Image Network Analysis), the project relies on a new technique that converts malware samples into grayscale images and then scans the image for textural and structural patterns specific to malware samples. 10 dangerous app vulnerabilities to watch out for (free PDF).

Microsoft image tool