Microsoft Details Anti-Malware Cloud-Based System

Microsoft says it used artificial intelligence to not only spot and identify and attempted malware attack, but to block it more than a thousand times in the next half hour. It says the defense was possible thanks to Windows Defender being used locally on the victim's computer, as well analyzing the snippet of code using cloud-based antimalware.

The company calls it an example of machine learning. This means computers are able to figure things out for themselves, rather than simply following 'true or false' routines that are part of a program. Similar to antivirus, the most basic level of anti-malware protection simply scans a computer looking for files that are already known to be malware. However, more sophisticated defenses such as the 'machine learning' approach provide the ability to decipher characteristics of potentially malicious software.

Decision Tree Shows Risk

The first line of defense came on the computer belonging to a Windows 7 user in North Carolina. Windows Defender spotted something was amiss by looking at the code in an unfamiliar file and, before it could be opened, simulating what would happen if the file was executed. (Source: thewindowsclub.com)

The next step was running a decision tree. This meant looking at various characteristics of the file and giving each a probability rating for how likely it was to mean the file was malicious. Windows Defender then crunched the numbers on various combinations of these individual probability ratings to give an overall rating.

Online Analysis Far Quicker

Once Windows Defender decided that the overall chances were that the file was malware, the online ("cloud") element kicked in. Microsoft's cloud computers then carried out assessments that were similar in principle to Windows Defender on the PC, but with the ability to crunch data far more quickly and drawing on a bigger database of previous confirmed malware.

According to Microsoft, it was took less than a minute from Windows Defender first spotting the file to reporting it to the Microsoft computers as a potential risk. The online analysis then took a matter of seconds before sending out a message to Windows PCs worldwide that the file should be considered compromised. That meant computers could block the file without needing to analyze it locally. (Source: microsoft.com)

What's Your Opinion?

Are you impressed by the way the security tools worked in this case? Do you rely on Windows built-in security or do you use third-party tools? What improvements would you like to see to the security tools you use?