Blog post

Deep Instinct - Malware detection using deep learning

During the Deep Learning Summit in London, we saw a lot of very interesting and technically strong talks.

One of these speakers has stayed with me to this day. Dr. Eli David' s talk was very instructive. I have rarely seen such a good speaker. Dr. Eli David is a leading expert in the field of computational intelligence and is a true deep learning specialist. He has already published more than 40 papers, mainly focusing on the field of genetic algorithms and deep learning. He also teaches on these topics and supports graduate student research in these fields. In addition, he has won several awards and is co-founder of Deep Instinct, a company that applies deep learning to cyber security.

Deep instinct logoDeep Instinct is a company that offers a customized solution to companies that want to secure themselves against malware that can enter through several channels. We all remember the WannaCry virus that has caused huge problems. The costs involved can quickly reach hundreds of millions of dollars. 

Most security companies have a very difficult time dealing with new malware. But new malware typically does not differ fiercely from older ones, and it is often subtle modifications that cause big problems. If we think about facial recognition, for example, we know that it continues to work pretty well even if there are minor changes such as growing a beard and the like.

So in principle, you could argue that if they could find a way to give their data as input to a deep learning neural network, the problem should be fairly easy to solve.

jgpeuoavmn7pwbh98ycsAll they need to make this work is large amounts of training data, GPUs, deep learning expertise and a deep learning framework. However, they have one very important additional constraint. If they want to offer security, it must work on any device: ranging from fixed computers to laptops, tablets and even smartphones. Existing frameworks are mostly made for research, to work in the cloud and require quite a lot of processor and memory capacity. To make matters worse, these frameworks do not allow the modification of some pieces (called building blocks), to modify the algorithms and this is crucial for cyber security.

So the challenges are as follows: they cannot use convolutional neural networks. They can' t use fully connected networks, and the inputs can vary in format and size.

So Deep Instinct has been rewriting the big pieces so that it takes binary files as input and can deal with input of different sizes and other formats. The bottom line is basically that they had to rewrite the whole deep learning framework from scratch, entirely in C and Cuda.

The results are pleasing. Although it is difficult for them to put a number on it, they do make the case that they are doing better than their competitors. Currently, they can even figure out which country the attack comes from with an accuracy of about 94.6 percent.