Dubai, UAE, December 21, 2020 – Sophos, a global leader in next-generation cybersecurity, today announced four new open Artificial Intelligence (AI) developments to help broaden and sharpen the industry’s defences against cyberattacks, including datasets, tools and methodologies designed to advance industry collaboration and innovation. This move accelerates a key Sophos objective to open its data science breakthroughs and make the use of AI in cybersecurity more transparent, all with the aim of better protecting organisations against cybercrime.
“With SophosAI’s new initiative to open its research, we can help influence how AI is positioned and discussed in cybersecurity moving forward. Today’s cacophony of opaque or guarded claims about the capabilities of AI in solutions makes it difficult for buyers to understand these claims. This leads to buyer skepticism, creating headwinds to future progress at the very moment we’re starting to see great breakthroughs,” said Joe Levy, chief technology officer, Sophos. “Correcting this requires self-policing within our community to produce a set of practices that will advance the industry in an open and transparent manner”.
It is difficult to overstate the criticality of this shift given the immense potential of how AI can benefit cybersecurity. Sophos evidence shows that defenders are increasingly facing human adversaries who are constantly upping their game, launching highly contextualised forgery campaigns or relentlessly developing new ransomware attacks. Scalable and effective defences against these and most other types of cyberattacks require assistance from AI.
Sophos is providing datasets, tools and methodologies in four important areas:
SOREL-20M Dataset for Accelerating Malware Detection
SOREL-20M, a joint project between SophosAI and ReversingLabs, is a production-scale dataset containing metadata, labels and features for 20 million Windows Portable Executable files. It includes 10 million disarmed malware samples available for download for the purpose of research on feature extraction to accelerate industry-wide improvements in security.
AI-powered Impersonation Protection Method
SophosAI’s Impersonation Protection is designed to protect against email spearphishing attacks, where influential people are impersonated to trick recipients into taking some harmful action for the benefit of the attacker. This new protection compares the display name of inbound emails against high level executive titles that are unique to specific organisations and flags these messages when they appear suspicious. Sophos has trained the AI on a large sample set of millions of known attack emails.
Digital Epidemiology to Determine Undetected Malware
SophosAI has also built a set of epidemiology-inspired statistical models for estimating the prevalence of malware infections in total, which enables Sophos to estimate the needles in a PE file haystack. SophosAI has made publicly available this method that helps to determine malicious “dark matter,” malware that might be missed and “future malware” that is in development by attackers.
YaraML Automatic Signature Generation Tools
SophosAI has developed a new method for automatic signature generation, called YaraML. SophosAI “compiles” industrial strength machine learning models into signature languages, essentially allowing AI to “write” the signatures. This represents a breakthrough for the security community.
These four advancements are the latest from SophosAI, which works creatively like a start-up incubator, but with the intellectual resources of a near billion-dollar global company, including SophosLabs, Sophos Managed Threat Response and hundreds of thousands of customers.
