Microsoft Defender will protect against ransomware with artificial intelligence
Human-controlled ransomware is characterized by a specific set of methods and behavioral markers, so Microsoft decided to use the power of artificial intelligence to detect this type of attack. Typically, an attack starts with the introduction of a file that provides remote access to the victim's computer. However, not all files used in attacks are known in advance to be malicious - some of them are not malicious at all. Therefore, the tokens generated by these files can be considered low priority and ignored by antivirus software. Additional adaptive protection based on artificial intelligence, capable of detecting unusual behavior of standard programs, can play a decisive role. Unlike traditional cloud-based protections, which are manually configured, the new system is adaptive - it can automatically raise or lower the aggressive nature of blocking decisions delivered via the cloud based on real-time data and predictions from a machine learning platform. Even if the algorithm fails to estimate the real value of the threat and the attacker achieves his own, the system will still be an obstacle to attack: when the machine has already been hacked, the system can switch to the most aggressive mode and block the malware payload, preventing the encryption of important data and files.