Microsoft unveiled a new autonomous artificial intelligence (AI) agent aimed at enhancing malware detection efforts by analyzing and classifying software without human intervention. Codenamed Project Ire, this large language model (LLM)-powered system automates the gold standard in malware classification, fully reverse engineering software files to determine if they are malicious or benign. The goal is to enable malware classification at scale, speed up threat response, and reduce manual efforts required by analysts to examine samples.
Project Ire utilizes specialized tools to reverse engineer software, analyzing it at different levels including low-level binary analysis, control flow reconstruction, and high-level interpretation of code behavior. The system’s tool-use API allows it to update its understanding of a file using various reverse engineering tools, such as Microsoft’s memory analysis sandboxes from Project Freta, custom and open-source tools, and multiple decompilers. Project Freta focuses on discovering undetected malware in memory snapshots of live Linux systems during memory audits.
The evaluation process of Project Ire involves automated reverse engineering tools identifying file types, structures, and potential areas of interest. The system then reconstructs the software’s control flow graph, invokes specialized tools to identify key functions, and uses a validator tool to verify its findings against evidence to classify the artifact. A detailed “chain of evidence” log is created to show how the system reached its conclusion, allowing security teams to review and refine the process if needed.
Tests on a dataset of publicly accessible Windows drivers showed that the Project Ire classifier correctly flagged 90% of all files and misidentified only 2% of benign files as threats. In a second evaluation of nearly 4,000 “hard-target” files, the system identified almost 9 out of 10 malicious files correctly with a false positive rate of only 4%. Microsoft plans to leverage the Project Ire prototype within its Defender organization for threat detection and software classification, aiming to scale the system’s speed and accuracy to classify files from any source, even on first encounter.
In addition to this development, Microsoft reported awarding a record $17 million in bounty awards to 344 security researchers from 59 countries in 2024 through its vulnerability reporting program. A total of 1,469 eligible vulnerability reports were submitted, with the highest individual bounty reaching $200,000. This initiative reflects Microsoft’s ongoing commitment to cybersecurity and collaboration with the global security research community.
Source link