Same content, different shell – a trick that has enabled the cybercrime industry to develop massively in recent years. Hackers camouflage their malware with so-called packers and other obfuscation techniques. Once detected by the antivirus program, they simply repackage the same malware and use it for the next attack. This is a profitable way to spread the malicious code further.
With a world first in the field of machine learning, G DATA is destroying the crooks’ business. The new DeepRay technology immediately unmasks camouflaged malware. This means that hackers can’t simply change the camouflage of a malware to trick antivirus software for a new attack anymore. Now, they have to rewrite the malware themselves – a much taller order.
G DATA uses a neural network consisting of several perceptrons. This network works with an algorithm that is continuously trained through adaptive learning and the know-how of our analysts. It categorizes executable files of various types using a variety of indicators, including the ratio of file size to executable code, the compiler version used, and the number of system functions imported.
If DeepRay decides that a file is suspicious, a depth analysis is performed in the RAM of the associated process. This involves identifying patterns that can be assigned to the core of known malware families or generally malicious behavior. Thanks to DeepRay, G DATA security solutions can detect camouflaged malicious files much earlier than ordinary technologies, so they can prevent malware damage at an early stage.
With DeepRay we are changing the rules of the game and are depriving cybercriminals of their economic basis. Thanks to this new technology, we can look behind the camouflage of the malware and effectively fend off fast-moving malware campaigns. This will significantly improve protection for our customers.
