Fortinet black logo

New Features

AI-based malware detection

Copy Link
Copy Doc ID 4f6cd3c1-22cb-11eb-96b9-00505692583a:773410
Download PDF

AI-based malware detection

The AV Engine AI malware detection model integrates into regular AV scanning to help detect potentially malicious Windows Portable Executables (PEs) in order to mitigate zero-day attacks. Previously, this type of detection was handled by heuristics that analyzed file behavior. With AV Engine AI, the module is trained by FortiGuard AV against many malware samples to identify file features that make up the malware. The AV Engine AI package can be downloaded by FortiOS via FortiGuard on devices with an active AV subscription.

When upgrading from 6.4 to 7.0, the previous heuristic settings are not kept. In 7.0, the machine-learning-detection setting is enabled by default at a per-VDOM level:

config antivirus settings
    set machine-learning-detection {enable| monitor | disable}
end

Files detected by the AV Engine AI are identified with the W32/AI.Pallas.Suspicious virus signature.

To verify the AV Engine AI contract information:
# diagnose autoupdate versions

AV Engine
---------
Version: 6.00256
Contract Expiry Date: Wed Jan  1 2025
Last Updated using manual update on Tue Mar  9 15:29:31 2021
Last Update Attempt: Thu Mar 11 13:50:32 2021
Result: No Updates

Virus Definitions
---------
Version: 84.00635
Contract Expiry Date: Wed Jan  1 2025
Last Updated using scheduled update on Thu Mar 11 13:50:32 2021
Last Update Attempt: Thu Mar 11 13:50:32 2021
Result: Updates Installed

...

AI/Machine Learning Malware Detection Model
---------
Version: 2.00021
Contract Expiry Date: Wed Jan  1 2025
Last Updated using manual update on Wed Mar 10 10:21:25 2021
Last Update Attempt: Thu Mar 11 13:50:32 2021
Result: No Updates

...
# get system status
...
Firmware Signature: certified
Virus-DB: 84.00632(2021-03-11 10:16)
Extended DB: 84.00632(2021-03-11 10:16)
AV AI/ML Model: 2.00021(2021-03-08 13:56)
...
Sample log
date=2021-03-10 time=15:41:02 eventtime=1615419662027720720 tz="-0800" logid="0211008192" type="utm" subtype="virus" eventtype="infected" level="warning" vd="vdom1" policyid=1 msg="File is infected." action="blocked" service="HTTP" sessionid=18050 srcip=10.1.100.221 dstip=172.16.200.224 srcport=42092 dstport=80 srcintf="wan2" srcintfrole="wan" dstintf="wan1" dstintfrole="wan" proto=6 direction="incoming" filename="1132999808" quarskip="Quarantine-disabled" virus="W32/AI.Pallas.Suspicious" dtype="Virus" ref="http://www.fortinet.com/ve?vn=W32%2FAI.Pallas.Suspicious" virusid=8187637 url="http://172.16.200.224/avengine_ai/clean/1132999808" profile="av" agent="Wget/1.20.3" analyticscksum="01ca5e5d9ea1bb615bd0d8ae8e62f210e50b6339db25013ec367b34f5f2ff043" analyticssubmit="false" crscore=50 craction=2 crlevel="critical"

AI-based malware detection

The AV Engine AI malware detection model integrates into regular AV scanning to help detect potentially malicious Windows Portable Executables (PEs) in order to mitigate zero-day attacks. Previously, this type of detection was handled by heuristics that analyzed file behavior. With AV Engine AI, the module is trained by FortiGuard AV against many malware samples to identify file features that make up the malware. The AV Engine AI package can be downloaded by FortiOS via FortiGuard on devices with an active AV subscription.

When upgrading from 6.4 to 7.0, the previous heuristic settings are not kept. In 7.0, the machine-learning-detection setting is enabled by default at a per-VDOM level:

config antivirus settings
    set machine-learning-detection {enable| monitor | disable}
end

Files detected by the AV Engine AI are identified with the W32/AI.Pallas.Suspicious virus signature.

To verify the AV Engine AI contract information:
# diagnose autoupdate versions

AV Engine
---------
Version: 6.00256
Contract Expiry Date: Wed Jan  1 2025
Last Updated using manual update on Tue Mar  9 15:29:31 2021
Last Update Attempt: Thu Mar 11 13:50:32 2021
Result: No Updates

Virus Definitions
---------
Version: 84.00635
Contract Expiry Date: Wed Jan  1 2025
Last Updated using scheduled update on Thu Mar 11 13:50:32 2021
Last Update Attempt: Thu Mar 11 13:50:32 2021
Result: Updates Installed

...

AI/Machine Learning Malware Detection Model
---------
Version: 2.00021
Contract Expiry Date: Wed Jan  1 2025
Last Updated using manual update on Wed Mar 10 10:21:25 2021
Last Update Attempt: Thu Mar 11 13:50:32 2021
Result: No Updates

...
# get system status
...
Firmware Signature: certified
Virus-DB: 84.00632(2021-03-11 10:16)
Extended DB: 84.00632(2021-03-11 10:16)
AV AI/ML Model: 2.00021(2021-03-08 13:56)
...
Sample log
date=2021-03-10 time=15:41:02 eventtime=1615419662027720720 tz="-0800" logid="0211008192" type="utm" subtype="virus" eventtype="infected" level="warning" vd="vdom1" policyid=1 msg="File is infected." action="blocked" service="HTTP" sessionid=18050 srcip=10.1.100.221 dstip=172.16.200.224 srcport=42092 dstport=80 srcintf="wan2" srcintfrole="wan" dstintf="wan1" dstintfrole="wan" proto=6 direction="incoming" filename="1132999808" quarskip="Quarantine-disabled" virus="W32/AI.Pallas.Suspicious" dtype="Virus" ref="http://www.fortinet.com/ve?vn=W32%2FAI.Pallas.Suspicious" virusid=8187637 url="http://172.16.200.224/avengine_ai/clean/1132999808" profile="av" agent="Wget/1.20.3" analyticscksum="01ca5e5d9ea1bb615bd0d8ae8e62f210e50b6339db25013ec367b34f5f2ff043" analyticssubmit="false" crscore=50 craction=2 crlevel="critical"