FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Description This article describes AI-based malware detection introduced in 7.0 firmware version.
Solution The AV Engine AI malware detection model integrates into regular AV scanning to help detect potentially malicious Windows Portable Executables (PEs) in order to mitigate zero-day attacks. Previously, this type of detection was handled by heuristics that analyzed file behavior.
With AV Engine AI, the module is trained by FortiGuard AV against many malware samples to identify file features that make up the malware. The AV Engine AI package can be downloaded by FortiOS via FortiGuard on units with an active AV subscription.
When upgrading from 6.4 to 7.0, the previous heuristic settings are not kept. In 7.0, the machine-learning-detection setting is enabled by default at a per-VDOM level:
# config antivirus settings set machine-learning-detection {enable| monitor | disable} end
Files detected by the AV Engine AI are identified with the W32/AI.Pallas.Suspicious virus signature.
To verify the AV Engine AI contract information:
# diagnose autoupdate versions
AV Engine --------- Version: 6.00256 Contract Expiry Date: Wed Jan 1 2025 Last Updated using manual update on Tue Mar 9 15:29:31 2021 Last Update Attempt: Thu Mar 11 13:50:32 2021 Result: No Updates
Virus Definitions --------- Version: 84.00635 Contract Expiry Date: Wed Jan 1 2025 Last Updated using scheduled update on Thu Mar 11 13:50:32 2021 Last Update Attempt: Thu Mar 11 13:50:32 2021 Result: Updates Installed
...
AI/Machine Learning Malware Detection Model --------- Version: 2.00021 Contract Expiry Date: Wed Jan 1 2025 Last Updated using manual update on Wed Mar 10 10:21:25 2021 Last Update Attempt: Thu Mar 11 13:50:32 2021 Result: No Updates
... # get system status ... Firmware Signature: certified Virus-DB: 84.00632(2021-03-11 10:16) Extended DB: 84.00632(2021-03-11 10:16) AV AI/ML Model: 2.00021(2021-03-08 13:56) ...
