FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
vhitnal
Staff
Staff
Description
This article describes AI-based malware detection introduced in 7.0 firmware version.

Solution
The AV Engine AI malware detection model integrates into regular AV scanning to help detect potentially malicious Windows Portable Executables (PEs) in order to mitigate zero-day attacks.
Previously, this type of detection was handled by heuristics that analyzed file behavior.

With AV Engine AI, the module is trained by FortiGuard AV against many malware samples to identify file features that make up the malware.
The AV Engine AI package can be downloaded by FortiOS via FortiGuard on units with an active AV subscription.

When upgrading from 6.4 to 7.0, the previous heuristic settings are not kept. In 7.0, the machine-learning-detection setting is enabled by default at a per-VDOM level:
# config antivirus settings
    set machine-learning-detection {enable| monitor | disable}
end
Files detected by the AV Engine AI are identified with the W32/AI.Pallas.Suspicious virus signature.

To verify the AV Engine AI contract information:
# diagnose autoupdate versions

AV Engine
---------
Version: 6.00256
Contract Expiry Date: Wed Jan  1 2025
Last Updated using manual update on Tue Mar  9 15:29:31 2021
Last Update Attempt: Thu Mar 11 13:50:32 2021
Result: No Updates

Virus Definitions
---------
Version: 84.00635
Contract Expiry Date: Wed Jan  1 2025
Last Updated using scheduled update on Thu Mar 11 13:50:32 2021
Last Update Attempt: Thu Mar 11 13:50:32 2021
Result: Updates Installed

...

AI/Machine Learning Malware Detection Model
---------
Version: 2.00021
Contract Expiry Date: Wed Jan  1 2025
Last Updated using manual update on Wed Mar 10 10:21:25 2021
Last Update Attempt: Thu Mar 11 13:50:32 2021
Result: No Updates


...
# get system status
...
Firmware Signature: certified
Virus-DB: 84.00632(2021-03-11 10:16)
Extended DB: 84.00632(2021-03-11 10:16)
AV AI/ML Model: 2.00021(2021-03-08 13:56)
...

Sample log
date=2021-03-10 time=15:41:02 eventtime=1615419662027720720 tz="-0800" logid="0211008192" type="utm" subtype="virus" eventtype="infected" level="warning" vd="vdom1" policyid=1 msg="File is infected." action="blocked" service="HTTP" sessionid=18050 srcip=10.1.100.221 dstip=172.16.200.224 srcport=42092 dstport=80 srcintf="wan2" srcintfrole="wan" dstintf="wan1" dstintfrole="wan" proto=6 direction="incoming" filename="1132999808" quarskip="Quarantine-disabled" virus="W32/AI.Pallas.Suspicious" dtype="Virus" ref="http://www.fortinet.com/ve?vn=W32%2FAI.Pallas.Suspicious" virusid=8187637 url="http://172.16.200.224/avengine_ai/clean/1132999808" profile="av" agent="Wget/1.20.3" analyticscksum="01ca5e5d9ea1bb615bd0d8ae8e62f210e50b6339db25013ec367b34f5f2ff043" analyticssubmit="false" crscore=50 craction=2 crlevel="critical"

Contributors