hnologies to provide the best outcome by working together.”
Tracing McAfee’s progress based on its investment in AI, Grobman said the journey started with machine learning on the endpoint in 2016 with Real Protect Static, which uses ML to look at what something is to determine whether it is malicious.
This was followed later that year by Real Protect Dynamic, which looked at looked at application behaviour to determine if it was malicious.
“But what we found in 2018 is that world-class malware detection alone is not enough because so many threats no longer look anything like traditional malware,” said Grobman.
“A new class of threat that the industry is calling ‘fileless malware’ covers a wide range of different scenarios, but essentially uses scripting that can be launched from many different places [such as legitimate tools] like PowerShell.”
In response, Grobman announced McAfee’s third variant of McAfee’s endpoint machine learning technology called Real Protect Fileless.
“We’ve essentially partnered with the [Microsoft] Windows 10 architecture – something called the anti-malware scan interface so that whenever Windows is about to run a script, Windows will call Real Protect Fileless to make an assessment if the script is malicious or not,” he said.
In practice, Grobman said this means that scripts will be assessed regardless of where they are run from and they will be blocked if they are malicious.
“We used ML in this case because we need to be flexible enough to detect malicious things beyond what can be detected with signatures alone,” he said.
To demonstrate the value of this, Grobman showed that while Windows 10 Defender was able to detect a standard version of the Mimikatz PowerShell script used to steal credentials, it was not able to detect an obfuscated version of the script because it is signature-based, while Real Protect Fileless was able to detect both versions of Mimikatz.
Grobman also used his keynote to demonstrate the power of using advanced analytics and telemetry data to produce actionable insights, which McAfee CEO Chris Young has identified as a strategic direction of product development for the company.
“McAfee has an amazing quantity of threat telemetry collected from about a billion sensors across consumer and enterprise installations around the world that see a wide range of technical indicators in networks, web gateways, endpoints and cloud-based operations,” he said.
To make use of all these telemetry, Grobman said McAfee has “built a pipeline” that is able to ingest this data, redact it where required and prepare it to be analysed.
“In five minutes alone, we get 116 million pieces of telemetry that sets the foundation for being able to look at information that ultimately will be able to transform into a capability that will give organisations a different type of visibility into their environment.”
In the same way that the US national hurricane centre is able to translate storm telemetry into a projected path and impact of a hurricane, Grobman said McAfee is working to transform cyber security telemetry to provide insights on which organisations can base a plan of action.
“We want to ensure we are able to provide new ways of thinking about the world and what is happening in organisations and how they intersect. We essentially want to take the raw data out of those billion sensors, combine it with organisation-specific data and transform it using world class analytics capability into information that is actionable,” he said.
To support McAfee’s efforts to deliver insights, Grobman said the company is running a research project to develop a real-time system that provides a global view every second of every day of the threats that are occurring around the world.
“There are so many scenarios that we will be able to look at and then identify which customers will be potentially affected and give them an early warning of what is coming so they can take defensive actions before the proverbial storm hits,” he said.
“We recognise that nation states and cyber criminals continue to up their game, and so