AI-based malware detection
The AV Engine AI malware detection model integrates into regular AV scanning to help detect potentially malicious Windows Portable Executables (PEs) in order to mitigate zero-day attacks. Previously, this type of detection was handled by heuristics that analyzed file behavior. With AV Engine AI, the module is trained by FortiGuard AV against many malware samples to identify file features that make up the malware. The AV Engine AI package can be downloaded by FortiOS via FortiGuard on devices with an active AV subscription.
When upgrading from 6.4 to 7.0, the previous heuristic settings are not kept. In 7.0, the machine-learning-detection setting is enabled by default at a per-VDOM level:
config antivirus settings
set machine-learning-detection {enable| monitor | disable}
end
Files detected by the AV Engine AI are identified with the W32/AI.Pallas.Suspicious virus signature.
To verify the AV Engine AI contract information:
# diagnose autoupdate versions AV Engine --------- Version: 6.00256 Contract Expiry Date: Wed Jan 1 2025 Last Updated using manual update on Tue Mar 9 15:29:31 2021 Last Update Attempt: Thu Mar 11 13:50:32 2021 Result: No Updates Virus Definitions --------- Version: 84.00635 Contract Expiry Date: Wed Jan 1 2025 Last Updated using scheduled update on Thu Mar 11 13:50:32 2021 Last Update Attempt: Thu Mar 11 13:50:32 2021 Result: Updates Installed ... AI/Machine Learning Malware Detection Model --------- Version: 2.00021 Contract Expiry Date: Wed Jan 1 2025 Last Updated using manual update on Wed Mar 10 10:21:25 2021 Last Update Attempt: Thu Mar 11 13:50:32 2021 Result: No Updates ...
# get system status ... Firmware Signature: certified Virus-DB: 84.00632(2021-03-11 10:16) Extended DB: 84.00632(2021-03-11 10:16) AV AI/ML Model: 2.00021(2021-03-08 13:56) ...
Sample log
date=2021-03-10 time=15:41:02 eventtime=1615419662027720720 tz="-0800" logid="0211008192" type="utm" subtype="virus" eventtype="infected" level="warning" vd="vdom1" policyid=1 msg="File is infected." action="blocked" service="HTTP" sessionid=18050 srcip=10.1.100.221 dstip=172.16.200.224 srcport=42092 dstport=80 srcintf="wan2" srcintfrole="wan" dstintf="wan1" dstintfrole="wan" proto=6 direction="incoming" filename="1132999808" quarskip="Quarantine-disabled" virus="W32/AI.Pallas.Suspicious" dtype="Virus" ref="http://www.fortinet.com/ve?vn=W32%2FAI.Pallas.Suspicious" virusid=8187637 url="http://172.16.200.224/avengine_ai/clean/1132999808" profile="av" agent="Wget/1.20.3" analyticscksum="01ca5e5d9ea1bb615bd0d8ae8e62f210e50b6339db25013ec367b34f5f2ff043" analyticssubmit="false" crscore=50 craction=2 crlevel="critical"