Mastermind of Defense: Join the latest Q&A session with our Director of Threat Research

Hi & thanks for this question, @Nunzio77.

This is a tough one - and i'd like to offer some context to the other readers before I get to answer your question: We're already seeing AI hard at work for scamming people out of their money and the situation looks even more dire for the year to come. The commoditization of LLMs will make it much easier for cyber-criminals to run  automated scamming toolkits able to target hundreds or thousands of consumers in multiple languages simultaneously. The rise of artificial Intelligence (AI) and LLM has drastically lowered the barrier of entry for cybercriminals who speak English as a second language and in the future, these tools could help them break into new markets with victims speaking more "exotic" languages.

Another worrying issue is the fact that these AI models could generate everything, from text to images to real-time videos used for scamming people and technology can only help so much.

Back to your question: yes, we are working on technlogies to help people detect scams powered by artificial intelligence, technologies that will naturally complement our already mature scam detection technology stack. We're also spending significant effort in educating users on how to tell AI-generated content. You might find this piece interesting: https://www.bitdefender.com/blog/hotforsecurity/deepfakes-what-they-are-how-they-work-and-how-to-protect-against-malicious-usage-in-the-digital-age/

Stay tuned, we're going to have plenty of announcements on this topic shortly. Let me know if I can help you with anything else in the mean time.

[another block cause I exceeded the word count in the first one]

Question 3

Previously, Bitdefender included an integrated Android database in its Mac and Windows products. However, currently, the Windows and Mac products can detect all types of malware for all operating systems except Android. Is there a reason for this? If the Mac and Windows products can detect iOS, Symbian, and Blackberry mobile malware, why did you remove Android detection from these products? This is a significant drawback for Bitdefender. For example, after removing the Android engine from the Mac and Windows products, some Android files were still detected by the Windows and macOS products, but the Android product failed to detect them. I have a collection of over 1,000 Android malware samples detected by the Windows and Mac products but not by Bitdefender Mobile Security. If you had to remove the Android engine, you should have removed it completely, eliminating all Android detection from the Windows and Mac products. I contacted support about reintegrating the Android engine back into Windows and Mac, and they told me the respective team would work on it if it can be implemented again. I received similar feedback from some Bitdefender staff on the forum who said this would be a great idea and would share it with the respective team. Therefore, I kindly request that you reconsider and reimplement Android detection into the Windows and Mac products. If that's not possible, you should remove the detection of Linux, Blackberry, Symbian, and Mac engines from the Windows OS product and Linux, Blackberry, Symbian, and Windows engines from the macOS product. This would ensure fairness since malware designed for other operating systems cannot harm a specific system.

 Let me look into that and I'll get back to you shortly.

Question 4

Bitdefender's home product utilizes signature-based, heuristic, advanced threat, and cloud-based detection technologies. Bitdefender's business/enterprise product includes all of these technologies plus HyperDetect. Isn't it unfair that the home version lacks HyperDetect? Will Bitdefender continue to maintain that home users do not require the same level of protection as business/enterprise users? While I understand that you cannot comment on other antimalware vendors, all other vendors offer the same detection technologies and malware coverage for both their home and business/enterprise products

OR is HyperDetect a single term given to a business/enterprise line of products that comprises all signature-based, heuristic, advanced threat, and cloud-based detection technologies.

HyperDetect is a technology that uses local machine learning models that are designed to intercept very specific types of attacks such as PowerShell abuse or tools and techniques used by APT groups, to mention a few. Gven that home users are not subject to state-sponsored attacks or advanced threat actors, HyperDetect will likely make no difference.

Bitdefender business and home products are targeted at two different audiences and include the mix of technologies that both audiences need to navigate the dangers associated to their daily activities. When we build these stacks, we always look at what the market needs and what their issues are, and always build (or port) new features to cater to their individual pain-points. Thoughout the time, we have ported several technologies form the enterprise products to the consumer portfolio: the Ransomware Remediation, Root Cause Analysis and so on and we keep doing that when it's relevant for our users. Throwing in business technologies into consumer products will likely make these difficult to manage and use for the average consumer. We believe that consumer products should be set-it-and-forget-it, because most people are not tech-savvy and don't like complex setups and maintenance.

Regarding fairness - we have a vast range of products that suit a specific type of users and we don't condition access to any. It's easy for people who think they need HyperDetect or any other business-only technology to make migrate to GravityZone, for instance (it is available for setups from 5 computers up to as many as you'd like - that's what I have at home :) )

Question 5

What sort of machine learning and AI technologies are implemented in both home product and business/enterprise product lines? Also, on virustotal.com, there is an engine called Bitdefender Theta, which I suppose is based on machine learning. What is the use of that engine on virustotal when it is not implemented in any of the home, business, or enterprise ranges of Bitdefender products?

The anti-malware engines (and their capabilities) in our consumer and business products are identical, except for the fact that business products also come with HyperDetect and can be complemented with the EDR module + sensors.

Theta is indeed a cloud-only, machine-learning only detection technology. It is an experimental technology that we don't integrate at this point.

Hope this helps,

Bob

Hi, @fedor

Nice to meet you and please accept my apologies for the delayed answers. Apologies, but my French is terrible, so I'll have your questions answered in English instead.

j'aimerais savoir si bitdefender a ou va utiliser l'IA dans le futur?

- Bitdefender *is* and has been using machine learning algorithms since 2007 for malware and spam detection, as well as for detecting cyber-bullying and predatory conversations in Parental Control technologies. We currently Out of the 495 patents issued to us for core technologies, about 10% are related to machine-learning algorithms to detect malware & other threats.

- est ce que la fonction remeditation des ransomwares restaure vraiment tous les fichiers bloquer par un ransomware?

Yes. Bitdefender keeps a backup copy of all files before they are allowed to undergo encryption. If, during processing, Bitdefender detects that the encryption is triggered by ransomware, it would automatically terminate the encryption process and restore all files to their previous state.

- quel sont tes diplomes pour en arriver a ce poste?

I started working for Bitdefender almost 16 years ago. Before 2008, I worked as a system administrator at an university, where I gradually became acquainted with cyber-security, threat hunting, incident response and remediation - things that helped me gain expertise for the current role.

I hope this helps,

Bogdan