Microsoft Security Test New Play: Use AI Q & A to Discover Vulnerabilities

Introduction: The goal of the Springfield project is to capture vulnerabilities in enterprise application software that may be exploited by hackers. Microsoft wants to use artificial intelligence to conduct a large number of random questions and answers to detect system vulnerabilities.

Microsoft announced on Monday that it is preparing to provide users with a cloud-based error detection tool that is driven by artificial intelligence. Its purpose is to eliminate vulnerabilities in Windows, offices and other enterprise applications to avoid the need to use expensive patches later. It is repaired.

It is called the "Springfield Plan" and the company demonstrated the tool at the annual technology conference held in Atlanta, saying:

"This is the best software vulnerability eradication tool the company has."

On Monday, Microsoft chief researcher Patrice Godefroid said in a post on the company's website:

"Hackers want to exploit these loopholes."

Microsoft stated that it has used key components of the tool since 2000 and is currently testing the software through a smaller user base than Windows and Office customers.

The project's chief scientist Godefroid said:

"The internal component was called SAEG and eventually helped Microsoft identify up to one-third of errors before July 7, Windows 7 was released."

The Springfield project is essentially an extension of fuzz testing where the software is randomly attacked and the input is not predictable. A software crash indicates a potential vulnerability.

The company took a further approach by using artificial intelligence "to ask a series of 'if' problems" to make the software make more complicated decisions and trigger a crash. In this way, it can find vulnerabilities that are ignored by other fuzzing tools. Combining this technology with user-friendly dashboards and Microsoft's Azure cloud ensures that customers can run high-volume security tests in their enterprise software.

Amy DeMartine, principal analyst of Forrester Research, said:

"The fuzzing test has won great praise because the software produced by Microsoft has affected millions of users. However, there are some loopholes that may not be triggered by input to escape detection. These tools must be run quickly and combined with development tools. Such as continuous integration tools to ensure that the development team use them successfully."

Because of the vulnerabilities in Windows and other applications and the need for continuous patching, Microsoft has been criticized for years. it says:

"The large number of denials indicates its high status in the operating system market."

CIOs and security experts also blame Microsoft on many issues, such as the use of the traditional Windows API, some of which were created before modern digital security practices were in place.

In March, Microsoft introduced the "Windows Defense Advanced Threat Protection," which aims to use machine learning to better detect actual attacks on Windows 10 customers who hold commercial licenses, rather than targeting vulnerabilities.

Last year, it also opened a cyber defensive operations center. In addition to 3,500 security officers from around the world, it also gathered dozens of security teams led by about 50 security experts on its official and Windows teams, as well as Xbox, Azure and others. Business unit.

Via:THE WALL STREET JOURNAL