The “What, How and Why?” of Machine learning in Quick Heal 2013

An enhanced scan engine is one of the primary features of Quick Heal 2013. The engine is now smaller in size (almost 1/10th) and utilizes adaptable machine learning capabilities to detect potential threats. This not only increases the security of the device but it also reduces the resource load to provide an optimized solution.

What is Machine Learning and how does it function?
In order to understand the engine enhancements, it is necessary to delve into machine learning and understand how this technique works. Machine learning is a pattern-based algorithm that teaches programs to study existing patterns and then predict future behavior based on these. There are many different avenues where machine learning can be implemented and the algorithm can be altered to achieve several purposes.

The nature of the algorithm causes the program to change its execution path and decisions based on the data it has gathered over time. As a result, new data causes the program to ‘learn’ and adapt its directory constantly. The accuracy of the program highly depends on the quality of training data that is provided during development.

Consider the case of spam filters used by email service providers. The machine learning algorithm here allows the filter to identify spam that resembles similar content received in the past. If an incoming email possesses characteristics similar to previously seen spam, it is classified as spam too and sent to the Junk box. As new spam pours in with altered content and different text, the algorithm teaches itself to recognize such alterations proactively.

Different types of Machine Learning
Machine learning can be classified into the following major categories:

Supervised learning: In this scenario the program uses labeled (supervised) training data to create functions and paths. In the development phase this data is punched in and the desired output is compared with the output achieved. This allows the algorithm to predict results in a reasonable manner and also helps it evolve over time. In the case of the aforementioned email spam filter example, emails that are classified as spam by the user serve as labels for future predictions. So the program sends similar emails to the Junk box in the future.

Unsupervised learning: This scenario allows the program to analyze unlabeled data to predict behavior and find hidden structures. Since there is no way to compare results, this method utilizes many data-mining concepts. The results are eventually clustered together to form distinctions and classifications.

Machine Learning in Quick Heal 2013
When it comes to malware analysis and threat detection, machine learning has capabilities that exceed present-day algorithms. The program structure enables recognition of present and past malware signatures and the detection of new threats as and when they arise. This is achieved through the study of supervised labels programmed during development and the unsupervised clustered patterns that the program teaches itself.

Malware authors leave various signatures that accompany exploits and these signatures are visible once identified. Machine learning teaches the scan engine to pour through known signatures and detect new signatures that could be threatening. The automation and increased detection rate provided by machine learning makes Quick Heal 2013 highly advanced.

Machine learning is a form of artificial intelligence and is a fairly complex technique. It can be modified to suit various purposes and its efficiency depends on how intricately it is tested. The Quick Heal 2013 scan engine directory possesses a large number of malware signatures that it already recognizes and this helps the algorithm predict future threats with near perfect accuracy. Along with other features like Browser Sandboxing and sub-domain blocking, machine learning provides our users with integrated and comprehensive protection.

Rahul Thadani