Whitelist Auto-Classification — How Rules and AI Reduce Manual Management
We outline how the trust list is managed automatically, with rules handling Windows programs and programs with a valid signature, and a LightGBM model judging unknown programs.
The Problem
Because the whitelist approach blocks every process that is not registered, it offers a high level of security. The drawback has been the burden on administrators of registering, one by one, the countless processes used on a PC.
Two-Stage Auto-Classification
- Rules — The engine automatically whitelists Windows processes and processes with a valid digital signature.
- AI verdict — Any other unknown program is blocked first. An AI model then analyzes its executable, and only programs found to be safe are added to the trust list automatically.
Administrators can also grant exceptions for unauthorized processes that are not on the whitelist.
How the AI Decides
- Input: The executable file (PE) of a program blocked by the driver
- Features: 2,381 features in the EMBER format — byte and byte-entropy histograms, string statistics, PE headers (COFF and optional header), section information, imported and exported functions, data directories, and general information (file size, presence of a signature or debug information, etc.)
- Model: LightGBM, which calculates the probability that a file is malicious as a score between 0 and 1.
- Verdict: If the score is at or below the threshold, the program is added to the trust list as type “AI Auto” and the agent is notified. If the score exceeds the threshold, the block stays in place and the program is reported to the management server.
- Exceptions and settings: Kernel-space access is excluded from automatic registration, regardless of the score. Administrators decide whether to use automatic registration and set the threshold score.
- Score storage: The score for each executable (identified by its hash) is stored and recalculated when the model version changes.
Model Training
Every month, we collect newly released ransomware samples, convert them into EMBER-format features and retrain the model with LightGBM. The trained model is converted into a native DLL and deployed to the agents, which switch to the new model without restarting.
Because blocking itself is handled by the whitelist, the level of protection stays the same even on closed networks that do not receive model updates.
Impact
Most Windows and commercial programs are trusted automatically, and the AI screens unknown programs first, so far fewer processes need an administrator’s direct judgment. We have cut manual management, long the hardest problem for whitelist technology, by more than 95%.
Detailed diagrams are available on the AI Auto-Classification page.