S12 Bonus: Fusing AI-Powered Predictive Malware Inference with Content Disarmament and Reconstruction (CDR) to Neutralize Silent File Attacks with Dr. Aqib Rashid, Applied AI Lead at Glasswall

[SPEAKER_01]: We intended to prove out that you could use CDR telemetry.

[SPEAKER_01]: So that is the structural telemetry that you obtain as a result of cleaning files and analyzing files and using that kind of data to build machine learning models.

[SPEAKER_01]: So we wanted to first prove out that end-to-end process.

[SPEAKER_01]: Some researchers in the past had proved that it could work to some degree, but that there was room for improvement in the performance there.

[SPEAKER_01]: So effectively, the MVP there became, that's first, understand, which bits of telemetry, if any, can we use for this process?

[SPEAKER_01]: If so, how good can we get this?

[SPEAKER_01]: I'm Dr. Akimushid, I'm the applied AI lead at Glasswall.

[SPEAKER_00]: This is Code Story.

[SPEAKER_00]: a podcast bringing you interviews with tech visionaries.

[SPEAKER_00]: Six, six months moonlighting goes.

[SPEAKER_00]: It's the last and all of the backgrounds who share what it takes to change an industry.

[SPEAKER_01]: I don't exactly know what to do.

[SPEAKER_00]: It doesn't go as to get right.

[SPEAKER_00]: who built the teams that have their bad company is its team's help each other, which is proud of our team.

[SPEAKER_00]: Keeping scalability top of mind, all that infrastructure was up there.

[SPEAKER_00]: Yes, we've been fighting it as we grew up.

[SPEAKER_00]: Total waste of time.

[SPEAKER_00]: The stories you don't read in the headlines.

[SPEAKER_00]: It's not an easy thing to achieve.

[SPEAKER_00]: To get yourself a deficit of off, try to begin to ride the ups and downs of the start-up line.

[SPEAKER_00]: Need to really want it.

[SPEAKER_00]: Not just about technology.

[SPEAKER_00]: All this and more on code story.

[SPEAKER_00]: I'm your host, Noah Labhart.

[SPEAKER_00]: In today, how Dr. Akib Rashid is helping you stop malware in its tracks, helping you adopt zero trust and protect your data.

[SPEAKER_00]: Dr. Akib Rashid was born and raised in London.

[SPEAKER_00]: He spent a lot of time around computers and tech growing up, and his parents pushed him towards becoming an expert in a discipline, and being a positive influence on society.

[SPEAKER_00]: But he maintained his balance in life by playing sports, which inspired him to want to lead a team in the future.

[SPEAKER_00]: But outside of tech, he is a dad to a one-year-old boy.

[SPEAKER_00]: He enjoys spending time with him outdoors and finds that the real beauty in life is watching him grow up.

[SPEAKER_00]: In September 2023, a kid had completed his Ph.D. around the subject of using AI to detect malware.

[SPEAKER_00]: His current venture was looking at how to implement this sort of approach into their products.

[SPEAKER_00]: Quickly, he got to work building a new product to detect malware in your files using AI.

[SPEAKER_00]: This is Dr. Rashid's creation story at Glasswall.

[SPEAKER_01]: Glassware is a company that has existed for a couple of decades now, actually.

[SPEAKER_01]: It's a cybersecurity company based in the UK and the US.

[SPEAKER_01]: And the expertise that our company has built up over time is around a technology known as content-dissarm and reconstruction.

[SPEAKER_01]: I don't need to describe too much the phenomenon of malware and malicious actors trying to get into your system and wreak havoc in your corporate network or whatever it might be.

[SPEAKER_01]: And one way that they typically do that is through files, so that could be PDF files, could be office files, and of course files are...

[SPEAKER_01]: The life-blood of an organization, whether it's center of the email, or Slack, or whatever it might be.

[SPEAKER_01]: And what you'll find is that traditional cyber-skilled technologies when they try to detect whether a particular files are malicious, they invoke signature-based detection, they invoke some kind of heuristics, or your traditional AV will do a decent job with detecting malware.

[SPEAKER_01]: But in certain situations and certain environments, all you want is a clean and pristine vial and you can't tolerate mal-retool.

[SPEAKER_01]: And sometimes you're dealing with so many files that you can't necessarily sign for them often, do just kind of analysis on them.

[SPEAKER_01]: But this is where CDR or content to some reconstruction comes into playing.

[SPEAKER_01]: This is something that glassful as pioneered over the last couple of decades.

[SPEAKER_01]: So this is where you take your file,

[SPEAKER_01]: And you firstly, you rid the fire of any kind of malware that Dynamite exists there.

[SPEAKER_01]: You then try to bring that file back to the manufacturers' original specification because we've developed an understanding of what a legitimate file should look like.

[SPEAKER_01]: So you decompose it completely, validate the file, and then what you deliver to the user is a clean, pristine file which is completely free from any kind of malware.

[SPEAKER_01]: It conforms to the specification of PDF or of Microsoft Office or images or whatever.

[SPEAKER_01]: And it's a deterministic guarantee that the file is safe to use regardless of where it came from.

[SPEAKER_01]: And this will follow that zero trust principle of philosophy which is that you don't trust any kind of files or anything that you interact with, you simply clean it, cleanse it, reconstruct it and give it back to the user such that they shouldn't actually know it as a difference.

[SPEAKER_01]: I joined the company in September of 2023.

[SPEAKER_01]: I think I should probably preface this with my background, which is in the security of machine learning and the application of machine learning and AI to cybersecurity.

[SPEAKER_01]: So I was completing a PhD, 23 on the topic of securing machine learning based

[SPEAKER_01]: and what Glass4 was looking to explore at that time was building capability to detect malware from files, because it's all well and good.

[SPEAKER_01]: Being able to cleanse the file and being able to provide that guarantee that the file is now completely safe, but it doesn't give you that insight as to whether the original file was malicious.

[SPEAKER_01]: And for some organisations or users that might be quite useful, it might be

[SPEAKER_01]: So that's where I joined the company and we started working on a product that would allow you to pass in the file to a machine learning model and the output would effectively be the likelihood of that file containing malware.

[SPEAKER_01]: So effectively we're operating on

[SPEAKER_01]: different signals from the file in order to be able to arrive at a verdict or some kind of prediction as to whether that file is malicious.

[SPEAKER_01]: Obviously my expectation is they all are in the cybersecurity ML intersection, so I was quite well positioned to be working on this problem at Glassfall when I joined a couple of years ago.

[SPEAKER_00]: And so I'm curious about

[SPEAKER_00]: The MVP of that product, right?

[SPEAKER_00]: You joined the companies, you know, got quickly started building this new product.

[SPEAKER_00]: Tell me about the MVP, what did it look like?

[SPEAKER_00]: What sort of tools you're using to bring it to life?

[SPEAKER_00]: And how long did it take you to bring it to life?

[SPEAKER_01]: the MVP at the time it was so before we actually landed on the specifics of this product.

[SPEAKER_01]: So for example, which kind of file types we want to target but are there the various non-functional and functional requirements etc.

[SPEAKER_01]: We had to prove at the science of doing all this.

[SPEAKER_01]: So taking different

[SPEAKER_01]: pieces of telemetry and using that to train a machine learning model and that model should then have the ability to reliably distinguish between good wear and malware.

[SPEAKER_01]: So the first real question we wanted to explore is what kind of signal would be genuinely discriminated.

[SPEAKER_01]: You could say that was the MVP phase in the research portion of this project or this product.

[SPEAKER_01]: We intended to prove out that you could use CDR telemetry.

[SPEAKER_01]: So that is the structural telemetry that you obtain as a result of cleaning files and analyzing files and understanding what's in files.

[SPEAKER_01]: And using that kind of data to build machine learning models.

[SPEAKER_01]: So we wanted to first prove out that end-to-end process.

[SPEAKER_01]: Some researchers in the past had proved that it couldn't work to some degree but to performance, but that there was room for improvement in the performance there.

[SPEAKER_01]: So effectively the MVP there became, that's first, understand which bits of telemetry, if any, can be used for this process.

[SPEAKER_01]: If so, how good can we get this?

[SPEAKER_01]: Can we validate the hypothesis that the malicious files look structurally different from the nine ones, given the data that CDR exposes?

[SPEAKER_01]: So what we found at that point was that the answer is yes.

[SPEAKER_01]: There is a statistical difference between the CDR data that represents malware versus the CDR data that represents goodware.

[SPEAKER_01]: So that is the deep structural telemetry

[SPEAKER_01]: So then, obviously, you don't have to try to trigger at, okay, we've proved the science of this little.

[SPEAKER_01]: Now, we have to try and prove this out as an end to end, commercially viable product.

[SPEAKER_01]: So commercially viable product means, okay, you can achieve.

[SPEAKER_01]: specific true positive rates or detection rates or specific false alarm or false positive rates to make this useful for customers but equally aspects such as inference time or roundtrip time the deployment requirements and all that kind of stuff suddenly come into play there.

[SPEAKER_01]: So the early phases of this at the MVP stage when this transition from being a research project effectively into a product that we are, that's sorry that we sought to develop at the time.

[SPEAKER_01]: Involve making some deliberate decisions around the types of model architectures, the types of files that we would support aspects related to explainability of models

[SPEAKER_01]: in a highly regulated mission-critical environment, but also maybe in an enterprise, SaaS solution as well.

[SPEAKER_01]: So you might not always have access to the internet.

[SPEAKER_01]: You might not always have the ability to call to home, so to speak.

[SPEAKER_01]: You'll have the requirement for transparency, auditability,

[SPEAKER_01]: When you're doing this at scale, you need to have the efficiency of millisecond scale inference.

[SPEAKER_01]: So making a decision on file in milliseconds.

[SPEAKER_01]: So that tolerance for sitting around and waiting for a file to come back with its verdict just isn't there.

[SPEAKER_01]: That is kind of scale.

[SPEAKER_01]: So understanding all of these different aspects of what customers would want and what would you uniquely position this in a certain period of time once we had developed this was parama for us at that early stage and of course the different file types themselves they are equally

[SPEAKER_01]: diverse but also equally complex in the nature of the PDFs are radically different to Microsoft Word documents which are different to Microsoft Excel documents which are different to images so we have to make certain decisions at certain points in this entire process to try and bring about a useful product on all fronts there.

[SPEAKER_00]: You've got that MVP, and you kind of touched on this maybe to high level, but I'm curious about how you progress and matured it from there.

[SPEAKER_00]: What I'm really looking for is like, how do you build your roadmap?

[SPEAKER_00]: How do you decide that, okay, this is the next most important thing to build or to address, and you know, on this particular product.

[SPEAKER_01]: The maturation or the development process is all about taking it from the hypothesis to production discipline.

[SPEAKER_01]: So, of course, early on it was all about ensuring and validating that the signal that we are training on here, which is that CDR telemetry that is.

[SPEAKER_01]: produced by glassful actually worked for the problem of detecting malware or predicting malware.

[SPEAKER_01]: But then taking down to production and maturing this further and building it into a road that basically meant bringing in that ML DLC, so a machine learning development life cycle and the SDLC and all the engineering rigour that comes with it.

[SPEAKER_01]: So that is looking at automated experimentation infrastructure,

[SPEAKER_01]: ensuring that any models that you develop are test and reliably on threats to the model has never seen, building out, continuous drift monitoring systems to understand if drift is occurring, how severe is the problem.

[SPEAKER_01]: But in equally building the software aspect of all this as well because it's all well in good building the AI capability in the AI model and I think a very robust process where you can ingest millions and millions of files as part of your training pipeline and train of models in a matter of hours which is what we've done at Glasswall.

[SPEAKER_01]: but then you also need to make the output of that process, which is the model usable and useful for the user.

[SPEAKER_01]: So building out a very user-friendly piece of software that ultimately gives customers that satisfaction that the model and the brains behind the operation, it is fundamentally going to make decisions about files in a manner that is safe, trustworthy, explainable.

[SPEAKER_01]: But an equally is understandable as well.

[SPEAKER_01]: So baking all that is into the roadmap and I don't understand, of course, along the way, that this could be a potential pain point for a customer or a customer might expect this at this juncture, was pivotal.

[SPEAKER_01]: We had some great input from our product team at Glassfall, along the way for understanding these different pain points.

[SPEAKER_01]: And of course, we were speaking to various prospects along the way as well.

[SPEAKER_01]: But I think it's important to get those early feedback loops in this process.

[SPEAKER_01]: With these feedback loops, with the understanding and the concrete understanding I would say about what we want from this product.

[SPEAKER_01]: But in equally, the engineering rigor, so that strong, stable, maintainable process around building this product and these models, all of that contributed towards the ultimate roadmap here.

[SPEAKER_01]: The roadmap here isn't a case of, okay, build a model that can detect malware and every kind of file that exists out there.

[SPEAKER_01]: No, you have to build up products in a manner that is also sustainable.

[SPEAKER_01]: So that means first build a model for maybe the PDF file type and then build a model for the next file type.

[SPEAKER_01]: And slowly you can start building up models in the repeatable fashion as well.

[SPEAKER_01]: Once you've understood the methodology there as well.

[SPEAKER_01]: An interesting thing nowadays, of course, is the development for seeing in a Gentic AI as well, so that has also had an impact on the roadmap.

[SPEAKER_01]: And of course, the industry is also rapidly evolving.

[SPEAKER_01]: So the industry and its evolution also factors into your roadmap as well, and it must do as you are developing a product like this.

[SPEAKER_00]: So what about tea?

[SPEAKER_00]: How did you build your team?

[SPEAKER_00]: And would you look for to find, I'm sorry, and what did you look for in this people to indicate that

[SPEAKER_01]: I like for people who are genuinely curious about the problem and not just the technology, the machine learning frameworks and the actual languages and just different engineering tools so to speak.

[SPEAKER_01]: You require that curiosity in order to be able to solve difficult problems.

[SPEAKER_01]: You want people who are eager to learn but also eager to contribute at the same time and you want people who hold themselves to a very high standard.

[SPEAKER_01]: That's why looking for the people who have, of course, the engineering prowess and the domain knowledge is absolutely vital, but also looking for people who are genuinely curious as we did at Glasswall is imperative when you're trying to solve a very difficult problem as we have done with foresight and with this product that can detect malware.

[SPEAKER_00]: I'm curious about scalability, right?

[SPEAKER_00]: And where it came into play when you first joined and took on this building, this new product, I'm curious how you approached it in the beginning, but I'm also, I'm really interested in where you've had to fight it as you've grown.

[SPEAKER_01]: When I joined the company, there wasn't really an ML pipeline or an AI pipeline that had been used for experimentation and building models because up until that point, a lot of the work was in the research phase and proving out the feasibility of training models with CDR telemetry.

[SPEAKER_01]: So when I joined, one of the first things that we did was build our ML pipeline from a ground up so that it involves a lot of AI engineering and a lot of discussion and thought around scalability.

[SPEAKER_01]: And I'm pleased to say that in the two years later or so, we're still using that ML pipeline, we're still using that technology that we built.

[SPEAKER_01]: that can, like I say, it ingest millions and millions of files and conduct feature analysis, conduct feature selection, conduct model training, do all the post training activities and at the end of it give you a model in the matter of hours for the file types that we care about.

[SPEAKER_01]: And being able to do this is no easy feat, especially when you consider the costs that could be involved in doing so, we've got the cost down quite considerably as well.

[SPEAKER_01]: But the ultimate beauty of all is of course is that we have models that will stand a test of time and they will scale with the evolving scripts and with evolving malware as time goes by.

[SPEAKER_01]: So, it wasn't the case that we were fighting with scalability or fighting necessarily as we grew.

[SPEAKER_01]: We knew ahead of time that we wanted to make this process of developing machine learning and AI models as repeatable, as automatable, as reproducible, as possible.

[SPEAKER_01]: while also ensuring that there is going to be a high quality model at the end of this entire process as well.

[SPEAKER_01]: And this is just on the training and the ML side, so one could also consider scalability in terms of using the model at inference times, so that is

[SPEAKER_01]: deploying the model and giving it to a customer and letting them have a go of it and take it for a drive.

[SPEAKER_01]: It's important that at inference time as well or at prediction time, the model behaves reliably and it scales well bear as well and it doesn't suffer from high degrees of latency where you're waiting seconds and minutes for files verdict to be returned to you.

[SPEAKER_01]: So all of these kinds of potential challenges, we get bored of ahead of time with a view to ensuring that this product will be sustainable going forward.

[SPEAKER_00]: As you step up on the balcony, you look across all that you've built thus far with glass wall what do you most proud of?

[SPEAKER_01]: I think it's the fact that we have managed to solve a very difficult problem.

[SPEAKER_01]: If you look at academia in general with respect to ML based or AI based reproduction, they page quite a bleak picture.

[SPEAKER_01]: where they're saying that this is a very difficult problem and we don't think this will be necessary so because there are certainly pitfalls and challenges involved and you might be able to build a model but certainly it will start drifting and it will have poor performance somehow later as you get new types of malware in the wild.

[SPEAKER_01]: I think though with Glassfall and with full site which is the capability that we've developed and the models that we've developed.

[SPEAKER_01]: We've shown that not only can you build models that can detect malware or predict malware on day zero, so that is looking at those unknown or zero-day vulnerabilities, but they will do just as well on day one when you know about the vulnerabilities that exist in a while.

[SPEAKER_01]: But also, months and months down to line, where the threat landscape may have evolved, the types of malware that exist have evolved.

[SPEAKER_01]: But because we have trained models on deep CDR structural telemetry, what we are somewhat inoculated against is that evolving threat landscape.

[SPEAKER_01]: So, it means that we have proved out that, yes, you can build capable models for this

[SPEAKER_01]: But then equally, you can then deploy these models in an air gap environment and an offline environment, where you have no calls to her, you have no internet and the model work very well there.

[SPEAKER_01]: You can deploy this same model in a SaaS solution, maybe in some kind of enterprise network, it will work just as well there.

[SPEAKER_01]: and all the while proving out along the way that you can do this in a scalable maintainable way underpinned by the world-class R&D that we've done here at Glasswall.

[SPEAKER_01]: So that is the decades of file-based security research that we've done.

[SPEAKER_01]: The AI engineering and AI research that we have conducted

[SPEAKER_01]: And of course, the intersection of those two fields has led us to the glassful force like which of course is undoubtedly the thing I'm most proud of in terms of my work at glasswall.

[SPEAKER_00]: Let's flip the script a little bit, tell me about a mistake you made, and how you and your team responded to it.

[SPEAKER_01]: I think research and development in general or science in general while there is all about making assumptions about what making assumptions and making hypotheses about certain problems or certain certain questions that have come to mind and oftentimes they don't stick because they don't land as you'd expect.

[SPEAKER_01]: The, for example, an assumption that we made early on in the R&D phase was that certain structural features might be more useful than others for the purposes of trying to detect malware.

[SPEAKER_01]: But what we quickly saw quickly found was that where we were looking at certain structural features and certain telemetry we weren't getting in the results that one would expect and one would consider commercially viable.

[SPEAKER_01]: to that obviously means you don't have to go better at drawing board and think a little deeper about the problem and of course thinking further and further about the science behind all this and the research behind on this will eventually get you to the right solution because I don't think that there is any problem out there that is

[SPEAKER_01]: completely unsolvable.

[SPEAKER_01]: Problems are going to be very difficult and you will make mistakes along the way and try to solve those problems.

[SPEAKER_01]: But that is all part of the learning process, Noah.

[SPEAKER_01]: I don't think there is anybody even claimed to have developed a perfect solution the first time around.

[SPEAKER_00]: Okay, I keep, let's move forward.

[SPEAKER_00]: What does the future look like for Glasswall, for what you've built there for?

[SPEAKER_00]: You know, all the things, how are you moving forward as the industry's changing regularly?

[SPEAKER_00]: What does the future look like?

[SPEAKER_01]: Our work at Glasswall is a cybersecurity company as a company who is heavily focused on file-based security and ensuring the safety of our customers is obviously going to be underpinned by the evolving threat landscape which is predominantly these days about AI and the threats posed by AI and the adjuncting ways of working so to speak.

[SPEAKER_01]: So that means developing capability in this kind of new era, whether it is a dealing with AI-based threats, whether it is dealing with new types of malware or new customer concerns around AI, but an equally ensuring that the capabilities that we have developed to date,

[SPEAKER_01]: Remain as effective as they have ever been because cyber security in general is a field where it is extremely critical to keep up to date and it is extremely high stakes and you can't afford to make mistakes.

[SPEAKER_01]: So what I would say is that the world of AI, the world of cybersecurity, these are probably two hottest places to be as a company and we are in both and in fact we are at the intersection with Glassville 4 site with content development reconstruction.

[SPEAKER_01]: Stay tuned, I would say there are certainly some very interesting developments coming out.

[SPEAKER_01]: One of them, of course, like I say, forsoil, which we have actually launched today.

[SPEAKER_01]: So that is extremely exciting and I'm looking forward to seeing that ending up in the customer's hands and understanding where customers want us to look further at in terms of any kind of AI capabilities coming forward.

[SPEAKER_00]: Okay, I keep, let's switch to you who influences the way that you work.

[SPEAKER_00]: Name a person or many persons or something, you look up to and why.

[SPEAKER_01]: I think I generally look to the security and AI community in general in terms of the evolution that has happened over the last 20, 30 years and the influence that has had on me as a person and the impact that has had on my ability to gain knowledge, to disseminate knowledge at an equally to make this as applicable as possible.

[SPEAKER_01]: So that is the answer in terms of industry knowledge and academic knowledge, so to speak, but generally speaking, I've had some really great role models growing up.

[SPEAKER_01]: My parents, my father, who pushed me towards pursuing PhD in the space of computer science, and that was of course a great influence for me growing up.

[SPEAKER_01]: So I think that certainly influences the way I work because I've always put it being pushed towards that drive for excellence and that drive for perfection where it is reasonable but it's not always necessary that you need to arrive at a perfect solution every time but that drive towards excellence is absolutely essential and that's effectively what's been influencing me and it's still continuous to influence me to this day.

[SPEAKER_00]: Okay, last question, so you're getting on a plane and you're sitting next to a young entrepreneur who's built the next big thing.

[SPEAKER_00]: They're jazzed about it that they can't wait to show it off to the world and can't wait to show it to you right there on the plane.

[SPEAKER_00]: What advice do you give that person?

[SPEAKER_00]: You know, having gone down this road a bit and building this new product at Glasswall, what would you tell them?

[SPEAKER_01]: So I would suggest to any young entrepreneurs is to build something that deserves trust before we build something that is that seems to be impressive, but somebody could potentially copy overnight and somebody could get too much quicker than you.

[SPEAKER_01]: But before example, when analogy in cybersecurity and AI, AI in cybersecurity is that it's very easy to build an AI model that looks good on a benchmark, but having that model then do very well in the real world under adversarial conditions is a very different problem.

[SPEAKER_01]: And I think that translates to pretty much anything else to get that early feedback.

[SPEAKER_01]: get that validation from prospects and customers and and people who know more than you before you try to build the perfect solution for a problem that might have been sold already might not exist or somebody might have the capacity to do better than you that is a fundamental aspect in the way of working these days with the rise of AI is that it is very easy now to build products very quickly.

[SPEAKER_01]: And along the way, of course, you will make mistakes and things will go wrong, but the question then becomes, is, do you have the fortitude and the resilience to to stand up and to say, no, I'm not giving up here, and instead I'm going to spend some time, energy, effort, and some brain power.

[SPEAKER_01]: to, by the fixed days, remediated, or just to build something better, I think that is important.

[SPEAKER_01]: So seek validation, seek that trust, and don't try to build something which is going to be unsustainable.

[SPEAKER_01]: And certainly don't go for a problem, which is effectively going to be solved by an AI agent in virtually no amount of time.

[SPEAKER_01]: So spend your time as wide as you possibly can, is what I would say.

[SPEAKER_00]: That's Excellent Advice.

[SPEAKER_00]: Well, OK, thank you for being on the show today.

[SPEAKER_00]: Thank you for telling your creation story at Glasswall.

[SPEAKER_01]: Thank you, Noah.

[SPEAKER_01]: It's been great.

[SPEAKER_00]: And this concludes another chapter of Coat Story.

[SPEAKER_00]: code story is hosted and produced by Noah Labhardt.

[SPEAKER_00]: Be sure to subscribe on Apple podcast, Spotify, or the podcasting app at your choice.

[SPEAKER_00]: And when you get a chance, leave us a review, both things help us out tremendously.

[SPEAKER_00]: And thanks again for listening.