I'd be cautious about making broad statements regarding how AI based AVs tend to behave. It's a new space with a lot of competitors, of varying degrees of quality, with varying degrees of actual AI in use. Not all of them are even tackling the exact same problem, so comparisons can get murky fast.
Its also a space where data collection and ground truth are expensive, so people try to boot strap solutions in odd ways. Its tough.
As the paper author, I'm not going to name any companies. Especially since one was sharing data with us for this work, and I don't want to inject any of my biases into a particular name. But we've done some fairly extensive testing of the models we've built. Both on data they gave us and data we got ourselves, and our model don't just label everything as malware. It is not quite AV quality at the moment, but we also have limited training data and are really still exploring the different ways one can tackle this problem with AI.
Jon did a great job in this blog post, but if you want more details on why there is so much work to still be done, I'd recommend reading our paper! We tried to make the intro section accessible to people with no AV/malware background.
Its also a space where data collection and ground truth are expensive, so people try to boot strap solutions in odd ways. Its tough.
As the paper author, I'm not going to name any companies. Especially since one was sharing data with us for this work, and I don't want to inject any of my biases into a particular name. But we've done some fairly extensive testing of the models we've built. Both on data they gave us and data we got ourselves, and our model don't just label everything as malware. It is not quite AV quality at the moment, but we also have limited training data and are really still exploring the different ways one can tackle this problem with AI.
Jon did a great job in this blog post, but if you want more details on why there is so much work to still be done, I'd recommend reading our paper! We tried to make the intro section accessible to people with no AV/malware background.