Kaspersky: pipeline ML detecta 467.000 novas ciberameaças por dia + analista IA Kira para SOC
Kaspersky's automated ML pipeline detects and classifies roughly 467,000 novel malicious files daily (up 14% YoY), handling over 99.9% of incoming threat volume without human intervention.
| Company & Sector | Лаборатория Касперского (Kaspersky) — Cibersegurança |
|---|---|
| Models & AI Stack | Behavioral ML Engine · Gradient Boosted Trees · Deep Threat Clustering · Kaspersky Security Network (KSN) · Kira LLM SOC Assistant · KUMA SIEM / XDR |
| Cronologia | 2018–2022 — production rollout of behavioral ML engines and KSN cloud clustering; 2023–2024 — neural anti-phishing and launch of Kira AI assistant in Threat Intelligence and XDR/SIEM; 2025–2026 — scaling past 467,000+ daily novel threat detections and agentic SOC workflows. |
| Verification | Verificado 2026-10 · 3 primary sources |
Contexto e escala do negócio
Kaspersky is a global cybersecurity leader in endpoint protection, XDR, MDR, SIEM, and Threat Intelligence, safeguarding over 400 million users and 220,000+ corporate clients worldwide.
Modern malware volume has long surpassed manual signature authoring: according to Kaspersky's 2024–2025 telemetry reports, its detection grid encounters an average of 467,000 new unique malicious files every single day—more than five novel samples per second.
To counter automated attacks, polymorphic ransomware, and spear-phishing, Kaspersky engineered a multi-tier machine learning funnel—spanning ultra-lightweight on-device models to cloud deep learning in Kaspersky Security Network (KSN)—and embedded the Kira generative AI assistant into its SOC platforms.
Problema e gargalos operacionais
The primary constraint in endpoint and XDR security is extreme error-cost asymmetry. Unlike consumer recommendations, a single false positive on a business binary can halt thousands of enterprise workstations, while a false negative can allow network-wide ransomware encryption.
Second is adversarial evasion: threat actors continuously obfuscate payloads and abuse legitimate system binaries (Living-off-the-Land / LotL) to bypass static heuristics.
Third is SOC analyst fatigue and talent scarcity: Tier-1 and Tier-2 analysts face thousands of complex PowerShell/Bash command lines, SIEM correlation alerts, and Threat Intelligence indicators daily.
Arquitetura e implementação de IA
Kaspersky's detection architecture operates as a multi-layered ML funnel. Pre-execution static ensembles evaluate thousands of structural file features in milliseconds. Upon execution, behavioral ML models analyze real-time sequences of OS API calls, memory injections, and file-system mutations—halting ransomware within milliseconds and automatically rolling back tampered files.
In the cloud, Kaspersky Security Network (KSN) runs deep clustering and similarity models over streaming telemetry, distributing automated micro-updates globally within minutes of a zero-day encounter.
For human defenders, Kaspersky integrated Kira—a specialized generative AI assistant inside KUMA SIEM, Symphony XDR, and Threat Intelligence—which de-obfuscates malicious scripts, translates natural-language questions into SIEM search queries, and summarizes multi-stage incident timelines.
“"In cybersecurity, no single model is a silver bullet: defense-in-depth pairs millisecond behavioral ML on the endpoint to stop the payload with specialized LLMs in the SOC to help analysts instantly decode the attacker's intent." — Kaspersky Security Research
Impacto mensurável e economia
Kaspersky's automated ML pipeline detects and classifies roughly 467,000 novel malicious files daily (up 14% YoY), handling over 99.9% of incoming threat volume without human intervention.
Behavioral ML combined with KSN cloud intelligence blocks zero-day ransomware strains at near-zero false-positive rates, consistently earning top scores in independent AV-Comparatives and SE Labs evaluations.
Deploying the Kira AI assistant across SOC workflows reduced initial incident triage and obfuscated script analysis time by 35–50%, accelerating junior analyst ramp-up.
Lições para a indústria
Where false positives can halt enterprise operations, a cascade of lightweight static models plus runtime behavioral ML outperforms monolithic deep networks.
Static file inspection fails against fileless Living-off-the-Land attacks; sequence modeling over OS system calls is decisive.
In SOC operations, generative AI delivers the highest ROI when de-obfuscating command-line payloads and translating analyst intent into SIEM queries.
Cloud telemetry loops (KSN) turn a zero-day encounter on one endpoint into global fleet immunity within minutes.
Fontes primárias verificadas
- Securelist / Kaspersky Security Bulletin: статистика киберугроз (467 000 новых вредоносных файлов в день) и технологии машинного обучения ↗
- Kaspersky Symphony XDR, KUMA и ИИ-ассистент Kira для аналитиков SOC ↗
- Как устроено машинное обучение в детекции вредоносного ПО и анализе телеметрии в Лаборатории Касперского ↗
Perguntas frequentes sobre a notícia
Why not send every suspicious file directly to a Large Language Model?
Endpoint process blocking must execute in single-digit milliseconds with minimal CPU overhead and even offline. Compact tree ensembles and behavioral models run on the host, while LLMs assist SOC analysts in cloud/on-prem consoles.
How does the Kira AI assistant protect confidential corporate SOC data?
Kira operates within Kaspersky's isolated security architecture, sanitizing sensitive host identifiers and grounding responses in curated Threat Intelligence and SIEM/XDR schemas.
What happens if ransomware modifies a few files before the behavioral model triggers?
The moment the behavioral ML engine flags an anomalous encryption sequence, it terminates the process and automatically restores modified files from a protected rollback buffer.
Ship AI Faster with Founders, Engineers & Weekly Architecture Reviews
Inside Vibe Club (hamidun.com/club) — weekly live masterminds with Zhemal Khamidun, Tech Radar, full LMS access, and 370+ production Claude Code skills.
O essencial da IA — uma vez por semana
Sete histórias que realmente importaram, escolhidas a dedo. Sem ruído nem releases.
Pronto! Verifique seu e-mail para a confirmação.