Deep Engine
The Deep Engine is one of the proprietary Artificial Intelligence engines developed by GLIMPS. Built on Deep Learning, it relies on a scientifically recognized approach known as code conceptualization. Unlike traditional detection methods based on file signatures or metadata, the Deep Engine analyzes binary code at the assembly level to extract its functional semantics.
How does the Deep Engine work?
The Deep Engine breaks down a file’s executable code to identify what GLIMPS calls “concept-codes” (pieces of code). This analysis focuses on code logic, regardless of its syntactic form.
In practical terms, an attacker can easily change a malware‘s signature by recompiling it, altering its metadata, or applying obfuscation techniques.
The Deep Engine operates through static analysis, without executing the file, enabling an average analysis time of 3 seconds. It supports Windows executables (PE format) and Linux executables (ELF format).
What types of threats does the Deep Engine detect?
Through code conceptualization, the Deep Engine is designed to identify threats that signature-based approaches cannot cover: known malware variants (even when the code has been modified or recompiled) as well as zero-day threats, meaning malicious files that have never been observed before.
When malware is detected, the Deep Engine can also automatically generate a corresponding YARA rule. This rule can then be used for retrohunting (searching through past submissions) or exported to the customer’s third-party security tools (EDR, SIEM, NDR).
By generating YARA rules, the Deep Engine speeds up reverse engineering by highlighting the most malicious ‘top functions’ in the binary and providing their virtual addresses so they can be located in IDA/Ghidra. This means an engineer does not have to go through 200 functions one by one, but can focus on a selection of just a few, offering real added value.
Where is the Deep Engine used across GLIMPS solutions?
The Deep Engine is the shared technological core of all GLIMPS Malware products. It is involved in every file analysis, regardless of the protected environment: network security, business applications, endpoints, CI/CD pipelines, collaboration platforms, or email.
It reaches its full depth of analysis in GLIMPS Malware Expert, the investigation console built for SOC and CSIRT teams, and in GLIMPS Fortress, the platform for large-scale analysis and secure Data Lake management.