AMTSO 2025 - Rethinking AV Testing in the Age of AI

Last week’s AMTSO conference in Lisbon was a fantastic experience -- great discussions, sharp questions, and an engaged audience! 🤓 

In my talk (video is now available on YouTube https://www.youtube.com/watch?v=uQagBMFVCjE), I explored how traditional antivirus testing methodologies are falling behind in the era of AI-driven cyber threats. We revisited our earlier work on Reinforcement Learning–powered ransomware and connected it to recent developments, including LLM-powered attacks such as APT28’s LAMEHUG operation. The key takeaway: malware testing must evolve to assess adaptive, AI-enabled threats that can modify their tactics in real time.

I’m grateful to the AMTSO community for the opportunity to share these insights and to everyone who joined the discussion on rethinking AV testing in the age of intelligent malware. Looking forward to continued collaboration on building the next generation of testing standards.

hashtag#AI hashtag#Cybersecurity hashtag#AMTSO hashtag#LLM hashtag#AdversarialAI hashtag#MalwareResearch hashtag#Nioguard hashtag#BTH

"Analysis of cyberweapons" course

I got requests from my colleagues from the US and EU universities to come up with the "Analysis of cyberweapons" course in English. In the first video, I start the series devoted to the analysis of the Russian cyberweapons used in the Russia-Ukraine war. 

The lessons will be published on my Patreon (https://www.patreon.com/alexanderadamov) and YouTube channel (https://www.youtube.com/c/MalwareResearchAcademy)

For Ukrainians:

- Telegram channel (UA): https://t.me/malwareanalysisinua
- Youtube channel (UA): https://www.youtube.com/channel/UCqquOw2m2QF_EjcyxVwIYyQ

AI and Cybersecurity. Part 4 - Clustering URLs

In Part 3, we tried to apply the feature scaling and dimensionality reduction techniques to the dataset with phishing and benign URLs. As a result, we were able to clearly see the distribution of URLs between two classes based on four attributes: registrar, country, lifetime, and protocol.

But what if we don’t have labels (phishing and benign) for the Internet links in the beginning. Will ML still work to detect phishing attacks? In this case, we may come to unsupervised learning, in particular, clustering. Clustering enables grouping objects of unknown classes according to common features so that we do not need labeled data for a training set.

AI and Cybersecurity. Part 1 - Intro

Image via www.vpnsrus.com

[Author: Alexander Adamov]

Foreword
I have spent almost all my professional life working in the antivirus industry detecting and analyzing malware. Around ten years ago, when the malware flow had increased so much that my colleagues and I did not have enough resources to analyze them all, we started thinking about automating our efforts. How to make a machine that autonomously detects and analyzes malware and phishing URLs day and night, writes and publishes reports? As a result, we managed to create a robot (what we call now 'malware sandbox') from scratch to automate most of the processes in the malware laboratory with the help of His Majesty Artificial Intelligence (AI). Since that, we accumulated a bunch of use cases for cyberattacks detection, malware analysis, and security testing with ML that can be useful for cybersecurity professionals that decided to leverage ML for cyberdefense. I'm going to share this knowledge in the series of blog posts that will eventually become a part of a new university course 'ML in Cybersecurity' that I plan to make open-source. I also welcome cybersecurity experts and data scientists to contribute and help universities adopting the course.