Which of the following is an example of AI being used for endpoint security?

AI-driven behavior-based malware detection is a prime example of AI in modern endpoint security. Unlike traditional signature-based methods that look for known threats, AI models on the endpoint analyze patterns of behavior in real-time. This includes monitoring process execution, file modifications, network connections, and system calls. By learning a baseline of normal activity and identifying anomalous behaviors indicative of malware (e.g., ransomware encryption patterns, fileless attacks), AI can detect and block novel and zero-day threats that have no existing signature.

B. Manual software patching is a critical but human-driven operational security task, not an application of artificial intelligence.
C. Static rule-based firewalls operate on predefined, manually configured rules (e.g., block port 80), lacking the dynamic learning capabilities of AI.
D. Basic log storage is merely data collection; AI is applied during the analysis phase, which is explicitly excluded in this option.

1. Palo Alto Networks. (2024). Cortex XDR Prevention. Palo Alto Networks Datasheet. "The Cortex XDR agent combines multiple layers of protection, including AI-driven local analysis and behavioral threat protection, to coordinate prevention at the endpoint."

2. Palo Alto Networks. (2023). Behavioral Threat Protection. Cortex XDR Administrator's Guide. "Behavioral Threat Protection (BTP) continuously monitors endpoint activity for malicious event chains... BTP rules, which are based on MITRE ATT&CK tactics and techniques, are developed by the Palo Alto Networks research team." This describes the core of behavior-based detection.

3. Ucci, D., Aniello, L., & Baldoni, R. (2019). Survey of machine learning techniques for malware analysis. Computers & Security, 81, 123-147. Section 3.2 discusses dynamic/behavioral analysis methods that form the basis for AI-driven endpoint detection. https://doi.org/10.1016/j.cose.2018.11.001