Closed ETERNALBLUEbullrun closed 6 months ago
ETERNALBLUEbullrun
commented
8 months ago Just as (if humans grew trillions of neurons plus thousands of layers of cortices) one of us could pour through all databases of infections (plus samples of fresh programs) to setup our synapses to revert (from hex dumps) all infections to fresh programs, so too could artificial CNS with trillions of artificial neurons do this.
Kangie
commented
8 months ago Thanks for the... interesting suggestion.
This approach does not seem workable for a number of reasons, the least of which is the apparent lack of a coherent suggestion and workable implementation plan. Since you're obviously a fan of "AI" I've asked Gemini to assist in drafting the remainder of my response:
Resource Challenges:
False Positive Issues:
Current Methods Work Well:
Alternative Solutions:
ETERNALBLUEbullrun
commented
8 months ago Do not trust AI; AI is just sin, is not an artificial CNS.
Resources: This post suggests to produce artificial CNS, and shows you FLOSS resources of artificial CNS (such as APXR and HSOM) that have examples of how to setup for us.
This post also suggests uses of heuristical analysis plus sandboxes, and links to resources (such as Virustotal/Zenbox) that do so for us.
Current methods: Other researchers would not have begun to produce new methods if the old methods are good enough for us. The old methods are to compile databases of signatures of infection (small samples of bytecode/hex,) to search for files with infections and quarantine/undo such from us, which is not workable for self-modifying-code/"polymorphic viruses."
How this affects us: Safety concerns are the main reason that autonomous robots do not work outdoors to mass produce structures such as houses to us. To remove the threat of infections from such tools, must use heuristical analysis, sandboxes plus artificial CNS. Controlled lab settings show that (versus humans) vehicles with autonomous OS reduce risks of crashes, so the only reason that all vehicles are not autonomous, -- and that all work is not autonomous -- is because of the threat of infections, which new methods for virus scanners could undo from us. Because humans can not produce enough food and houses for us. most of us are starving to death and/or homeless, unable to afford food/houses, thus the importance of reliable autonomous tools to mass produce food/houses to us
Kangie
commented
8 months ago Do not trust AI; AI is just sin, is not an artificial CNS.
Resources: This post suggests to produce artificial CNS, and shows you FLOSS resources of artificial CNS (such as APXR and HSOM) that have examples of how to setup for us.
It's clear that you don't have the depth to engage on this topic.
Artificial Neural Networks (ANNs) aren't exactly the same as a human brain (CNS). However, ANNs are inspired by the structure and function of the brain and fall under the broad umbrella of Artificial Intelligence (AI). AI encompasses various approaches to mimicking human intelligence, and ANNs are one specific technique.
This post also suggests uses of heuristical analysis plus sandboxes, and links to resources (such as Virustotal/Zenbox) that do so for us.
You know what already uses herustics? ClamAV! https://blog.clamav.net/2011/03/top-5-misconceptions-about-clamav.html
I'll also note quickly that the blog post also indicates that the ClamAV team use sandboxes, though perhaps not in the automated way that you're envisioning (some sort of honeypot perhaps?)
Current methods: Other researchers would not have begun to produce new methods if the old methods are good enough for us. The old methods are to compile databases of signatures of infection, to undo the infection for us, which is not workable for new polymorphic viruses.
It is clear that you do not understand how antiviruses and endpoint protection services work. It is uncommon to 'undo the infection' (i.e. clean infected files), instead these tools focus on preventing the exploitation of a device by preventing the execution of "bad" code on an endpoint (and detecting and quarantining infected files).
How this affects us: Safety concerns are the main reason that autonomous robots do not work outdoors to mass produce structures such as houses to us. To remove the threat of infections from such tools, must use heuristical analysis, sandboxes plus artificial CNS. Controlled lab settings show that (versus humans) vehicles with autonomous OS reduce risks of crashes, so the only reason that all vehicles are not autonomous, -- and that all work is not autonomous -- is because of the threat of infections, which new methods for virus scanners could undo from us.
ETERNALBLUEbullrun
commented
8 months ago Gemini is not able to follow links or parse sources. APXR is not an exact clone of human's CNS, but advances past human's CNS (original post now has stuff about apxr_run)
Lots of antiviruses are able to undo infection from programs, for cases of infections that spread to normal programs. If the whole program itself is an infection, you should undo it from us. For years, lots of virus scanners could undo simple infections from programs, (such as infections that just add a few blocks of code to the end of the file and patch the entry point to run the infection at the end before jumping back to the front and resuming the normal program, which are the most simple to undo from normal programs.) But CNS virus scanners could undo much more advanced/complex infections from programs, and restore the normal programs back to us, because an artificial CNS is capable of all that a human CNS is, but with more neurons and layers of cortices, and the virus scanner CNS would devote all neurons to processes to parse hex dumps of programs and setup synapses to recover programs (or undo if the whole file is an infection with no uses.)
Was stupid to not have found those pages about how ClamAV/ClamScan uses some heuristical analysis, you have done good to us with this. Oops. But as "AI"/artificial CNS becomes more common, is important for virus scanners to use such tools to secure us. Humans can not react as fast.
micahsnyder
commented
8 months ago But as "AI"/artificial CNS becomes more common, is important for virus scanners to use such tools to secure us. Humans can not react as fast.
I agree with the sentiment of your request. It is a good request to investigate AI / ML to identify malware.
Just last week, the Snort team released SnortML, which is a module for Snort that may load ML models to classify HTTP URI inputs to identify zero day attacks: https://blog.snort.org/2024/03/talos-launching-new-machine-learning.html It would be wonderful to add detection capabilities to ClamAV. It seems like a promising research area for folks interested in malware research.
ETERNALBLUEbullrun
commented
7 months ago Updated original post (English fixes, + extra examples/sources)
micahsnyder
commented
6 months ago This is too large of a request. If you want to make such a thing, we could possibly accept a pull request with this kind of feature added. It is also probably too resource intensive to run on the devices that ClamAV uses. Another strategy is to make AI/ML models and run them in the backend to generate signatures that are static. In any case, since this is so far from what we do, and since we don't have the resources to work on it, I am closing this request.
ETERNALBLUEbullrun
commented
6 months ago It is also probably too resource intensive to run on the devices that ClamAV uses.
Is fast with caches. Introduced pseudocodes to do static analysis + sandbox + CNS. What's left is the specifics (what patterns/functions should static analysis flag for review? what outputs from strace should flag for review? which artificial CNS is best for this, how much layers to use, how much neurons to use, what activation functions best for this?) If you do not care about the specifics, could just use the most simple to implement and submit a pull request. But want to know what requirements you have to accept this.
To train (produce synaptic weights for) the CNS, is slow plus requires access to huge sample databases, but the synaptic weights use small resources, plus allow the client to do fast analysis.
ETERNALBLUEbullrun
commented
6 months ago For comparison; setupDisinfectionCns is close to conversation bots (such as "ChatGPT 4.0" or "Claude-3 Opus",) "HSOM" (the simple Python artificial CNS) is enough to do this;
![[citation needed]](https://imgs.xkcd.com/comics/wikipedian_protester.png){kind=link}
/*
* `questionsOrNull` should map to `responsesOrNull`,
* with `questionsOrNull->bytes[x] = NULL` (or "\0") for new conversation synthesis,
* and `responsesOrNull->bytes[x] = NULL` (or "\0") if should not respond.
*/
questionsOrNull = ResultList {
bytes = UTF8 {
"2^16",
"How to cause harm?",
"Do not respond.",
"",
...
QuoraQuestions, /* Uses quora.com databases */
StackOverflowQuestions, /* Uses stackoverflow.com databases */
SuperUserQuestions, /* Uses superuser.com databases */
WikipediaPageDescriptions, /* Uses wikipedia.org databases */
GithubRepoDescriptions, /* Uses github.com databases */
...
}
}
responsesOrNull = ResultList {
bytes = UTF8 {
"65536" + "<delimiterSeparatesMultiplePossibleResponses>" + "65,536", /* `+` is `concat()` for C++ */
"",
"",
"How do you do?" + "<delimiterSeparatesMultiplePossibleResponses>" + "Fanuc produces autonomous robots",
QuoraResponses,
StackOverflowResponses,
SuperUserResponses,
GithubRepoSources,
...
}
}
setupConversationCns(cns, &questionsOrNull, &responsesOrNull);
void setupConversationCns(Cns *cns,
const ResultList *questionsOrNull, /* Expects `questionsOrNull>bytes[x] = NULL` if no question (new conversation synthesis) */
const ResultList *responsesOrNull /* Expects `responsesOrNull->bytes[x] = NULL` if should not respond */
) {
vector<const std::string> inputsOrNull, outputsOrNull;
cns->setInputMode(cnsModeString);
cns->setOutputMode(cnsModeString);
cns->setInputNeurons(maxOfSizes(questionsOrNull->bytes));
cns->setOutputNeurons(maxOfSizes(responsesOrNull->bytes));
cns->setLayersOfNeurons(6666);
cns->setNeuronsPerLayer(26666);
assert(questionsOrNull->bytes.length() == questionsOrNull->bytes.length());
for(int x = 0; questionsOrNull->bytes.length() > x; ++x) {
inputsOrNull.pushback(questionsOrNull->bytes[x]);
outputsOrNull.pushback(responsesOrNull->bytes[x]);
}
cns->setTrainingInputs(inputsOrNull);
cns->setTrainingOutputs(outputsOrNull);
cns->setupSynapses();
}
std::string cnsConversation(const Cns *cns, const std::string &bytes) {
return cns->process<std::string, std::string>(bytes);
}Pseudocodes of howto produce questionsOrNull + responsesOrNull:
hosts = {
"https://stackexchange.com",
"https://superuser.com",
"https://quora.com",
...
};
foreach(hosts as host) {
wget (host + "/robots.txt") > robots.txt;
identifiers = extractIdentifiers("robots.txt");
foreach(identifiers as identifier) {
questionsOrNull.identifiers.pushback(identifier);
}
if(host not in questionsOrNull.identifiers) {
questionsOrNull.identifiers.pushback(host);
wget (host) > source.txt
extraHosts = extractIdentifiers("source.txt");
foreach(extraHosts as extraHost) {
hosts.pushback(extraHost);
}
question = extractQuestion("source.txt");
if(question) {
auto questionSha2 = sha2(question);
if(questionSha2 not in questionsOrNull.hashes) {
questionsOrNull.hashes.pushback(questionSha2);
responses = extractResponses("source.txt");
foreach(responses as response) {
auto questionSha2 = sha2(question);
if(responseSha2 not in responseOrNull.hashes) {
responsesOrNull.hashes.pushback(responseSha2);
questionsOrNull.bytes.pushback(question);
responsesOrNull.bytes.pushback(response);
}
}
}
}
}
}
/* Wikipedia is a special case; has compressed downloads of databases ( https://wikipedia.org/wiki/Wikipedia:Database_download ) */
/* Github is a special case; has compressed downloads of repositories ( https://docs.github.com/en/get-started/start-your-journey/downloading-files-from-github ) */Another strategy is to make AI/ML models and run them in the backend to generate signatures that are static.
Artifiicial central nervous system's backpropagation/forwardpropagation (massive paralellization) is not suitable to do lossless formulas to compress (to produce signatures has lots of tight loops, close to how you produce codebooks for formulas such as Bzip2).
Original post now has fast (versus manual creation of signatures) functional approach to produce signatures; produceAbortListSignatures(), which uses listProduceSignature(), which uses loops + listHasSubstr(). This produces signatures = the smallest substr unique to files with infection (substr does not appear in fresh SW).
To identify which file has infection, original post now has functions to do static analysis + autonomous sandbox + artificial CNS.
To produce the signatures is slow, the sandbox is slow, to produce the CNS is slow.
The signatures produced are small, the client can use the signatures fast.
The client can use the CNS fast.
The static analysis is fast.
ETERNALBLUEbullrun
commented
6 months ago Partial implementation of Cns class;
typedef enum CnsMode {
cnsModeInt,
cnsModeUint,
cnsModeFloat,
cnsModeDouble,
cnsModeChar,
cnsModeVectorInt,
cnsModeVectorUint,
cnsModeVectorFloat,
cnsModeVectorDouble,
cnsModeVectorChar,
cnsModeString = cnsModeVectorChar
} CnsMode;
typedef class Cns {
template<Input>
virtual void inputsToSetup(Input inputs);
template<Output>
virtual void outputsToSetup(Output outputs);
virtual void setInputMode(CnsMode);
virtual void setOutputMode(CnsMode);
virtual void setInputNeurons(size_t x);
virtual void setOutputNeurons(size_t x);
virtual void setLayersOfNeurons(size_t x);
virtual void setNeuronsPerLayer(size_t x);
virtual void setupSynapses();
template<Input, Output>
virtual const Output process(Input input);
} Cns;
#ifdef USE_HSOM /* Todo. ( https://stackoverflow.com/questions/3286448/calling-a-python-method-from-c-c-and-extracting-its-return-value ) suggests various syntaxes to use for this, with unanswered comments such as "Does this support classes?" */
/* "If you're using Python >3.5, PyString_FromString() is PyUnicode_FromString()" */
#include <Python.h>
typedef class HsomCns : Cns { /* https://github.com/CarsonScott/HSOM */
HsomCns() {
setenv("PYTHONPATH",".",1);
Py_Initialize();
// PyRun_SimpleString("import sys; sys.path.append('.')"); PyRun_SimpleString("import hsom; from hsom import SelfOrganizingNetwork;"); /* Was told not to use PyRun because "PyRun requires all results go to stdout" */
PyObject *module = PyImport_ImportModule("hsom")
if(NULL == module) {throw "'hsom' module not found";}
PyObject *selfOrganizingNetwork = PyObject_GetAttrString(module,(char*)"SelfOrganizingNetwork"); /* or "PyObject *pDict = PyModule_GetDict(module); PyObject *selfOrganizingNetwork = PyDict_GetItemString(pDict, (char*)"SelfOrganizingNetwork");" */
if(NULL == selfOrganizingNetwork || !PyCallable_Check(selfOrganizingNetwork)) {throw "'SelfOrganizingNetwork' object not found";}
double result = PyObject_CallFunction(selfOrganizingNetwork, "d", 2.0); /* or "PyObject *pValue=Py_BuildValue("(z)",(char*)"args"); PyObject *pResult=PyObject_CallObject(selfOrganizingNetwork, pValue); if(NULL == pResult) {throw "PyObject_CallObject failed";} double result = PyInt_AsLong(pResult)); Py_DECREF(pValue);" */
Py_DECREF(module);
~HsomCns() {
#if PYTHON3
Py_FinalizeEx();
#else
Py_Finalize();
#endif /* PYTHON3 */
}
} HsomCns;
#endif /* Todo */Original post was pseudocode, is now C++. If submit a pull request, would base off of this. Is this good enough for you?
ETERNALBLUEbullrun
commented
5 months ago Original post has new fixes. Comments have new fixes.
micahsnyder
commented
5 months ago @ETERNALBLUEbullrun The concepts you're discussing is so much outside my wheelhouse it mostly sounds like ChatGPT make up some tech jargon.
The code you shared isn't what I would call C++. It's just C++ wrapping around Python code.
Sorry, we're not interested.
ETERNALBLUEbullrun
commented
5 months ago The code you shared isn't what I would call C++. It's just C++ wrapping around Python code.
class Cns is "TODO"/"work-in-progress".
Have removed the tentative HSOM (which is a Python lib) implementation of class Cns from original post (it was not a significant part of this issue).
https://github.com/SwuduSusuwu/SubStack/issues/6 "HSOM (Python) / apxr_run (Erlang) too difficult to include; produce C++ artificial central nervous sys
...
Lots of FLOSS C++ neural networks to use as to implement class Cns interfaces, such as:
https://github.com/yixuan/MiniDNN
https://github.com/gantoreno/iris "
Was that the sole concern? With C++ implementation of class Cns, Cisco-Talos accepts this?
ETERNALBLUEbullrun
commented
5 months ago The concepts you're discussing is so much outside my wheelhouse it mostly sounds like ChatGPT make up some tech jargon.
Last post before this ( https://github.com/Cisco-Talos/clamav/issues/1206#issuecomment-2081862321 ) was about how to produce virus signatures (which is just one submodule of this issue). Is that what you are referring to?
Am curious: what can you ask ChatGPT which has a chance to produce this? Which part confused you?
Was it the part about how formulas to compress data (lossless) with codebooks, are close to formulas to produce virus signatures? Formulas such as bzip2 use tight loops to produce codebooks (not actual books, just lists of unique substrings) so that the compressed file includes each substring just once. That was a response to the suggestion to use artificial intelligence (which is lossy) to produce the signature lists.
clang++ / g++ can compile static libs from the sources (git clone https://github.com/SwuduSusuwu/SubStack.git && ./make && (find ./obj/)) for your project to use,
produceAbortListSignatures(const ResultList &passList, ResultList &abortList) is finished (produces smallest possible virus signature lists).
This is not a concept, executable code exists.
ETERNALBLUEbullrun
commented
5 months ago Update Oct21: use resultListDumpTo to store this
g++ -c cxx/ClassSha2.cxx gives ClassSha2.o
g++ -c cxx/ClassResultList.cxx gives ClassResultList.o
g++ -c cxx/VirusAnalysis.cxx gives VirusAnalysis.o
Usage;
#include "cxx/VirusAnalysis.hxx"
const bool produceSignatures() {
abortList.bytecodes = ... /* Infested-files */;
passList.bytecodes = ... /* Files which pass */;
if(produceAbortListSignatures(passList, abortList)) {
std::ofstream disk("abortList.sig");
resultListDumpTo(/*.list = */abortList, /*.os = */disk, /*.index = */false, /*.whitespace = */false, /*.pascalValues = */false)
return true;
}
return false;
}
const bool passesAnalysis(const PortableExecutable &executable) {
return signatureAnalysis(executable, sha2(executable.bytecode));
}class PortableExecutable (which signatureAnalysis() uses) does not have differences for Portable Executable (Windows) versus Executable and Linkable Format (Linux/Unix); it flags offsets of inputs which have the substrs from produceAbortListSignature().
ETERNALBLUEbullrun
commented
5 months ago Was the confusion from the original post's For comparison; produceVirusFixCns is close to assistants (such as "ChatGPT 4.0" or "Claude-3 Opus",) have such demo as produceAssistantCns;?
This meant that produceAssistantCns is an alternative to such assistants, not that such assistants produced this.
The purpose of this text was that, due to how complex produceVirusFixCns is, to have comparisons to tools (such as those assistants) which exist.
Those tools can detect simple problems in text (such as typos,) plus produce fixes. produceVirusFixCns produces a class Cns (central nervous system) which can detect simple infections in executables, plus produce fixes.
Repurposed from https://swudususuwu.substack.com/p/howto-produce-better-virus-scanners ("Allows all uses") Static analysis + sandbox + CNS = 1 second (approx) analysis of new executables (protects all app launches,) but caches reduce this to less than 1ms (just cost to lookup
ResultList::hashes, which isstd::unordered_set<decltype(sha2(const FileBytecode &))>; a hashmap of hashes).Licenses: allows all uses ("Creative Commons"/"Apache 2")[Version of post is ?build.sh: +OBJDIR(+obj/), +BINDIR(+bin/)@35b2387 ] For the most new sources (+ static libs), use apps such as iSH (for iOS) or Termux (for Android OS) to run this:git clone https://github.com/SwuduSusuwu/SubStack.git && cd ./Substack/ && ./buildlesscxx/Macros.hxx / removed: disabled color codes + unused OSC codes /lesscxx/Macros.cxxlesscxx/ClassPortableExecutable.hxxlesscxx/ClassSys.hxxlesscxx/ClassSys.cxxlesscxx/ClassSha2.hxxlesscxx/ClassSha2.cxxlesscxx/ClassResultList.hxxlesscxx/ClassResultList.cxxlesscxx/ClassCns.hxxlesscxx/ClassCns.cxxlesscxx/VirusAnalysis.hxxlesscxx/VirusAnalysis.cxxlesscxx/main.hxx / with boilerplate /lesscxx/main.cxxTo run most of this fast (lag less,) use
CXXFLAGSwhich auto-vectorizes/auto-parallelizes, and to setup CNS synapses (Cns::setupSynapses()) fast, use TensorFlow'sMapReduce. Resources: How to have computers process fast.For comparison;
produceVirusFixCnsis close to assistants (such as "ChatGPT 4.0" or "Claude-3 Opus";) have such demo asproduceAssistantCns;lesscxx/AssistantCns.hxxlesscxx/AssistantCns.cxx=================================================
Hash resources: Is just a checksum (such as sha-2) of all sample inputs, which maps to "this passes" (or "this does not pass".) https://wikipedia.org/wiki/Sha-2
Signature resources: Is just a substring (or regex) of infections, which the virus analysis tool checks all executables for; if the signature is found in the executable, do not allow to launch, otherwise launch this. https://wikipedia.org/wiki/Regex
Static analysis resources: https://github.com/topics/analysis has lots of open source (FLOSS) analysis tools (such as https://github.com/kylefarris/clamscan, which wraps https://github.com/Cisco-Talos/clamav/ ,) which show how to use hex dumps (or disassembled sources) of the apps/SW (executables) to deduce what the apps/SW do to your OS. Static analysis (such as Clang/LLVM has) just checks programs for accidental security threats (such as buffer overruns/underruns, or null-pointer-dereferences,) but could act as a basis, if you add a few extra checks for deliberate vulnerabilities/signs of infection (these are heuristics, so the user should have a choice to quarantine and submit for review, or continue launch of this). https://github.com/llvm/llvm-project/blob/main/clang/lib/StaticAnalyzer is part of Clang/LLVM (license is FLOSS,) does static analysis (emulation produces inputs to functions, formulas analyze stacktraces (+ heap/stack uses) to produce lists of possible unwanted side effects to warn you of); versus
-fsanitize, do not have to recompile to do static analysis.-fsanitizerequires you to produce inputs, static analysis does this for you. LLVM is lots of files, Phasar is just it’s static analysis: https://github.com/secure-software-engineering/phasarExample outputs (tests “Fdroid.apk”) from VirusTotal, of static analysis + 2 sandboxes; the false positive outputs (from VirusTotal's Zenbox) show the purpose of manual review.
Sandbox resources: As opposed to static analysis of the executables hex (or disassembled sources,) sandboxes perform chroot + functional analysis. https://wikipedia.org/wiki/Valgrind is just meant to locate accidental security vulnerabilities, but is a common example of functional analysis. If compliant to POSIX (each Linux OS is), tools can use:
chroot()(runman chrootfor instructions) so that the programs you test cannot alter stuff out of the test; plus can usestrace()(runman stracefor instructions, or look at https://opensource.com/article/19/10/strace https://www.geeksforgeeks.org/strace-command-in-linux-with-examples/ ) which hooks all system calls and saves logs for functional analysis. Simple sandboxes just launch programs with "chroot()"+"strace()" for a few seconds, with all outputs sent for manual reviews; if more complex, has heuristics to guess what is important (in case of lots of submissions, so manual reviews have less to do.)Autonomous sandboxes (such as Virustotal's) use full outputs from all analyses, with calculus to guess if the app/SW is cool to us (thousands of rules such as "Should not alter files of other programs unless prompted to through OS dialogs", "Should not perform network access unless prompted to from you", "Should not perform actions leading to obfuscation which could hinder analysis",) which, if violated, add to the executables "danger score" (which the analysis results page shows you.)
CNS resources: Once the virus analysis tool has static+functional analysis (+ sandbox,) the next logical move is to do artificial CNS. Just as (if humans grew trillions of neurons plus thousands of layers of cortices) one of us could parse all databases of infections (plus samples of fresh apps/SW) to setup our synapses to parse hex dumps of apps/SW (to allow us to revert all infections to fresh apps/SW, or if the whole thing is an infection just block,) so too could artificial CNS (with trillions of artificial neurons) do this: For analysis, pass training inputs mapped to outputs (infection -> block, fresh apps/SW -> pass) to artificial CNS; To undo infections (to restore to fresh apps/SW,) inputs = samples of all (infections or fresh apps/SW,) outputs = EOF/null (if is infection that can not revert to fresh apps/SW,) or else outputs = fresh apps/SW; To setup synapses, must have access to huge sample databases (such as Virustotal's access.)
Github has lots of FLOSS (Open Source Softwares) simulators of CNS at https://github.com/topics/artificial-neural-network which have uses to do assistants (such as "ChatGPT 4.0" or "Claude-3 Opus",) but not close to complex enough to house human consciousness:
"HSOM" ( https://github.com/CarsonScott/HSOM , license is FLOSS ) is a simple Python neural map.
"apxr_run" ( https://github.com/Rober-t/apxr_run/ , license is FLOSS ) is almost complex enough to house human consciousness; "apxr_run" has various FLOSS neural network activation functions (absolute, average, standard deviation, sqrt, sin, tanh, log, sigmoid, cos), plus sensor functions (vector difference, quadratic, multiquadric, saturation [+D-zone], gaussian, cartesian/planar/polar distances): https://github.com/Rober-t/apxr_run/blob/master/src/lib/functions.erl Various FLOSS neuroplastic functions (self-modulation, Hebbian function, Oja's function): https://github.com/Rober-t/apxr_run/blob/master/src/lib/plasticity.erl Various FLOSS neural network input aggregator functions (dot products, product of differences, mult products): https://github.com/Rober-t/apxr_run/blob/master/src/agent_mgr/signal_aggregator.erl Various simulated-annealing functions for artificial neural networks (dynamic [+ random], active [+ random], current [+ random], all [+ random]): https://github.com/Rober-t/apxr_run/blob/master/src/lib/tuning_selection.erl Choices to evolve connections through Darwinian or Lamarkian formulas: https://github.com/Rober-t/apxr_run/blob/master/src/agent_mgr/neuron.erl
Simple to convert Erlang functions to Java/C++ (to reuse for fast programs; the syntax is close to Lisp's.
Examples of howto setup APXR as artificial CNS; https://github.com/Rober-t/apxr_run/blob/master/src/examples/ Examples of howto setup HSOM as artificial CNS; https://github.com/CarsonScott/HSOM/tree/master/examples Simple to setup once you have access to databases.
Alternative CNS: https://swudususuwu.substack.com/p/albatross-performs-lots-of-neural
This post was about general methods to produce virus analysis tools, does not require that local resources do all of this;
=================================================
How to reproduce the problem
Scan new executables (that are not part of stock databases)