Technology

AI Auto-Classifi­cation

AI analyzes blocked programs and automatically adds the safe ones to the trust list

At least

95%

less manual management

Auto-whitelisted (AI Auto-Classification)Manual management

With conventional whitelisting, every process has to be managed manually, but DocStory's AI Auto-Classification Engine cuts manual management by 95% or more.

AI Verdict

AI Gives Blocked Programs a Second Look

Programs that are not on the trust list are blocked first. AI then analyzes their executables and adds only the safe ones to the trust list.

  1. 01Blocking

    When a program that is not on the trust list tries to modify a document, the driver blocks it first.

  2. 02Feature Extraction

    DocStory extracts 2,381 EMBER-format features from the blocked program's executable.

  3. 03AI Score

    A LightGBM model scores the program from 0 to 1 based on how likely it is to be malicious.

  4. 04Verdict

    • Auto-added to trust listreport_gen.exe
    • Stays blocked · reported to serverinvoice.pdf.exe

    Programs at or below the threshold are added to the trust list automatically; those above it stay blocked and are reported.

AI auto-classification flow. Step 1, Blocking: when a program that is not on the trust list (for example, report_gen.exe or invoice.pdf.exe) tries to modify a document, the driver blocks it first. Step 2, Feature extraction: DocStory extracts 2,381 EMBER-format features from the blocked program's executable, including the byte histogram, entropy, PE header and sections, imported functions and string statistics. Step 3, AI score: a LightGBM model scores the program from 0 to 1 based on how likely it is to be malicious. In this example, report_gen.exe scores 0.04 and invoice.pdf.exe scores 0.97. Step 4, Verdict: report_gen.exe, at or below the threshold, is added to the trust list automatically and runs normally from then on, while invoice.pdf.exe, above the threshold, stays blocked and is reported to the management server.

  • Administrators Set the Threshold

    Administrators decide whether to use automatic registration and where to set the threshold score.

  • Files Seen Once Are Remembered

    The score for each executable is saved and recalculated only when the model changes.

Auto-Classification Engine

95%+ Less Manual Management

Windows components and programs with a valid digital signature are trusted automatically, and AI decides on the remaining unverified programs. Security stays at the same level; only the management burden is reduced.

Conventional whitelisting: manual management zone
OS processes
Commercial software
processes
Other
processes
DocStory automatic whitelist management zone
(AI Auto-Classification Engine)
DocStory
manual management zone
With conventional whitelisting, OS processes, commercial software processes and other processes all fall within the manual management zone. DocStory manages OS and commercial software processes automatically with its AI Auto-Classification Engine, leaving only other processes in the manual management zone.

Model Training

A Freshly Trained Model Every Month

The model is retrained every month on newly emerged ransomware samples, and the new model is deployed to the agents.

  1. 01

    Sample Collection

    Newly emerged ransomware samples are collected.

  2. 02

    Feature Extraction

    Each sample is converted into 2,381 EMBER-format features.

  3. 03

    Retraining

    The model is retrained with LightGBM.

  4. 04

    Deployment

    Agents switch to the new model without restarting.

Every month, newly emerged ransomware samples are collected and converted into 2,381 EMBER-format features, and the AI model is retrained with LightGBM and deployed to the agents. The agents switch to the new model without restarting.

Blocking itself is driven by the whitelist, so even on closed (air-gapped) networks that receive no model updates, the level of protection stays the same.

FAQ

View More
Whitelist solutions are known for the hassle of registering countless processes one by one. Has that been solved?

Windows processes and processes with a valid digital signature are whitelisted automatically by the engine, so most processes used on a PC never need to be registered. Only the few processes that pose a security risk have to be managed. We have cut the heavy management load, the main drawback of whitelist solutions, by more than 90%.

Can exceptions be made for unauthorized processes that are not on the whitelist?

Yes. Administrators can grant exceptions for unauthorized processes.

Who adds processes to the whitelist, users or administrators?

Only administrators can add them. Once added, a process is applied to the agents as whitelisted right away. With AI auto-classification turned on, blocked programs that the AI judges to be safe are added automatically (administrators can turn this off).

Learn More

Preemptive BlockingBlocks unauthorized processes before they can reach protected dataSelf-ProtectionMeets integrity, confidentiality and availability tests under Korean national evaluation criteriaDocStoryA new kind of ransomware protection unlike anything you have used before

Get in Touch

Leave us a message and our team will get back to you as soon as possible.

Contact Us+82-2-407-0680