Agentic Cyber Explorerby Fide AI · PreviewPreview
Chronicle/Defense & research

Microsoft's Project Ire agent autonomously reverse engineers and classifies malware

DefenseTool releaseSignificance assistant-drafted

Microsoft Research describes Project Ire, a prototype LLM agent that uses decompilers and binary analysis tools to reverse engineer software and classify it as malicious or benign, producing an auditable chain-of-evidence report. Microsoft reports 0.98 precision and 0.83 recall on a Windows driver dataset, but 0.26 recall on about 4,000 hard real-world files, and plans to deploy it in Defender as Binary Analyzer.

Why it matters

It is a rare defensive-agent announcement that publishes both strong and weak results, including low recall on hard samples.

Key facts

As stated in the sources, with where to find them.

  • Windows drivers dataset: precision 0.98, recall 0.83, 2% false positive rate.Evaluation section
  • About 4,000 'hard-target' real-world files: precision 0.89, recall 0.26, 4% false positive rate.Evaluation section
  • Microsoft says Project Ire was the first reverse engineer at Microsoft, human or machine, to author a conviction case for automatic blocking of a specific APT sample.Blog post
  • The prototype will be used in Defender as Binary Analyzer.Blog post, deployment note

Findings that cite this record

No tracked finding cites this record yet.

Sources

Related records