AI Architecture
AI Components
ai_client.dll
WinHTTP-based API client for OpenAI-compatible endpoints. Handles API authentication, request formatting, and response parsing.
ai_action.dll
AI action execution module. Parses AI responses and executes appropriate security actions based on recommendations.
ai_web_search.dll
AI-powered web search for threat intelligence. Searches external knowledge bases for the latest threat information.
Knowledge Base & Memory Lookup
Core AI Capability: Self-Directed Knowledge Search
A key feature of TRAE Guardian's AI is its ability to autonomously search knowledge bases and memory to enhance threat detection. This is not a simple keyword match - the AI can:
- Search Knowledge Base: Query an internal knowledge base containing known threat patterns, malware signatures, and attack techniques
- Memory Lookup: Access historical data about previously detected threats, process behaviors, and user interactions
- Contextual Analysis: Combine real-time ETW log data with historical knowledge to identify emerging threats
- Pattern Recognition: Detect new threat patterns by comparing current behaviors against known attack signatures
Knowledge Base Features
Threat Intelligence Database
Contains information about known malware families, attack vectors, and indicators of compromise (IOCs). Updated regularly with the latest threat intelligence.
Behavior Pattern Matching
AI can search for specific behavior patterns in the knowledge base to identify known attack techniques being used by current processes.
Historical Memory
Stores information about previously detected threats, allowing the AI to recognize recurrence patterns and adapt its detection strategies.
Web Search Integration
When internal knowledge is insufficient, the AI can perform web searches to gather the latest threat intelligence from external sources.
Continuous Learning
New threat information gathered from detection events is added to the knowledge base, improving detection accuracy over time.
Real-time Query
AI can query the knowledge base during live threat detection to get instant insights about suspicious process behaviors.
AI Model & Configuration
🤖 AI Model
- Model: DeepSeek-R1-0528-Qwen3-8B
- Endpoint: SiliconFlow Cloud API
- Protocol: OpenAI-compatible API
- Key Management: XOR-encrypted API key storage
⚙️ AI Configuration
- AI Weight: Configurable impact on risk scoring
- Decay Time: Score decay rate per minute
- Recovery: Whether scores can recover over time
- Enabled: AI can be enabled/disabled per rule
AI Functions
Risk Evaluation
AiEvaluateSingleProcess(): Analyzes individual process behavior and assigns risk scores based on multiple factors including ETW logs, handle usage, and network activity.
Behavior Analysis
Long-term monitoring of suspicious process patterns. The AI tracks process activities over time to identify persistent threats and emerging attack patterns.
Threat Intelligence
AI-powered pattern recognition. Searches knowledge base for matches with known threat signatures and attack techniques.
Indirect Influence
AI provides indirect influence only. It adds AI scores to the risk assessment but does not directly execute termination commands. This prevents AI errors from causing system damage.
ETW Monitoring
AI only monitors ETW logs for analysis purposes. It does not have access to execute system commands or modify files directly.
Security Constraints
AI's capabilities are strictly limited to analysis and scoring. All execution actions are handled by the algorithmic response engine, ensuring safety and reliability.
AI Workflow
How AI Assists in Threat Detection
- ETW Log Collection: ETW monitor collects kernel-level event data
- Data Filtering: Relevant events are filtered and prepared for AI analysis
- Knowledge Base Query: AI searches internal knowledge base for matching threat patterns
- Memory Lookup: Historical threat data is retrieved for contextual analysis
- Risk Evaluation: AI assigns risk scores based on combined analysis
- Score Integration: AI scores are integrated with algorithmic scores
- Response Decision: Rule engine determines appropriate response based on total score
Important AI Constraints
✅ Safety First
- AI does NOT execute termination commands
- AI only adds scores to risk assessment
- Execution handled by algorithmic response engine
- AI only monitors ETW logs
🔒 Security Boundaries
- No direct file access
- No registry modification
- No process termination
- Read-only access to system information
⚠️ AI is designed as an enhancement to the algorithmic detection engine, not a replacement. Critical security decisions are always made by deterministic rules.