cyber.hendryadrian.com
Security News · crowdstrike.com

CrowdStrike Adds On-Device AI Classification to Falcon Data Security

· Original article ↗

Summary

CrowdStrike says Falcon Data Security will use compact language models on-device to classify sensitive content in real time, starting with Intel NPU-powered PCs. The approach aims to protect data without sending it off-device.

Key points

  • The capability classifies unstructured sensitive content, such as conversationally shared credentials, using language-model context in addition to rule-based patterns.
  • CrowdStrike and Intel optimized inference for Intel Core Ultra NPUs, aiming for sustained performance and lower power use during always-on endpoint protection.
  • Inference runs locally, avoiding the latency and privacy considerations of sending sensitive content to cloud services.
  • The endpoint sensor uses ONNX Runtime and an OpenVINO execution provider to run the model without a Python runtime.
  • CrowdStrike says its distilled, FP16-quantized model uses less than 5% of its teacher model's parameters while achieving similar classification efficacy.
  • The company describes extending the same model approach to Linux-based EC2 instances with NVIDIA GPUs and macOS through CoreML for Apple Neural Engine.

Article Details

Event Type
Product capability announcement
Impact
CrowdStrike Falcon Data Security adds on-device, language-model-based classification of sensitive data, initially using Intel NPUs. The capability is intended to support real-time protection while reducing reliance on cloud inference and avoiding sending sensitive data off-device. The article also describes support for cloud GPU deployments and plans to bring the capability to macOS.

Vendors

AppleWe are bringing the same experience to macOS through CoreML, Apple's native AI inference framework, targeting the Apple Neural Engine (ANE) directly.CrowdStrikeTo address this challenge, CrowdStrike worked closely with Intel to introduce a new capability in CrowdStrike Falcon® Data Security that classifies sensitive data using language models that run on-device using dedicatedIntelTo address this challenge, CrowdStrike worked closely with Intel to introduce a new capability in CrowdStrike Falcon® Data Security that classifies sensitive data using language models that run on-device using dedicatedNvidiaThe same model powers Falcon Data Security for Cloud on Linux-based EC2 instances with NVIDIA GPUs.

Products

Falcon Data SecurityCloud-based inference wasn't an option for endpoint security: Cloud latency introduces delays, and sending sensitive customer data off the device creates privacy considerations that Falcon Data Security strives to avoid.Falcon sensorIntel Core UltraTo understand the value of AI-accelerated hardware, we benchmarked inference latency on common documents across all three compute options on Intel Core Ultra 7 (Series 2) hardware:

Related Articles