I'm looking into WDAC and the option to use Microsoft's ISG for files that are not explicitly allowed or denied caught my interest. Unfortunately I haven't been able to find any information on what is sent to the ISG to make the known good/unknown/known bad decision. The MSDN page on the ISG just mentions it sends a hash, but it also claims the ISG isn't a list of known good programs but rather a complicated program using machine learning to make a decision.
These two points seem mutually exclusive -- what kind of machine learning analysis can you do on a hash given that changing a single bit in a file completely modifies the hash and there is no statistical correlation indicating what specific difference there is between two different hashes? The only thing I can think of that would do that would be something like ssdeep or another fuzzy hash, and even that seems to carry relatively little information. When I thought of ISG, I was thinking something more like genetic program analysis -- comparing code snippets for commonality between the provided program and other programs analyzed by the ISG.
Is there any information showing what specifically is sent to the ISG when WDAC/SmartScreen/whatever queries to see if a file is "reputable?"
