NTT R&D s anti-malware technologies

Size: px

Start display at page:

Download "NTT R&D s anti-malware technologies"

Grant Carter
8 years ago
Views:

1 NTT R&D s anti-malware technologies Jan. 21, 2015 NTT Secure Platform Laboratories Takeo HARIU

2 Threats causes most of cyber attacks Major infection routes are web browsing, URL links in messages, attachment files, etc. URL link Users constant emergence of new malware Infection by web browsing McAfee Labs Threats Report Nov Infection by clicking web link Web browsing Exploiting / infection others 2

.. Users constant emergence of new malware Infection by web browsing Email http://.

3 NTT R&D s Anti-malware Technologies Detect/gather the latest attacks using sensors Analyze gathered data such as malware samples Construct an intelligence database of threat information Implement countermeasures such as access filtering Web client type Web server type Android crawler Reputation / Profiling NTT R&D attack sensors Collected data files result dynamic Intelligence Database RELIEF 悪性サイトURL 攻撃元 Time series data of 攻撃コード Malicious マルウェア web sites 検体 Sources 悪 of 性 attacks アプリ Exploiting 等の codes 時系列データ files communications 3

type Android crawler Reputation / Profiling NTT R&D attack sensors Collected data files result dynamic Intelligence Database RELIEF 悪性

NTT R&D s Anti-malware Technologies Detect/gather the latest attacks using sensors Analyze gathered data such as malware samples Construct an intelligence database of threat information Implement

4 NTT R&D s Anti-malware Technologies Detect/gather the latest attacks using sensors Analyze gathered data such as malware samples Construct an intelligence database of threat information Implement countermeasures such as access filtering Web client type Web server type Android crawler Reputation / Profiling NTT R&D attack sensors Collected data files result dynamic Intelligence Database RELIEF 悪性サイトURL 攻撃元 Time series data of 攻撃コード Malicious マルウェア web sites 検体 Sources 悪 of 性 attacks アプリ Exploiting 等の codes 時系列データ files communications 4

Web Client Type Honeypot A decoy web crawler which detects attacks to web browser vulnerabilities Crawls web sites, finds malicious web sites with exploiting codes or malware files, specifies

5 Web Client Type Honeypot A decoy web crawler which detects attacks to web browser vulnerabilities Crawls web sites, finds malicious web sites with exploiting codes or malware files, specifies attacks, and collects malware files Highly parallelized OSes and browsers make it possible to crawl many web sites Malicious site Crawling Web client type s Exploiting code downloading Web space in the OS (virtual machine) Web browser (process) 5

malware files Highly parallelized OSes and browsers make it possible to crawl many web sites Malicious site

6 NTT R&D s Anti-malware Technologies Detect/gather the latest attacks using sensors Analyze gathered data such as malware samples Construct an intelligence database of threat information Implement countermeasures such as access filtering Web client type Web server type Android crawler Reputation / Profiling NTT R&D attack sensors Collected data files result dynamic Intelligence Database RELIEF 悪性サイトURL 攻撃元 Time series data of 攻撃コード Malicious マルウェア web sites 検体 Sources 悪 of 性 attacks アプリ Exploiting 等の codes 時系列データ files communications 6

information such as attacker s C&C servers, malware distribution sites Analysis environment malware

7 Dynamic Analysis Some malware acts communicating with attacker s C&C servers, so malware dynamic in environment is important Analyze malware behavior safely by using Fake Extract malware-related hosts information such as attacker s C&C servers, malware distribution sites Analysis environment malware Controls communications with benign users Benign sites Malicious sites Fake Fake generates fake responses 7

8 NTT R&D s Anti-malware Technologies Detect/gather the latest attacks using sensors Analyze gathered data such as malware samples Construct an intelligence database of threat information Implement countermeasures such as access filtering Web client type Web server type Android crawler Reputation / Profiling NTT R&D attack sensors Collected data files result dynamic Intelligence Database RELIEF 悪性サイトURL 攻撃元 Time series data of 攻撃コード Malicious マルウェア web sites 検体 Sources 悪 of 性 attacks アプリ Exploiting 等の codes 時系列データ files communications 8

alerting infected users or falsified web administrators Honeypots Network monitoring Operator Usage scenes

9 Security Intelligence DB RELIEF Analyze collected time-series data taking with various viewpoint such as nations, vulnerabilities Apply to countermeasures such as blocking malicious communications by using blacklists, alerting infected users or falsified web administrators Honeypots Network monitoring Operator Usage scenes Analysis Administrator Falsified site Security intelligence DB RELIEF Blocking malicious communications Cooperation with SIEM 9

10 Thank you! 10

Anti-Malware Technologies

: Trend of Network Security Technologies Anti-Malware Technologies Mitsutaka Itoh, Takeo Hariu, Naoto Tanimoto, Makoto Iwamura, Takeshi Yagi, Yuhei Kawakoya, Kazufumi Aoki, Mitsuaki Akiyama, and Shinta