NTT R&D s anti-malware technologies Jan. 21, 2015 NTT Secure Platform Laboratories Takeo HARIU
Threats causes most of cyber attacks Major infection routes are web browsing, URL links in email messages, attachment files, etc. URL link http://... Users constant emergence of new malware Infection by web browsing Email http://... McAfee Labs Threats Report Nov. 2014 Infection by clicking web link Web browsing Exploiting / infection others http://www.mcafee.com/us/resources/reports/rp-quarterly-threat-q3-2014.pdf?cid=bhp032 2
NTT R&D s Anti-malware Technologies Detect/gather the latest attacks using sensors Analyze gathered data such as malware samples Construct an intelligence database of threat information Implement countermeasures such as access filtering Web client type Web server type Android crawler Reputation / Profiling NTT R&D attack sensors Collected data files result dynamic Intelligence Database RELIEF 悪 性 サイトURL 攻 撃 元 Time series data of 攻 撃 コード Malicious マルウェア web sites 検 体 Sources 悪 of 性 attacks アプリ Exploiting 等 の codes 時 系 列 データ files communications 3
NTT R&D s Anti-malware Technologies Detect/gather the latest attacks using sensors Analyze gathered data such as malware samples Construct an intelligence database of threat information Implement countermeasures such as access filtering Web client type Web server type Android crawler Reputation / Profiling NTT R&D attack sensors Collected data files result dynamic Intelligence Database RELIEF 悪 性 サイトURL 攻 撃 元 Time series data of 攻 撃 コード Malicious マルウェア web sites 検 体 Sources 悪 of 性 attacks アプリ Exploiting 等 の codes 時 系 列 データ files communications 4
Web Client Type Honeypot A decoy web crawler which detects attacks to web browser vulnerabilities Crawls web sites, finds malicious web sites with exploiting codes or malware files, specifies attacks, and collects malware files Highly parallelized OSes and browsers make it possible to crawl many web sites Malicious site Crawling Web client type s Exploiting code downloading Web space in the OS (virtual machine) Web browser (process) 5
NTT R&D s Anti-malware Technologies Detect/gather the latest attacks using sensors Analyze gathered data such as malware samples Construct an intelligence database of threat information Implement countermeasures such as access filtering Web client type Web server type Android crawler Reputation / Profiling NTT R&D attack sensors Collected data files result dynamic Intelligence Database RELIEF 悪 性 サイトURL 攻 撃 元 Time series data of 攻 撃 コード Malicious マルウェア web sites 検 体 Sources 悪 of 性 attacks アプリ Exploiting 等 の codes 時 系 列 データ files communications 6
Dynamic Analysis Some malware acts communicating with attacker s C&C servers, so malware dynamic in environment is important Analyze malware behavior safely by using Fake Extract malware-related hosts information such as attacker s C&C servers, malware distribution sites Analysis environment malware Controls communications with benign users Benign sites Malicious sites Fake Fake generates fake responses 7
NTT R&D s Anti-malware Technologies Detect/gather the latest attacks using sensors Analyze gathered data such as malware samples Construct an intelligence database of threat information Implement countermeasures such as access filtering Web client type Web server type Android crawler Reputation / Profiling NTT R&D attack sensors Collected data files result dynamic Intelligence Database RELIEF 悪 性 サイトURL 攻 撃 元 Time series data of 攻 撃 コード Malicious マルウェア web sites 検 体 Sources 悪 of 性 attacks アプリ Exploiting 等 の codes 時 系 列 データ files communications 8
Security Intelligence DB RELIEF Analyze collected time-series data taking with various viewpoint such as nations, vulnerabilities Apply to countermeasures such as blocking malicious communications by using blacklists, alerting infected users or falsified web administrators Honeypots Network monitoring Operator Usage scenes Analysis Administrator Falsified site Security intelligence DB RELIEF Blocking malicious communications Cooperation with SIEM 9
Thank you! 10