Smart Protection Network Raimund Genes, CTO
Overwhelmed by Volume of New Threats New unique samples added to AV-Test's malware repository (2000-2010) 20.000.000 18.000.000 16.000.000 14.000.000 12.000.000 10.000.000 8.000.000 6.000.000 4.000.000 Dec Nov Oct Sep Aug Jul Jun May Apr Mar Feb Jan 2.000.000 0 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Source: AV-Test.org
File Web E- Mail
Smart Protection Network Sourcing Processing & Analysis Validate & Create Solution Quality Assurance Solution Distribution Solution Adoption File Web / URL Email Domain IP File Reputation Service Web Reputation Service Email Reputation Service Smart Protection Customer SPN Correlation Community Intelligence (Feedback loop)
Correlation Fake news by email. One A compromised click in a link. web site EMAIL REPUTATION WEB REPUTATION FILE REPUTATION A fake video
Backend Operations Data Feeds Correlation Monitor & Trigger Systems
Big Data!
Email Reputation ER S Spam Samples Reputation Data Feedback Data Storage Clusters VM Clusters Query Logs New Threat Discovery
Email Reputation Spam Samples Reputation Data 50M/day SPN Infrastructure Query Logs Reputation Servers Honeypot 1TB/day Pattern Feedback Data Query 200M/day Costumers
Email Reputation Daily Service Capacity Data Sourcing Data Analytics Solution Delivery 50M Spam samples 180,000 Suspicious IPs 200M User s feedback 1TB Mail traffic logs 806TB Raw data 1B IP address reputation 278GB Sampling pool 668,000 Cloud entries 8,050 Signatures 130,000 New IP listing
Web Reputation
Web Reputation Statistics Data Sourcing 42 Sources (16-19 in Regularity) 11,000 Unique Feedbacks 8~10 Billion URL Queries Data Analyses 1 Billion URLs Analyzed 7.2 TB raw and condensed data for correlations and mining Solution Delivery 52,580,000 static patterns 20,000 new patterns 15~20 million infections blocked
File Reputation
Do we need to rethink IT Security?
+ GRID and MARS Goodware Ressource and Information Database Mobile Application Reputation Service
GRID
146.000.000 GRID - Largest Catalog of Goodware 1.268.808 1.400.000 145.000.000 144.808.694 1.200.000 144.000.000 143.000.000 998.996 876.703 144.118.367 143.175.756 942.611 912.480 871.183 142.304.573 1.000.000 800.000 142.000.000 Unique File 141.000.000 526.272141.035.765 690.327 600.000 Weekly Added Files 140.000.000 276.013139.597.013 140.123.285 400.000 139.000.000 138.720.310 138.444.297 200.000 138.000.000 Mar 1 Mar 8 Mar 15 Mar 22 Mar 29 Apr 5 Apr 12 Apr 19 Apr 26 2012 - (Bit 9 = 120M unique files)
File Reputation Rating GRID Access Layer Used by Deep Security 8 to provide File Integrity Monitoring, Deep Discovery 3, and DTAS 3 for file reputation Integrated with SPN Backend Services (ex. FLUSTR (for SPN feedback), Census (planned), etc.) GFR Service (formerly NFC look-up) 2 Billion queries per day from the following products CSM 5.0 CSM 5.1 "CSM 6.X(WFBS 6.X) "CSM 7.X(WFBS 7.X) Deep Security Deep Discovery HouseCall 7.1 PC-cillin 2007 PC-cillin 2008 PC-cillin 2009 PC-cillin Pro 2009 PC-cillin 2010 PC-cillin Pro 2010 TDME v2.1 Titanium 1.0 WFBS-SVC 3.01 Titanium 3.0 OSCE v10.x "Fake AntiVirus Remover 0.9() Titanium 5.0 CPM 10.5 DCE 6.0 Titanium 6.0
Application Control: Endpoint TMAC blocks Skype as its usage is not allowed within the company s usage policy
Big Picture TMAC Communication GRID (Goodware Resources and Information Database) HTTP / SOAP Live Information / Translations TMAC Server (PLS) HTTP / Zipped / Encryped XML Incremental & channel based updates Customer Network Pull HTTP/S + GZIP Mime based protocol TMAC Agent (PLS) Push (PLS) Pull
Application Control: GRID Backend
ISP s, Telcos, Providers:
Mobile App Reputation 1. Collects Apps and scans them in the cloud 3. Correlates web queries with Smart Protection Network 2. Static Analysis: Dissects app code and private data access. Generates reputation scores and detailed report 4. Dynamic Analysis: Activates app to analyze actual behaviour
New in v2.1 Private Data Leak Protection Analyses App Behaviour Determines if it collects private information; IMEI Contacts Messages Photos Location Microphone Keyboard Input Determines if it sends it off the device; SMS or Internet NOTE: This is different to other privacy solutions that purely dissect the permissions an app requests. Mobile App Reputation Technology uses Data-taint technology to track private data accessed by an app and monitor its usage.
Trend Micro Mobile App Reputation Service Trend Micro Mobile App Reputation Service is a cloud based service that dynamically tests mobile applications for malicious activity, resource usage and privacy violations. It enables app store providers to block infected apps and provide customers with an enhanced app discovery experience. Cloud Service Dynamically Scans Apps Integrates with App Store Managed by Trend Micro No Infrastructure Cost Reduce Staff Cost Always available Monitors App Behaviour Detects Malware, Private Data Theft, Resource Abuse Remove bad apps Improved app discovery Customers can have a delightful experience World Leader in Cloud Security 22+ years of security expertise Correlates with Smart Protection Network
The Service Web Upload FTP Crawler Report is provided HTML Appstore removes bad apps and adds detailed info to app listings Appstore submits new apps Apps are scanned XML EMAIL
Benefits the ecosystem App Store Developer Consumer Ensures all apps are safe, provides more detailed search information to user, no infrastructure or expertise required Only competes with high quality, safe apps & apps can be found more easily based on more detailed criteria. Is assured that apps they are downloading are safe and that they can make informed decisions about resource usage. Ndoo Network is the first Android AppStore to integrate the Mobile App Reputation technology. We have been working with Trend Micro to test and evaluate the technology since mid-2011 and are seeing great results in catching malicious apps before they get onto the market-- it builds trust with our consumers, helping to increase downloads. This is fantastic and we have been able to integrate security expertise into the vetting process of our 60,000 apps without any hardware or headcount increase. Chong Chen, CEO, Ndoo Network