© 2010 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID Zero-day Protection with Outbreak Intelligence
{"Image DocumentName": "Zero-day Protection with Outbreak Intelligence", "Image ImageDescription": "Here you can see a diagram that outlines the flow of data through the ScanSafe system. On the right, there\u2019s an end-user at their computer, on the left, the Web page that they have just requested. I\u2019ll describe how this system works. Every Web page that is requested passes through Outbreak Intelligence. The Web page is split into the different elements that exist on that page \u2013 html, Javascript, flash, PDF\u2026whatever is contained within the web page \u2013 these separate content elements are then fed into Outbreak Intelligence. Outbreak Intelligence is made up of numerous scanlets \u2013 each scanlet is specifically designed and trained to analyse a particular type of Web content. As you can see we have different scanlets for different types of content. One very important thing here is that all the Web page content is scanned in parallel. Nothing happens serially here \u2013 that\u2019s how we ensure high performance while maintaining the highest level of security. So in this highly parallel process, all HTTP and SSL encrypted content is scanned using a combination of static and dynamic analysis techniques. Let\u2019s take a look at one or two of these scanlets in a little more detail\u2026 The Windows exe scanlet is a great example of how Outbreak Intelligence uses the huge dataset of real-world Web usage \u2013 remember over 1 billion web requests a day go into this ever increasing dataset \u2013 to help determine if code is malicious. It uses a combination of both static and dynamic analysis. Based on the dataset, the Windows exe scanlet in Outbreak Intelligence knows a lot about what Windows exe files look like and how they behave. Based on this insight, it knows some very important facts, like if an executable file is obfuscated, there\u2019s a 95% chance that it is malicious. And we know that the fewer sections an executable file consists of (they are normally made up of sections such as header, text, code and so on), the more likely it is that it\u2019s malicious. In fact, exe files with 3 or fewer sections have a 70% chance of being malicious. We know all these things because of our deep visibility, and can make all these judgments without even looking into what the exe file is trying to do. Add that dynamic analysis of the file itself, how it behaves, what it attempts to do once it runs, and Outbreak Intelligence gives a very accurate picture of what content is malicious, and what content is benign. Another good example here is the file anomaly scanlet \u2013 this is one of my favorites. While we have specialized scanlets for major threat vectors, the file anomaly scanlet really picks up all the content that might be considered safe \u2013 things like cursors, gif files etc. We see tens of millions of unique files every day; and based on this, the file anomaly scanlet has a pretty good picture of what files look like \u2013 and conversely, what they don\u2019t look like, and it spends it\u2019s time looking for things that look just a bit different from the norm \u2013 for example, an animated gif with just one frame. It knows that there needs to be multiple frames, that\u2019s what makes it animated. A great example of where this came into play recently was with one of our customers who had a machine that was infected with a trojan, the trojan was attempting to communicate with its home base by apparently requesting gif files. To many security systems this would look like a completely innocent communication \u2013 the File Anomaly scanlet however looked at the gif files that were being sent through and found that there were commands embedded within the files. It knew that gif files aren\u2019t meant to contain commands and prevented the communication, therefore stopping the phone home behavior. Back to the diagram \u2013 once all of these scanlets have formed their opinion (85% chance of malware for example), they pass this opinion on to the Meta Scanner. The Meta Scanner is really the chairman in this committee of experts. Based on the internal statistical model of the Meta Scanner, it is then decided if the requested Web page contains malware or not. Of course all malware is blocked before it enters the networks of our customers. Finally, looking toward the bottom of this diagram you can see the Outbreak Intelligence Lab \u2013 there are a few key things here. Our people \u2013 the ScanSafe Security Threat Alert Team, or STAT are widely recognized Web security researchers who spend their time identifying emerging threats and making sure that our customers know about them and are protected. We haven\u2019t lost the human element completely in this. They have found many different zero-day threats such as the Gumblar threat that I\u2019ll highlight in a minute. Also inside the Outbreak Intelligence Lab is where we design our automated machine learning capabilities for our scanlets. Every scanlet is trained prior to being released into Outbreak Intelligence \u2013 this training ensures that every scanlet can accurately identify any malware within it\u2019s specific area of expertise. I recently read a book (The Big Switch) where it mentioned about computers being trained to identify different things in pictures. To start with, they were shown trees, trees were tagged in different images. Over time the computers started to recognize trees, and in the end, they could identify trees in any image, regardless of the location or background in the picture\u2026that\u2019s really what we do with our scanlets\u2026train them to identify malware. Once the scanlets are released, they are left to continue to learn and adapt to changes in the environment, so in that instance, there is no human interaction, no security update before our customers are protected, it\u2019s all built in. And of course, let\u2019s not forget the billion requests a day that goes into the Web usage dataset that enables a lot of the capabilities within Outbreak Intelligence. So hopefully you get a good picture of the high level capabilities of Outbreak Intelligence.", "Image XResolution": "37", "Image YResolution": "37", "Image ResolutionUnit": "Pixels/Centimeter", "Image Software": "SlidePlayer", "Image YCbCrPositioning": "Centered"}