Smart Protection Network – Data Mining Framework

Mobile App Reputation technology can be easily integrated by service providers and application developers to provide apps of higher quality and better security to app stores, while users avoid privacy risks and high resource consumption.

Correlation with other reputation technologies ensures Trend Micro customers are protected from malicious mobile apps and web pages where these apps are located.

• Provides users critical information about apps they are using
• Prevents malicious apps from being downloaded
• Identifies apps that may abuse privacy or device resource

Our endpoint products query the whitelist whenever a suspicious file is identified to check if the file is a known good file. The database is also used by threat researchers to quickly eliminate known good files from being analyzed during our processes for identifying malicious content.

• Leverages one of the largest whitelisting databases in the world for fast, accurate identification of known good events
• In-the-cloud database developed over several years reduces false positives
• Allows threat researchers to focus on suspicious or malicious content, thereby speeding up identification of new threats
   

Trend Micro researchers are constantly monitoring and working with 3rd party vendors whose applications may be exploited by criminals. We also monitor exploits at various sources and monitor criminal communications and sites for active code.

This allows us to quickly identify and correlate the threat intelligence needed to block exploits from taking advantage of software vulnerabilities, known or unknown. This enables us to protect our customers against software vulnerabilities.

• Quickly discovers and adds protection from known and zero-day exploits
• Shields known and unknown vulnerabilities from unlimited exploits until they can be patched
• Correlates exploit intelligence to other threats used by cybercriminals in attacks

This provides our researchers with gigabytes of malicious network traffic that is filtered, processed, and analyzed to create and test intelligent rules to detect malicious communications and behaviors. Additionally, threat researchers perform penetration testing in simulated enterprise network environments providing them with rich network traffic for further rule development and testing.

Key Benefits

• Quickly identifies botnet or targeted attack behaviors
• Correlates threat intelligence and blocks all aspects of an attack
• Adds another layer of protection for customers using network-based solutions

Analyzing the tools and techniques used by threat actors allows us to develop models of behavior and tools that help us identify new threats. Applying these tools and models to the data we receive from our global sensornet lets us quickly identify any new threats that may be propagating.

This research also allows us to develop proactive detection of new threats before they are used by the cybercriminals.

• Proactively protects against new threats developed within the cybercriminal underground community
• Identifies new attack methods early, minimizing the attack window
• Collaborates with law enforcement to identify and apprehend known cybercriminals

We assign a reputation score based on factors such as a website’s age, historical location changes and indications of suspicious activities discovered through malware behavior analysis. We’ve advanced how we apply web reputation to keep pace with new types of criminal attacks that can come and go very quickly, or try to stay hidden.

1^st Generation Web Reputation

• Centralized downloading
• Download content and test it

2^nd Generation Web Reputation

• Requires multiple components to work in collaboration; one is not enough
• Smart Feedback (feedback from real-world sensors)
• Sandboxing /emulation (threat intelligence coming from live analysis of web pages)
• Cybercriminal monitoring/detective work (TrendLabs threat researchers investigate tools and techniques of cybercriminals)

Results

• Blocks users from accessing compromised or infected sites
• Blocks users from communicating with Communication & Control servers (C&C) used by criminals
• Blocks access to malicious domains registered by criminals for perpetrating cybercrime

The first layer of defense validates IP addresses by checking them against a reputation database of known spam sources; the second layer uses machine learning to identify malicious or spam-like content; the third layer correlates email with our other threat data so that, for example, it can immediately block a link to a malicious URL identified by our web reputation technology.

• Blocks malicious emails and threats such as zombies, in the cloud, before they reach you
• Blocks users from social engineering and phishing attacks
• Includes language-independent rules to identify threats such as phishing links, as well as language-dependent modules to identify spam indicators in multiple languages

This in-the-cloud approach eliminates the need to deploy a large number of pattern files to hundreds or thousands of endpoints. As soon as the pattern is updated on the Smart Protection Server, protection is immediately available to all clients.

We continually enhance file reputation to improve malware detection. Smart Feedback allows Trend Micro to use community feedback of files from millions of users to identify pertinent information such as the prevalence of a file, geo-location, age, first seen, last seen and other data that helps determine the likelihood that a file is malicious.

Used in conjunction with our in-the-cloud whitelisting ensures few false positives occur. This new technology is used today in our backend infrastructure and is making its way into our solutions in the future.

• Checks the reputation of each file against an extensive database before permitting user access
• Uses high performance content delivery networks and local caching servers to ensure minimum latency during the validation process
• Leverages cloud-client architecture to decrease the size of the local pattern file, thus minimizing demand on network resources

Trend Micro has the distinct advantage of being able to respond in real time, providing immediate and automatic protection from the multitude of threats.

• Applying behavior analysis, analyzes combinations of activities and the components of threats to determine if they are malicious
• Continuously updates and correlates global threat intelligence to ensure real-time threat response, be it from a malicious website, mobile app, spam sender or infected file
• Provides visibility into the relationships within targeted attack campaigns, such as geo-location, targeted organizations, and attack methods

• Performs web and file reputation queries directly to local servers, without the need to go to the public cloud
• Saves network bandwidth and improves efficiency of endpoint security updates
• Ensures privacy of your data

As such, it is more important than ever to obtain feedback from customers to identify new sources of attacks. This collaboration between Trend Micro and our customers allows us to improve the protection for everyone—“a neighborhood watch” system of community protection via 24x7 communication between Trend Micro products, research centers and technologies for "better together" security.

• Automatically updates Trend Micro’s global threat intelligence each time a new threat is identified on a single customer’s routine reputation check
• Improves the speed with which we can identify new threats