di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

ChatGPT and Malware: Making Your Malicious Wishes Come True

chatgpt-malicious-wishes-blog.png

Listing preview

Perspective & Findings

ChatGPT and Malware: Making Your Malicious Wishes Come True

image_media_card

Malicious JARs and Polyglot files: “Who do you think you JAR?”

New MuddyWater Threat: Old Kitten; New Tricks

Polonium APT Group: Uncovering New Elements

Emotet’s Vacation is Over: No Rest for the Wicked

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Malicious Office files: 20+ Years of Microsoft Office Exploits

MIT Explores How Deep Learning is Transforming Cybersecurity

Trending at Deep Instinct

carousel_cards

listing_preview

We asked CISOs to tell us what they think are the biggest challenges facing the cybersecurity industry. From IoT to data privacy and data breaches. CI

ciso_pov_2019_2.jpg

We asked CISOs to tell us what they think are the biggest challenges facing the <a href="https://www.deepinstinct.com/blog/">cybersecurity industry</a>. From IoT to data privacy and data breaches. CISOs weigh-in to tell us what the cybersecurity landscape of the future will hold:
<ol>
<li>“The next biggest #security challenge in today's dynamic world is the IT/IoT network convergence. The next wave of attack is to compromise and take over the control of #IOT devices and disrupt the human life. The biggest shortcoming with IoT devices are that we have less security controls available for these devices however we have higher adoption due to obvious reasons for ease of access and increase productivity.”</li>
</ol>
Vaibhav Pathak, CISSP - WinMagic <a href="https://www.linkedin.com/in/vaibhav-pathak-cissp-6512b71b/">https://www.linkedin.com/in/vaibhav-pathak-cissp-6512b71b/</a>
&nbsp;
<ol start="2">
<li>“Some of the main challenges we face include standard and regulation compliance, continued cloud application security, security by design, awareness of prevention measures and identification of weaknesses”</li>
</ol>
Tomer Shemesh, CISO - Ex Libris <a href="https://www.linkedin.com/in/tomer-shemesh-41357550/">https://www.linkedin.com/in/tomer-shemesh-41357550/</a>
&nbsp;
<ol start="3">
<li>My biggest concern is the meta-effect. Yes, the security incidents will continue at an accelerating pace and will for the next few years at least, we have not hit "peak breach" by any means. But the longer this goes on the more inured people become to finger pointing and blame finding and the more helpless they will feel. Helpless people won't help themselves and that will make solutions that much harder to implement.</li>
</ol>
Bill Bonney, Virtual CISO - CISO Desk Reference Guide (1 &amp; 2) <a href="https://www.linkedin.com/in/billbonney/">https://www.linkedin.com/in/billbonney/</a>
&nbsp;
<ol start="4">
<li>“The human factor is a significant risk factor, it is not enough to take a specific measure, employee awareness is a continuous process that when done right, turns the origin of the problem into part of the solution. My goal is to no longer hear “this is phishing right? Because I opened the file and…”</li>
</ol>
Maytal Brooks-Kempler, CISSP - Helena, <a href="https://www.linkedin.com/in/maytalbrookskempler/">https://www.linkedin.com/in/maytalbrookskempler/</a>
&nbsp;
<ol start="5">
<li>Majority of the cyber breaches that made the headlines in 2018 were caused by phishing attacks, gaps in vendor risk management, credential theft, and lack of sophisticated security analytics for continuous monitoring. IMHO companies will continue to adapt their security program to protect against the similar  threats in 2019 by tweaking awareness techniques,  hardening the supply chain , and leveraging automation/AI/ML for security processes.</li>
</ol>
Gurdeep Kaur, CISO - PSEG, <a href="https://www.linkedin.com/in/gurdeepkaur/">https://www.linkedin.com/in/gurdeepkaur/</a>
&nbsp;
<ol start="6">
<li>“In my opinion, an infosec leader’s role is to surface the existing risks the organization faces and manage them in the best way possible for the organizations, in cooperation with management. My main concern is from the fast pace of attacker’s capabilities and the sophistication of them, making it harder to identify threats. I believe infosec leaders need to learn from past mistakes and take a proactive approach”.</li>
</ol>
Moran Shalom, CISO - AU10TIX <a href="http://linkedin.com/in/moran-shalom-070049a8">http://linkedin.com/in/moran-shalom-070049a8</a>
&nbsp;
<ol start="7">
<li>“The organization's cyber protection capabilities need to meet today’s existing risks that and anticipate the needs caused by planned business innovation. In order to be prepared in the best way and to foster business innovation, we should foster innovation in the world of cyber protection by using industry startup technologies.”</li>
</ol>
Shuky Peleg, Head of Cyber Defense and Information Security - MATAF <a href="http://linkedin.com/in/shukypeleg">http://linkedin.com/in/shukypeleg</a>
&nbsp;
<ol start="8">
<li>“One of the challenges for companies providing end-user services (such as Telcom companies) is to keep their customers/members data private and meet with GDPR requirements, and ensure their sub-processors are also maintaining the PII. In addition, data security in a cloud environment is a major challenge for organizations who chose to use hybrid or public cloud infrastructures. Another constant concern for information security leaders is the human factor.”</li>
</ol>
Ben Afshari, CISSP - Amdocs <a href="https://www.linkedin.com/in/benafshari/">https://www.linkedin.com/in/benafshari/</a>
&nbsp;
<ol start="9">
<li>“While many organizations work daily on their level of security in the organization, we discover from time to time new breaches originating from corporate supply chains. Today, organizations are required to protect their information at any given time, including organizations suppliers and sometimes even sub-providers.”</li>
</ol>
Raphy Bitton, CISO - Comsec <a href="https://www.linkedin.com/in/raphy-bitton-cissp-85b23aa1/">https://www.linkedin.com/in/raphy-bitton-cissp-85b23aa1/</a>
&nbsp;
<a href="https://info.deepinstinct.com/whitepaper-reinventing-prevention-with-deep-learning"><img class="wp-image-4303 aligncenter" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0ff5850c23a15898/611a80af457ae716163675e8/reinventing-prevention-inner-banner.png" alt="" width="612" height="153" /></a>
&nbsp;
<ol start="10">
<li>“In 2018, we devoted a serious part of our efforts on being pro-active decision-makers to mitigate supply chains risks. An effective supply chain risk solution depends on compatibility with the organization’s business strategy and mission statement, product families, markets and supply chain third-parties. By mitigating these risks, we allowed our customers to be more confident in our ability to deliver our product/service and therefore they were able to focus their energy towards the core aspects of their business.... saving lives!”</li>
</ol>
Yaniv A. Milhovitch, CISO - Viz.ai <a href="https://www.linkedin.com/in/yaniv-a-milhovitch-cissp-cism-cfr-ciotp-mcse-mcp-b8514b57/">https://www.linkedin.com/in/yaniv-a-milhovitch-cissp-cism-cfr-ciotp-mcse-mcp-b8514b57/</a>
&nbsp;
<ol start="11">
<li>"The formula is apparent in the IT security; There are bugs… and people that take advantage of the bugs. The main challenges are:</li>
</ol>
<ul>
<li>More inexperienced programmers and hardware developers.</li>
<li>Billions of new devices (Computers, phones, IoTs [integrated and small devices])</li>
<li>Much more data worth stealing</li>
<li>Billions of new, inexperienced administrators and 'homeowners' that do not know how to secure a machine.</li>
<li>More companies doing 'dumb things' like storing data on another company networked machine (cloud) without taking data protection and data privacy into consideration.</li>
<li>Most of the companies having the issue with expert’s cybersecurity skills shortage to guard the company's information</li>
</ul>
In my opinion, information security experts should have:
<ul>
<li>A solid technical background that covers as much as possible of the IT security infrastructure</li>
<li>An intense experience in designing information security programs and operations.</li>
<li>An aptitude and interest in information security</li>
</ul>
Take note, as an information security expert, that you have to match up to your attacker's strength or better yet, supersede it (Hunt the Hunter). Keep in mind, once you get the basics right, you can start building your expertise."
Fadi SODAH, IT Specialist - SDC Government <a href="https://www.linkedin.com/in/madunix/">https://www.linkedin.com/in/madunix/</a>
&nbsp;
We thank all the CISOs who participated and shared their thoughts.
Are you a CISO? Join the conversation and tell us what you think are the biggest challenges you will face this year.
&nbsp;
&nbsp;
&nbsp;

Inside the CISOs Mind: Cybersecurity 2019 and Beyond

“One ring to rule them all!”. That’s what the Lord of the Rings is all about, and the same rule should be true for an endpoint protection platform “On

One_management_console-3.jpg

“One ring to rule them all!”. That’s what the Lord of the Rings is all about, and the same rule should be true for an endpoint protection platform “One management console to Protect them all!”. In today’s world, the proliferation of security products is making it harder for IT administrators’ in large organizations to manage and secure all endpoints. You need integration with multiple solutions and API calls to orchestration services that will manage all the data collected from all the security products in the organization to meet complex and rapidly growing needs. But what if… what if there was a product that could manage and secure all your organization’s endpoints and devices from Windows through servers and other platforms such as Mac, Android, and iOS all from one single console? Imagine if you could see all security events across your organization looking only at a single dashboard. But why leave it to your imagination? This is a reality, a reality where all devices are deployed, managed and secured from one single security management console. A true platform that can save companies time, money and resources at a time where <a href="https://www.gartner.com/en/newsroom/press-releases/2018-08-15-gartner-forecasts-worldwide-information-security-spending-to-exceed-124-billion-in-2019">Gartner forecasts worldwide information security spending is poised to exceed $124 billion in 2019</a>.
In this blog post, I will cover the advantages of having an <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener">Endpoint Security</a> platform that supports all OS types and having the security of endpoints managed from a single console.
An Endpoint Protection Platform that boosts Productivity
Established organizations usually run systems that have been in place for years and which have been put in place at great expense to the organization, the software may have been augmented throughout the years. In today’s multi-platform world and the increase of attack vectors across these platforms’, administrators use multiple types of security software. When the software from one doesn’t interact with the software from another, productivity slows, and frustration grows. In a recent publication, <a href="https://www.gartner.com/doc/3894683/predicts--mobile-endpoint-technologies">Gartner predicts</a> that in 2019 End-user computing groups will converge to a single digital workplace team to support a mobile workforce accessing cloud services across diverse endpoints, and recommends creating an integrated, agile digital workplace operations group to drive operational efficiency by combining the PC, mobile and cloud office teams.
Having a cross-platform security management console for all devices can improve productivity as well as reduce overlap between security products and cut the total cost of ownership, allowing a single administrator to supervise what was once done by a full team.  The ability to prevent, detect and remediate threats all from a single console ensures the best security for the organization.
[caption id="attachment_4732" align="aligncenter" width="739"]<img class="size-full wp-image-4732" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteb464a413e07d349/611a7fe0fcdd141645581699/Picture1-1.png" alt="" width="739" height="416" /> All the events cross platform from a single dashboard[/caption]
An Endpoint Protection Platform with An Advanced Management Console
Every organization has a life cycle of employees, new employees coming, employees leaving, companies merging, company acquisitions and more. Deploying, managing and maintaining the security of all the assets in a changing dynamic organization can be a big undertaking for any security administrator. The ability to maintain the security of all the devices from a single platform is not a new concept but is a proven practice (e.g. MDM or EMM) among many organizations. A security solution that provides a single hub for managing organization devices allows for better control and security and streamlining the experience and management.
Cost-Effective Endpoint Protection
Cost is a driving factor in many organizations when it comes to embedding new systems in the organizations environment. With multiple products come multiple costs; cost for the product itself, cost of implementing a new product, cost of maintaining the products as well as the cost when scaling a product in the organization or the cost of removing a product from the organization systems when it is no longer relevant. Cost should be factored not only by how much the organization pays the 3rd party vendor for the software, but also how much time and effort the organization spends in implementing and maintaining such software.
A single endpoint protection platform can reduce the cost as it uses the same set of resources for all the products on its platform. It can drastically reduce cost of the organization’s implementation and maintenance resource as there is only one product to integrate and once the platform is in place, all the devices security applications run through it, so there is only one vendor that provides all the organization’s needs and reduces the overhead of dealing with multiple vendors, licensing, support and products.
[caption id="attachment_4733" align="aligncenter" width="777"]<img class="size-full wp-image-4733" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7cb953fc2687d9c8/611a7fe1ffd778164aa236a2/Picture2-1.png" alt="" width="777" height="437" /> Managing deployment of multiple OS types.[/caption]
Scalability - An Endpoint Protection Platform that grows with your company
When selecting an endpoint security solution, organization growth is one of the most important aspects to consider. Having the ability to know that the system is in place, can scale the organization’s needs not only in one year but in 5 years and is important to some companies. When dealing with multiple security solutions you need to keep ‘Scale’ in mind all the time. With each acquisition or large growth in the organization, you need to ensure that the system in place is scalable and manageable. Some of these concerns can be avoided with the right solutions in place that can scale and provide security constantly for all the organizations’ needs and expansions.
Visibility - A Unified Endpoint Protection Platform improves Accessibility 
Security visibility in real-time is a huge challenge for any organization. Getting accurate data from multiple sources and the need to correlate the data can be very cumbersome. Visibility is key to protecting organizations assets and data because you can’t protect endpoints if you don’t see or have all the information. Multiple sources may be great to get a second opinion or to verify threats, but having a single solution that gives you the visibility and information you need can be key to protecting the organization. Visibility across all the organizations’ assets and platforms from a single dashboard will allow for quicker action and remediation to protect the organization.
[caption id="attachment_4734" align="aligncenter" width="700"]<img class="size-full wp-image-4734" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4ace76f53b553b40/611a7fdd5110c915ef85ca82/Picture3.png" alt="" width="700" height="787" /> Detailed information for each event.[/caption]
Maintainability - Only one platform to update regularly
Some may say that having a single endpoint protection platform can be also known as a single point of failure (putting all your eggs in one basket). But, in most cases, it is known as a single point of success, quick repair and continuous improvements. Having multiple security products means the organization must ensure that ALL the products are up-to-date and compatible for all its assets and deal with multiple vendors for troubleshooting and fixing issues. With a security product that offers a solution for all devices, it can improve maintenance time and for fixing issues in a fraction of the time.
To Conclude
With the growing ecosystem of platforms in the enterprise environment, a single platform can offer an all-in-one protection solution for security visibility and needs. Having such a system in place can give the organization full control of all organization devices and truly be a single ‘precious’ platform to protect them all.
At Deep Instinct, we use proprietary <a href="https://www.deepinstinct.com/deep-learning-cybersecurity/">deep learning cyber security</a> capabilities for full protection and visibility for any device and OS, offering a comprehensive protection platform and one simple dashboard for managing, monitoring and analyzing all the organization’s security needs cross-OS, ranging from SIEM and REST-API integration, dynamic grouping of devices, analytics capabilities and Multi-tenant management and so much more.

One Endpoint Protection Platform to Protect them all

By: Ally Benoliel, Marketing Communications Manager

Wrapping up 2018 in one of the noisiest and most fascinating industries, I noticed that cyber-a

top_stuff_2018-1.jpg

By: Ally Benoliel, Marketing Communications Manager
Wrapping up 2018 in one of the noisiest and most fascinating industries, I noticed that cyber-attacks are becoming an increasing issue and combating them is becoming more and more challenging. At Deep Instinct, we focused a large part of our marketing efforts, on creating content around the most pressing issues in cybersecurity today.
Take a look at some of our top picks.
Prevention is back! 
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/d22e9c54-f967-4c04-86d6-0d26b3741693"><img id="hs-cta-img-d22e9c54-f967-4c04-86d6-0d26b3741693" class="hs-cta-img alignright" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/d22e9c54-f967-4c04-86d6-0d26b3741693.png" alt="New call-to-action" width="200" height="200" /></a> 

While the number of security vendors has increased dramatically lately, not only did the security landscape not improve as you would expect it do, but it is doing much much worse. More and more enterprises are being compromised with attacks originating on the endpoint.
How can this be explained?
Well for one, there are over <a href="https://www.av-test.org/en/statistics/malware/">350K machine-generated malware appearing daily</a>, and while there are tons of security solutions, none are offering actual security.
If we look back, we can see an <a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/ffcc9f6f-5f5b-4387-90d3-58d48b011274?__hstc=160033954.9dcdf969025385f1e7faa46479d2c985.1529445781258.1544536478425.1544616560878.148&amp;__hssc=160033954.2.1544616560878&amp;__hsfp=3057413405">evolution in the approaches</a> led by security solutions:
Back in the 90’s when the malware was known, the approach was to prevent it. But with time, as the sophistication of malware continued to evolve, the industry gave up on the innovation of prevention technologies and moved into a detect-and-respond mode.
Thankfully, with innovative technologies available, we can now revive the concept of prevention, even for unknown attacks. With deep learning, we are reinventing and redefining cybersecurity “prevention” to its original classification: The idea that you can prevent attacks from happening.
To learn more, download this free whitepaper: <a href="https://info.deepinstinct.com/whitepaper-reinventing-prevention-with-deep-learning">Reinventing Cybersecurity Prevention with Deep Learning: Endpoint Cybersecurity Evolution</a>
Be Fearless When it Comes to Fileless Malware Attacks 
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/22d14362-58b7-4821-8f93-ceb3958690ba"><img id="hs-cta-img-22d14362-58b7-4821-8f93-ceb3958690ba" class="hs-cta-img alignright" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/22d14362-58b7-4821-8f93-ceb3958690ba.png" alt="New call-to-action" width="200" height="200" /></a> 

Cyber criminals are constantly looking for new and sophisticated ways in which to avoid being detected and successfully perform a malicious attack. This was most evident in the past few years. Apart from the rise in ransomware attacks, there has also been an increase in the amount of fileless attacks, which pose a threat to organizations and challenge for security solutions due to the use of sophisticated attack techniques and various non-executable file formats.
The definition of what is considered fileless attack is wide, as the term “fileless attack” encompasses several possible attack scenarios, only some of which don’t write any files to disk, while very few scenarios are completely fileless.
To learn about the anatomy of fileless attacks, and get an in-depth explanation of the challenges and solutions involved, download this free whitepaper: <a href="https://info.deepinstinct.com/whitepaper-making-sense-of-fileless-malware">Making Sense of Fileless Malware</a>
The Rise of New Sophisticated Evasive Malware 
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/645b561f-f16c-4c42-b53c-6ad5fdefe4d0"><img id="hs-cta-img-645b561f-f16c-4c42-b53c-6ad5fdefe4d0" class="hs-cta-img alignright" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/645b561f-f16c-4c42-b53c-6ad5fdefe4d0.png" alt="New call-to-action" width="200" height="200" /></a> 
In the last few years we have seen various ways of spreading malicious code, one main infrastructure of spreading malware being the dark web.
In June 2018, one of Deep Instinct’s researches, Tom Nipravsky, noticed a highly complicated botnet (number of internet-connected devices, where the owner can control them using command and control servers), which was detected and prevented in one of our client’s live environment and devices – by our deep learning cybersecurity solution.
This highly sophisticated botnet, dubbed MyloBot (named after Tom’s dog) incorporates different malicious techniques and complexities.
To read the full analysis of how Mylobot works, download this research paper: <a href="https://info.deepinstinct.com/meet-mylobot-a-sophisticated-never-seen-before-botnet">Meet Mylobot - A Sophisticated Never-Seen-Before Botnet</a>
The Increased Need for MSSPs 
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/d49a7d91-0835-4795-9abf-f540c3562dae"><img id="hs-cta-img-d49a7d91-0835-4795-9abf-f540c3562dae" class="hs-cta-img alignright" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/d49a7d91-0835-4795-9abf-f540c3562dae.png" alt="New call-to-action" width="200" height="200" /></a> 
Today, more and more cyber-attacks are targeting industry sectors and organizations of all sizes, and the potential damages have increased the <a href="https://info.deepinstinct.com/whitepaper-multi-tenancy-security-solution-for-mssps">awareness for advanced security services by MSSPs</a> (Managed Security Service Providers) in order to stay protected.
But for MSSPs to block the most advanced threats, they are required to adopt innovative technologies, such as advanced EPP solutions that are “MSSP ready”, meaning they can be managed in a multi-tenant environment. Currently, there are very few advanced security solutions that can be be managed in such an environment.
In Deep Instinct’s latest release, version 2.2, Deep Instinct added the ability for MSSPs and large enterprises to manage all entities from the same instance and management console along with more capabilities required for MSSPs.
To learn more, download this free whitepaper: <a href="https://info.deepinstinct.com/whitepaper-multi-tenancy-security-solution-for-mssps">Multi-tenancy security solution for MSSPs</a>
Obliviousness Around Employee Mobile Security 
Employees need to be aware that their mobile device is a vulnerable endpoint that can harm their employer and cause significant damage. Awareness that their device on which they use company resources, can cause significant damage resulting in millions of dollars of losses. By raising employee awareness of the risks and vulnerabilities, up to a third of cyber-attacks targeted from mobile devices on organizations and companies can be prevented.
This cannot be denied or ignored anymore, companies must ensure that their employees are well-informed when it comes to mobile threats and learn how to manage situations that may develop, insuring the company’s security. This all begins with AWARENESS.
Read more here: <a href="https://www.deepinstinct.com/2018/03/26/6-key-ways-to-raise-employee-mobile-threat-awareness/">6 KEY WAYS TO RAISE EMPLOYEE MOBILE THREAT AWARENESS</a>
The Need for AI-based Solutions 
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/f4d03b1a-d24a-40ee-a577-7287241a409d"><img id="hs-cta-img-f4d03b1a-d24a-40ee-a577-7287241a409d" class="hs-cta-img alignright" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/f4d03b1a-d24a-40ee-a577-7287241a409d.png" alt="New call-to-action" width="200" height="200" /></a> 

From ransomware, to spyware and banking trojans, the types of malware threats are many. Yet the one threat that seems to be posing the greatest challenge to organizations and their cybersecurity solutions is unknown malware.
This is because the means that have most typically been used to counter cyber threats to date remain insufficient when it comes to unknowns.
Yet, the demand for beating the threat of unknowns is only getting bigger as the threat continues to grow at a dizzying pace.
There is one approach, though, that overcomes the pitfalls of other means, as it is inherently designed to handle unknown malware. This approach is deep learning.
For a quick recap – <a href="https://info.deepinstinct.com/deep-learning-for-dummies">deep learning is the most advanced branch of artificial intelligence today.</a> Its learning method is inspired by the way the human brain learns – taking in all the data and learning from it automatically and intuitively.
Deep learning is the first — and currently the only — learning method that is capable of training directly on raw data. There is no need for feature engineering with deep learning, as is needed with machine learning. To the contrary, deep learning can dive into the raw data of the file, without explicitly being told to pay attention to certain features, which have been specified by human experts.
Moreover, deep learning scales well to hundreds of millions of training samples. As the training dataset gets larger and larger, deep learning continuously improves. And the third aspect of deep learning that makes it unique is its ability to pick up on patterns and correlations in the raw data that are too complex for any human or AI to pick up on.
Thus, its unique approach to training and learning endows it with both intuitive and predictive capabilities – which is probably one of the most critical capabilities for picking up on unknown threats. For, if you can’t ‘know’ in advance what it is, you must be able to predict what it is.
To learn more about the power of deep learning, download our <a href="https://info.deepinstinct.com/deep-learning-for-dummies">Deep Learning Book for Dummies</a>.
Summary
The cybersecurity domain never ceases to amaze me. With more and more solutions, more and more attacks and the continued cat and mouse chase between defenders and attackers, we are always kept on our toes.
My hope is that 2019 will bring a better understanding to the market, that cybersecurity may not be bullet-proof, but with innovative cutting-edge technologies, you can get pretty darn close to it.
&nbsp;

Deep Instinct’s 2018 Most Read Content Pieces

By: Mark Arapovic, SE Manager

Security 'guys' are an eclectic mix of personalities. The people working in this industry of ours are as varied as th

football_cyber_2.jpg

By: Mark Arapovic, SE Manager
Security 'guys' are an eclectic mix of personalities. The people working in this industry of ours are as varied as they come, but I have to say, one topic which continues to dominate a lot of pre and post meeting small talk over the past few weeks has been the FIFA World cup. Surprisingly, for a group of people that are stereotypically supposed to be 'nerds', there are more of you in vendor/channel/customer land I know that have been waking up at 4am, or pulling allnighters to watch the matches than I expected.
I for one, am one of them. (though the Australian time zone can put a football fan's dedication to test)
Another hot topic over the past few months/years (within meetings this time) is the discussion around Detection vs Prevention in terms of a security strategy. It's never been a tougher time being a customer wading through all of the security solutions currently on the market. It’s safe to say that the explosion of Malware since 2008 has been matched by the explosion of startups and cybersecurity vendors claiming to have a silver bullet for the troubling times we find ourselves in.
<h4>Why 2008? </h4>
Well, Bitcoin of course. It has given the 'bad guys' a way to monetize their handywork and has been a quite lucrative way for them to get away with a clean pair of heels. Combine this anonymous monetization of threats with the treasure trove of tools leaked from the NSA (which have given us such hits as WannaCry) and you have an environment of fear and uncertainty ripe for the picking from a vendor perspective. This 'feeding frenzy' of opportunity for security vendors has really thrown a lot of traditional assumptions and foundational principles of Cybersecurity out the window, and as the months roll on, and another breach is disclosed, another attack discussed, the water is becoming muddier and muddier as vendors reach beyond their core discipline to get a larger chunk of the pie.
<img class="aligncenter" src="https://media.licdn.com/dms/image/C5612AQGP2QnmZRJKvg/article-inline_image-shrink_1000_1488/0?e=2131315200&amp;v=beta&amp;t=KdcTzECWdw7YN1ds-6TkQauAivowXROQ5yCErQIMiUE" />
I don't want to use the word 'cowboys' but some of the conversations I have had with customers relaying the claims of some vendor solutions is just down right iresponsible. Come to think of it, some of the most entertaining exchanges I have read online recently have been grandiose vendor postings on LinkedIn that quickly get shot down by independant researchers or security professionals.  Maybe its desperation, maybe those of us in vendor land are just not as knowledgable as we used to be, or maybe it's just hard to find good security people that wont struggle to keep up with new concepts and new technologies. But whatever it is, I get the feeling that the channel, in particular a strong security focussed partner is more important than ever, especially when it comes to making big decisions in terms of security strategy.
<h4>So, Detection vs Prevention, why is this even a question? </h4>
The tidal wave of threats that have been unleashed in recent times really broke the banks for a lot of tradtional vendors. The philosophy (from a prevention perspective) of layering signature based engines with a multitude of other complimentary technologies has been barely viable whilst burdening our endpoints with so many running services and processes, our end users have been screaming for it to stop. This approach of adding another driver or agent to provide a small uplift in detection or to stop a specific type of threat is akin to buying as many lottery tickets as possible to get better chance of winning a clean environment. (and dont get me started on prevention capabilties that rely on a cloud connection) Sustainable? not at all. Effective? Not really. When I see videos posted online showing Malware running but then get caught after the fact, or rolled back, I feel like I am the only one in the room questioning how that is even acceptable, and why any vendor would advertise they missed in the first place. Not impressed.
Maybe I am from the old school where prevention was what we were measured on, where incident response implied that something got through, there has been a failure, an error, an apology letter and explination needed after we hopefuly cleanup the mess the miss has caused. But not these days. A piece of Malware that runs past the pre-execution layer of any product doesnt raise any eyebrows, and seems to be almost acceptable because we have apparantly hit the ceiling of pre-execution and prevention capability. For a few years now its almost as if the industry has thrown its hands in the air and said, we cant do much better than what we are doing with prevention, so lets just let it run and figure out what it is doing after the fact...
<h4>Enter the wonderful world of EDR. </h4>
At the point when everyone realised the shortcomings of available prevention technologies, and this imaginary ceiling was hit, EDR solutions all of a sudden were not just tools designed to pick up a live attacker moving throughout the environment (or should I say, that theoretical 1% that AV products missed), but had now crossed over into the world of making up for the shortcomings of traditional prevention based solutions. Endpoint Security vendors all of a sudden expanded their forensic and detection/response capability and traditional EDR vendors started building in preventative layers and marketed themselves as an AV replacement technology. This is essentially where we are today and why there is so much uncertainty.
Speaking with customers, I have heard many times the desicion boiling down to if they wanted an EDR solution with some Threat Prevention, or a Threat Prevention solution with a sprinkle of EDR. Too many vendors trying to be too many things? Or is having a single budget for securing your Endpoints and being forced to pick the problem?
I can imagine how difficult it must be for a CIO forumlating a security strategy, when the 'experts' can barely decide where all of these varying solutions sit in a report or quadrant. This is why it is in this day and age customers should really go back to basics, and why I love the analogy of picking your all star Football team.
<h4>If you guys out there could only be a fly on the wall..</h4>
Having worked in the industry for over a decade, its natural that some very close friends of mine work for a whole range of vendors, including competitors. So besides the FIFA World Cup discussions recently, we have had just as equally heated debates about Security and the current landscape. It is natural if you work for a vendor that has a particular philosophy or approach, that you too evangelize this approach, which is why it is so important to keep vendors honest by building a relationship with a security focused solutions provider or MSP (who is hopefully one or two steps removed from all of the vendors out there), or go and do the hard hards yourself with putting vendor claims the test.
During one of my recent 'catch ups' with some former collelagues we had some interesting discussions around EDR and Next-Gen AV. After the chest thumping had died down, and when using the analogy of approaching your Security strategy the same way you would a Fantasy Football team, there were some really interesting admissions.
<h4>If only they had agreed to be quoted here</h4>
A peer working for an 'EDR' vendor said:
"Using your analogy, I would say that expecting an EDR solution to be highly effective at actual threat prevention, is like putting Lionel Messi as Goalkeeper in the fantasy World Cup team. The EDR premise after all is that the prevention layer will let through more than it will stop, which makes the EDR solution more relevant. "
Another, who is a self described EDR-phobe said:
"Of course EDR should be part of your security philosophy, but before heading down that path you have to understand its not exactly a 'set and forget' type of solution. You need to dedicate multiple head count to the management of the solution, wether that be internal or outsourced to a partner, I would imagine the more you invest, the more useful the solution becomes'
The assumption that a prevention layer will miss, in my humble opinion, is overstated somewhat depending who you talk to. Not only are we now at a stage where innovation on the prevention side of the fence has exploded once again, but those of us that were starting to lean toward the Detection and Response approach are now having second thoughts with these new developments, specifically around Deep Learning.
Yes, yes, I know, the first rule in security is that nothing is 100%, but having an overly pessimistic view on prevention tech and dismissing the advances made on this side of the fence in recent years is bordering on ignorance. At the same time, no prevention based solution is bullet proof, which is why you need to build on this the deeper you move toward your own security utopia.
So, who is on your team?
So, the question you should ask yourself is, who is in your Security Fantasy Team? Who provides the best prevention, the best visibility, the best control, the least performance hit, the most operational advantage, and should each of these things really be from a single vendor? I think the Football analogy is very relevant in this regard, because in the past we have seen certain Footbal philosophies come, dominate, then fade away.. much like in our Cybersecurity world. So my view is that a mix and the best of each philosophy is probably the safest way to go.
<h4>The Cyber Security Experts Guide to Football (Soccer) Tactics and Philosophy:</h4>
Catenaccio = Application Whitelisting
Emphasis on Defense, made famous by the Italian teams of the 70's ad 80's that was super-effective but counter productive to the spirit of the beautiful game, angered a lot of fans but appreciated much more when scaled back.
Gegen-Press/Rock'n'Roll Football = Next-Gen AV / AI based prevention
Defending from the front, having your strikers act as your first line of defense, new, fresh, exciting and in the modern generation pioneered by Jurgen Klopp with his Boroussia Dortmund and Liverpool teams. Pretenders are easily caught out if you do not have the correct framework or approach to this, a lot of teams claim to use this philosophy but on game day its evident a lot cannot pull it off.
Total Football = Security as a System (i.e. Endpoints talking to Firewalls either directly or via SIEM/Orchestration utilities)
The famous dutch team of the 70s, one of the greatest teams never to win a world cup spear headed by the late, great Johan Cruyff, this system is still the foundation of the Ajax (Amsterdam) youth academy today where every player at some stage, plays in every position in order to get an understanding of every position.
Tiki-Taka - Endpoint Detection and Response
Made famous by Barcelona and the Spanish team in recent history, typically no striker, but relying on short, sharp passes, complex triangles and posession of the ball. Exploded onto the scene, won Spain a world cup, but as you may have seen, the Spanish were just knocked out of the recent tournament in Russia... how times change.
The Long Ball game = Old School AV and/or Firewall
Typically a Sunday League tactic, still employed by a lot of English and Scottish teams, where you simply launch the ball up front and hope one of your players gets on the end of it. Not really effective when up against high quality opposition, but some times the best you can do with budget restricitons limiting the recruitment of good players.
So, if I were to build my Fantasy Football team, I would use a mixture of all the above systems and tactics depending on my opponent... each has their strong point, but each has weaknesses too.
&nbsp;
* Disclaimer * 
I work for Deep Instinct here in Australia. The first company to apply Deep Learning to Cyber Security. I have my biases, yes, but after working in Cyber Security for 12 years for multiple vendors, my personal belief is that prevention is better than finding a cure.
I joined Deep Instinct because I was blown away by what a custom Deep Learning framework can do to revolutionize and reinvent the way we look at prevention and our <a href="https://www.deepinstinct.com/2018/06/20/meet-mylobot-a-new-highly-sophisticated-never-seen-before-botnet-thats-out-in-the-wild/">recent discovery of MyloBot</a> validates what our approach is capable of. - Mark Arapovic, Sales Engineer Manager
Meantime, to learn more about how deep learning works and why it’s revolutionizing how cybersecurity is done, we invite you to download the Deep Learning for Dummies book  &gt;&gt;
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4" target="_blank" rel="noopener"><img id="hs-cta-img-39c4111b-3a7a-4680-a472-137ad9c7b4c4" class="hs-cta-img" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4.png" alt="New call-to-action" width="800" height="200" /></a>

The World Cup of Cybersecurity - who is in your fantasy team?

INFOGRAPHIC: Deep Instinct Unraveled in 8 Steps: How Deep Learning Works



Interested learning more about Deep Learning and how its applied to cy

deepinstinct_infographicrgb.jpg

INFOGRAPHIC: Deep Instinct Unraveled in 8 Steps: How Deep Learning Works
<img class="alignnone wp-image-3141 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcf22e3a9de01bfef/611a8191e38a40163ef5db66/deepinstinct_infographicrgb.jpg" alt="" width="994" height="1387" />
Interested learning more about Deep Learning and how its applied to cybersecurity? Read the Deep Learning book for Dummies
<a href="https://info.deepinstinct.com/deep-learning-for-dummies"><img class="alignnone wp-image-3003" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta02f8d011e98cb4a/611a81b3ed05ed1671c9f1a1/dummies-blog-banner.png" alt="" width="648" height="162" /></a>

Deep Instinct unraveled in 8 steps [INFOGRAPHIC]

From ransomware, to spyware and banking trojans, the types of malware threats are many. Yet the one threat that seems to be posing the greatest challe

Why-Deep-Learning-Is-the-Only-Option-for-Stopping-Unknown-Malware_2.jpg

From ransomware, to spyware and banking trojans, the types of malware threats are many. Yet the one threat that seems to be posing the greatest challenge to organizations and their cybersecurity solutions is <a href="/glossary/unknown-malware" target="_self">unknown malware</a>.This is because the means that have most typically been used to counter cyber threats to date remain insufficient when it comes to unknowns:Signature-based: traditional antivirus solutions usually lean on such technique. With this technique, key data from given files is signed, and so for next times files are matched with the same signature, those will be classified as malicious. The key data is usually strings, or other byte sequences of code piece. This approach is not adequate since it can only be used for known attacks, based on known pieces from current existing malicious files. With unknown attacks, the signature won’t match anything.Heuristic-based: this is an advanced technique for signatures. Instead of using a fixed signature, some parts of the signature can be random, and so it doesn’t necessarily have to be an exact signature match. The downside is that it is time consuming and works better with known than unknown files.Sandboxing: involves running suspicious files within an isolated environment for a few minutes, while dynamically testing what the file is doing while it is running, in order to understand whether it is malicious or not without impacting the production environment. In most cases, such implementations would be in detection mode, as it is time consuming to analyze and get a verdict, and so it delays on-going organizational work (e.g. receiving emails with attachments). In addition, many malware campaigns are well familiar with such platforms, and have many anti-VM capabilities to bypass detection by such solutions. For example, in a case where there is a match with the drivers, hostname or username used by sandboxing platforms, the malware won’t execute its malicious activities.Machine learning: a branch of artificial intelligence (AI). It allows computers to learn, by feeding large amounts of feature-based data to the ‘machine’ to teach it how to identify malicious files, based on certain file features. While more advanced and coming ahead of signature, heuristic, and sandboxing, one of its main downsides is that it relies on such feature engineering – meaning, it only uses a small part of the file structure, and is based on known attack vectors that are represented by those features. As a result, most of the data goes unprocessed, unanalyzed, and the correlations between the data points do not undergo analysis either. This means that machine learning is partial by its very nature and can never properly or fully pick up on, nor prevent unknow files. In addition, classical machine learning algorithms tend to not be very much accurate, mostly in domains that are not easy to solve, such as cybersecurity. That leads to moderate recall (detection rate) and false positive rate on unseen samples that were not involved in the training phase of the algorithm.Accordingly, none of these approaches fare well in today’s world that is primarily battling new and unseen malware variants.<h4>The Ever-Growing Threat of Unknowns</h4>Yet, the demand for beating the threat of unknowns is only getting bigger as the threat continues to grow at a dizzying pace. Consider these staggering stats, for example:<ul><li>There are over 100 unknown malware attacks hitting an organization every hour; and</li><li>Over 360,000 new malicious files appearing daily.</li></ul>It’s no surprise, then, that in a recent <a href="https://securitybrief.com.au/story/study-says-unknown-malware-biggest-threat-security-professionals/" target="_self">report</a>, it was found that of the 300 global IT and InfoSec professionals surveyed, 49% believe that unknown malware is the greatest risk to their organization.<h4>The Unique Abilities of Deep Learning Cybersecurity</h4>There is one approach, though, that overcomes the pitfalls of other means, as it is inherently designed to handle unknown malware. This approach is <a href="https://www.deepinstinct.com/deep-learning-cybersecurity/" target="_blank" rel="noopener noreferrer">deep learning cybersecurity</a>.For a quick recap – deep learning is the most advanced branch of artificial intelligence today. Its learning method is inspired by the way the human brain learns – taking in all the data and learning from it automatically and intuitively.Deep learning is the first — and currently the only — learning method that is capable of training directly on raw data. There is no need for feature engineering with deep learning, as is needed with machine learning. To the contrary, deep learning can dive into the raw data of the file, without explicitly being told to pay attention to certain features, which have been specified by human experts.Moreover, deep learning scales well to hundreds of millions of training samples. As the training dataset gets larger and larger, deep learning continuously improves. And the third aspect of deep learning that makes it unique is its ability to pick up on patterns and correlations in the raw data that are too complex for any human or AI to pick up on.Thus, its unique approach to training and learning endows it with both intuitive and predictive capabilities – which is probably one of the most critical capabilities for picking up on unknown threats. For, if you can’t ‘know’ in advance what it is, you must be able to predict what it is.Machine Learning vs. Deep Learning<img class="wp-image-2940 aligncenter" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6be9d875f565d277/611a81ca844c89162405ef18/table_2.jpg" width="626" height="618" style="width: 626px; height: 618px;"/>Thus, deep learning is unique among all other cybersecurity approaches and is best positioned for handling unknowns. In fact, deep learning has a specific expertise with unknown files, delivering the highest detection and prevention rates along with unmatched low rates of false positives.<h4>Deep Instinct Is Leading the Deep Learning&nbsp;Cyber Security&nbsp;Revolution&nbsp;</h4>Deep Instinct is proud to make available the first cybersecurity solution that harnesses the power of deep learning to prevent, detect, and respond to unknown threats (and known, of course), to protect any device type, running on any operating system, and against any file-based and even file-less attack. Deep Instinct not only provides autonomous cybersecurity in preventing cyber-attacks from executing on your devices, but also the <a href="https://www.deepinstinct.com/automatic-threat-analysis/" target="_blank" rel="noopener noreferrer">malware analytics</a> and threat classification you need to be well informed. Key features of our automatic threat analysis include an intuitive security management console, attack chain identification, advanced threat analytics, and in depth threat analysis reporting.&nbsp;<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4" target="_blank"><img id="hs-cta-img-39c4111b-3a7a-4680-a472-137ad9c7b4c4" class="hs-cta-img" style="width: 800px; height: 200px;" src="https://no-cache.hubspot.com/cta/default/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4.png" alt="New call-to-action" width="800" height="200"/></a>

Why Deep Learning Is the Only Option for Stopping Unknown Malware

By Ishai Rosenberg, Algo Team Leader

In our last post, “From Machine Learning to Deep Learning, And What It Means for Cybersecurity – Part 1,” we i

Deep_learning_for_dummies_part_2830x569.jpg

By Ishai Rosenberg, Algo Team Leader
In our last post, “<a href="https://www.deepinstinct.com/2018/06/24/from-machine-learning-to-deep-learning-and-what-it-means-for-cybersecurity-part-1/" target="_blank" rel="noopener">From Machine Learning to Deep Learning, And What It Means for Cybersecurity – Part 1</a>,” we introduced deep learning, how it evolved, and its real-world application.
In today’s second installment of our four-part series, we will cover the neural networks that power deep learning.
<h4>The Original Neural Network</h4>
Before diving into the neural networks of artificial intelligence, let’s first take a look at the original neural network that is the inspiration for all this deep learning – the human brain.
The human brain consists of different regions, each of which performs a specific task, and each consisting of dozens of billions of small processing units known as neurons, which are connected to each other via synapses.
The ‘deep learning’ of the human neural network happens when input arrives to the brain, neurons process it, and the more the input, the more and better it learns. For example, when the optic nerve transfers signals (the input) from our eyes to a certain region in the brain (the processing area), the neurons in that area learn to process these signals, enabling us with the ability to see.
Everything human beings learn, everything we remember, everything we do, is the result of this kind activity in the brain. Research suggests that the reason why human beings are considered more intelligent than other animals is the fact that we have many more neurons in the main processing area of our brains, i.e. the cerebral cortex.
The original neural network (the brain) and how it processes information, where the more the neurons, the better (smarter) – is the very inspiration for the artificial neural networks that are at the heart of deep learning.
<h4>Artificial Neural Networks</h4>
The concept of artificial neural networks is based on the idea that ‘signals’ can be received from other ‘neurons’ in the format of numerical values –e.g., the raw bytes of a memory file.
And, when attempting to bolster the capabilities of processing these input numbers by the neural networks, it was discovered that if more layers of neurons, known as ‘hidden layers’, were added between the input and output layers, then the network could achieve much greater data processing capabilities.
Then, taking things even further, in the 1980s when a sophisticated algorithm called ‘backpropagation’ was developed, state-of-the art <a href="https://www.deepinstinct.com/2019/04/16/applications-of-deep-learning/" target="_blank" rel="noopener">training of deep neural</a> networks was finally made possible.
<h4>Training Neural Networks</h4>
The complex principle of training neural networks with backpropagation can be explained with a relatively simple cat metaphor.
Let me explain.
Imagine that you’d like to train a “cat detector.” You would assemble a training dataset with 10,000 images containing cats, plus 10,000 images that do not contain cats.
All these images are of size 30 x 30 pixels, and they are in grayscale (that means a single value describes each pixel, rather than three values for red, green, and blue).
A neural network for this classification task would contain an input layer, a few hidden layers, and an output layer. In this example, the input layer could contain 900 neurons, which is 30 times 30, as is determined by the number of pixels. The output layer should contain two neurons (one neuron representing the “no cat” class, and the other neuron representing a “cat” class).
Here we would have the simplest type of network, which is a fully connected neural network, and which means that all the neurons in each layer are connected to all the neurons in the subsequent layer.
As the neural network is initialized, it doesn’t yet have any useful knowledge. Given an image, it won’t do any better than a coin toss when it comes to detecting whether the image contains a cat or not. It obtains the knowledge about how to recognize a cat through the training process. The training is done in two stages:
<ul>
<li>Feed-forward: where neurons in the input layer send their values to the neurons in the next layer, aggregating inputs to the next layer, and so on, until the output neurons deliver the results.</li>
<li>Backpropagation: where at first the resulting output vs. the expected output is measured to gauge the error rate. Then the backpropagation algorithm is used to backpropagate the error rate to the input neurons and teach them how to modify their answer the next time they receive such input: the bigger the error, the bigger the change in the answer would be.</li>
</ul>
When you’ve finished training a neural network, you must further test the accuracy using a set of samples that weren’t used during the training. This set is the test set, and its purpose is to make sure the network has not simply “memorized” the training set without learning the principles behind it.
Once the results are satisfactory, the neural network can be used for real-world predictions.
<h4>Taking Neural Networks One Step Forward</h4>
Deep learning is by far the hottest field within artificial intelligence today. That’s pretty remarkable when you consider that until a few years ago, just about everyone other than a few research groups had completely given up on neural nets.
However, during the past few years, several innovations have helped overcome the potential barriers to the effectiveness of deep learning, and which now allow researchers to train deeper neural networks.
important contributor to the greater proliferation of neural networks is the use of graphics processing units (GPUs) instead of central processing units (CPUs). This is because GPUs are designed as massive parallel processing units, which excel at performing the same instructions over many different data values in parallel. And, this is exactly what neural networks must do.
Accordingly, with the advancements in the algorithms used in deep learning along with the use of GPUs, deep learning on neural networks has become a new and formidable force to be reckoned with when it comes to the great promise of artificial intelligence.
Meantime, to learn more about how deep learning works and why it’s revolutionizing how cybersecurity is done, we invite you to download the Deep Learning for Dummies book  &gt;&gt;
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4" target="_blank" rel="noopener"><img id="hs-cta-img-39c4111b-3a7a-4680-a472-137ad9c7b4c4" class="hs-cta-img" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4.png" alt="New call-to-action" width="800" height="200" /></a><script charset="utf-8" src="https://js.hscta.net/cta/current.js"></script><script type="text/javascript"> hbspt.cta.load(2183098, '39c4111b-3a7a-4680-a472-137ad9c7b4c4', {}); </script>

Understanding The Neural Networks That Underlie Deep Learning - Part 2

By Jonathan Kaftzan, VP Marketing

With today’s blog post – I am excited to get us started on a four-part series based on our newly published book, 

deep_learning_for_dummies_part_1830x569.jpg

By Jonathan Kaftzan, VP MarketingWith today’s blog post – I am excited to get us started on a four-part series based on our newly published book, Deep Learning for Dummies by our very own Dr. Eli David. We thought it would only be fair to share some of the insights here with you.To get us started, part 1 of this series will give you a brief intro to deep learning and then dive a bit deeper in its evolution, how it differs from other artificial intelligence (AI) technologies, and its real-world application.<h4>The Magic of Deep Learning </h4>“Deep learning is the area of&nbsp;artificial intelligence where the real magic is happening right now,” <a href="https://www.forbes.com/sites/bernardmarr/2017/08/08/the-amazing-ways-how-google-uses-deep-learning-ai/#3e1874813204" target="_blank" rel="noopener">Forbes</a>.Deep learning (DL) is at the cutting of artificial intelligence (AI), driving innovation across many different commercial applications.With the ever-growing availability of more and more data, and deep learning’s unique ability to leverage it for ever more intuitive, accurate, and real-time insights – the opportunities for taking AI to where it’s never been before have never been greater.But, before we get into the wonders of DL – let’s take a look back to where it all got started – so we can better understand why it’s so important not only for other commercial applications, but specifically for revolutionizing cybersecurity.<h4>The First Step in the Evolution: AI and Machine Learning</h4>The term artificial intelligence (AI) was originally coined by the pioneering computer scientist John McCarthy in the 1950s and refers to machines that can perform tasks that are characteristic of human intelligence.The leading subfield of AI today is known as <a href="/glossary/machine-learning" target="_self">machine learning (ML)</a>, where an algorithm is “trained” to&nbsp;learn and adjust itself to improve without being programmed. While indeed an advancement over traditional AI methods, it is not without its limitations. For example, one of the major limitations is its reliance on feature extraction. This is a process by which human experts dictate what the important features or properties of each problem are.As such, this approach ignores most of the raw data. As a result, ML is limited, missing the rich and complex patterns available in complete data sets.<h4>Going to Uncharted&nbsp;Territory with Deep Learning</h4>Deep learning, also known as deep neural networks, however, is different. It is the most advanced subset of AI, going further than machine learning, and taking inspiration from the way the human brain works, where ‘neurons’ (algorithms) mimic the biological structure of the brain.The biggest difference between machine learning versus deep learning is that deep learning is the first — and currently the only — learning method that is capable of training directly on raw data.There is no need for feature extraction with deep learning. Moreover, as opposed to machine learning, deep learning scales well to hundreds of millions of training samples. As the training dataset gets larger and larger, deep learning continuously improves.Machine Learning vs. Deep learning: An Overview<img class="alignnone wp-image-1909" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc143eb549fdb1991/611a82cae8189f1604a23008/table.jpg" width="715" height="548" style="width: 715px; height: 548px;"/><h4>The Unprecedented Success of Deep Learning</h4>During the past few years, deep learning has achieved a 20-30%improvement in most benchmarks of computer vision, speech recognition, and text understanding. This represents the greatest leap in performance in the history of AI and computer scienceץThere are two major drivers for this success. The first is the improvement in algorithms, which, until a few years ago, could only train “shallow” neural networks. But, today’s improved methods allow for the successful training of very deep neural networks – where, the deeper the network (i.e. the more layers stacked up) – the more complex and refined the data processing.The second and even more important driver is the use of graphics processing units (GPUs). These days, nearly all deep learning training is conducted on GPUs made by Nvidia.So, for example, when seeking to train a deep learning framework on new capabilities, whether for image processing, speech recognition, or cybersecurity – new capabilities can go to market much much faster.<h4>The Commercial Application of Deep Learning </h4>With its effectiveness and high levels of accuracy, the adoption of deep learning is accelerating, and we see it already being promoted with <a href="https://www.cbinsights.com/research/industries-disrupted-deep-learning/" target="_self">multiple commercial applications</a>:<ul><li>Autonomous cars: for automatically unlocking cars with face recognition, alerting drivers to potential hazards, and gaze tracking for driver distraction alerts;</li><li>Healthcare & genomics: to predict the outcomes of genome alterations and provide a more precise understanding of diseases;</li><li>Agriculture: to predict crop yields based on the analysis of masses of satellite images;</li><li>Image recognition: sorting and classifying millions of uploaded images for more accurate search results;</li><li>Personal (virtual) assistants: for speech recognition to better understand spoken commands and questions and predicting user needs and preferences.</li></ul><h4>Deep Learning for Cybersecurity</h4>Indeed, the unprecedented capabilities of deep learning present exciting opportunities for many <a href="https://www.deepinstinct.com/2019/04/16/applications-of-deep-learning/" target="_blank" rel="noopener">commercial applications</a>.One area that is just now joining the deep learning revolution is cybersecurity. With more and more attacks coming from unknown, unseen, or recently mutated sources – current AV methods can’t keep up. Only deep learning can handle the task. And, why is that? Well . . . you’ll need to stay tuned. We’ll cover that in our forthcoming posts in the series.Meantime, to learn more about how deep learning works and why it’s revolutionizing how cybersecurity is done, we invite you to download the Deep Learning for Dummies book <a href="https://info.deepinstinct.com/deep-learning-for-dummies" target="_self">here</a>.<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4" target="_blank"><img id="hs-cta-img-39c4111b-3a7a-4680-a472-137ad9c7b4c4" class="hs-cta-img" style="width: 800px; height: 200px;" src="https://no-cache.hubspot.com/cta/default/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4.png" alt="New call-to-action" width="800" height="200"/></a> hbspt.cta.load(2183098, '39c4111b-3a7a-4680-a472-137ad9c7b4c4', {}); Stay tuned for part 2 of the series - Understanding Neural Networks and how it evolved into deep learning.

From Machine Learning vs Deep Learning, And What It Means for Cybersecurity – Part 1

Over the past few years, we have seen various ways of spreading malicious code, one main infrastructure of spreading malware being the dark web.

La

milo_bit830x569.jpg

Over the past few years, we have seen various ways of spreading malicious code, one main infrastructure of spreading malware being the dark web.
Lately, we have noticed a highly complicated botnet (number of internet-connected devices, where the owner can control them using command and control servers), which was detected and prevented in one of our client’s live environment and devices - by our deep learning cybersecurity solution. This botnet presents three different layers of evasion techniques, including usage of command and control servers to download the final payload. the combination and complexity of these techniques were never seen in the wild before.
Botnets can theoretically perform anything – depending on the payload. The payload can vary from DDoS attacks, steal data, and even installation ransomware which can cause tremendous damage.
<h4>What it does</h4>
This highly sophisticated botnet incorporates different malicious techniques:
<ul>
<li>Anti VM techniques</li>
<li>Anti-sandbox techniques</li>
<li>Anti-debugging techniques</li>
<li>Wrapping internal parts with an encrypted resource file</li>
<li>Code injection</li>
<li>Process hollowing - a technique where an attacker creates a new process in a suspended state, and replaces its image with the one that is to be hidden</li>
<li><a href="https://www.blackhat.com/docs/us-16/materials/us-16-Nipravsky-Certificate-Bypass-Hiding-And-Executing-Malware-From-A-Digitally-Signed-Executable-wp.pdf" target="_blank" rel="noopener noreferrer">Reflective EXE</a> - executing EXE files directly from memory, without having them on disk. This kind of reflection is not very common and was <a href="https://www.blackhat.com/docs/us-16/materials/us-16-Nipravsky-Certificate-Bypass-Hiding-And-Executing-Malware-From-A-Digitally-Signed-Executable-wp.pdf" target="_blank" rel="noopener noreferrer">first published</a> by Deep Instinct in Blackhat USA 2016</li>
<li>It also has a delaying mechanism of 14 days before accessing its command and control servers.</li>
</ul>
The fact that everything takes place in memory (while executing the main business logic of the botnet in an external process using code injection) makes it even harder to detect and trace.
When we traced the command and control server we revealed that it was used by other malware campaigns as well which originated from the dark web.
The dark web plays a critical part in the spread of malware: Its rather simple accessibility of services and knowledge has made it easy for any attacker to gain much more abilities in minimum effort. The first example for this, is the shared knowledge in forums: in the dark web, attackers trade methods and techniques in underground forums, thus exposing knowledge to additional malware developers.
Another example, which has increased in the past couple of years, is the amount of malware for sale on dark web markets. By using the dark web, anyone today can access an online market and purchase a malware. Prices vary, from simple malware that costs several dollars to malware sold at hundreds of dollars as “fully undetectable”. Other than the malware itself, malware developers can purchase services that assist in the infection process. An attacker can purchase access to exploit kits, buy traffic of tens of thousands of users to a web page, or even buy a full ransomware-as-a-service for his own use.
<h4>Malware vs. Malware</h4>
Part of this malware process is terminating and deleting instances of other malware. It checks for known folders that malware “lives” in (“Application Data” folder), and if a certain file is running – it immediately terminates it and deletes its file. It even aims for specific folders of other botnets such as DorkBot.
We estimate this rare and unique behavior is because of money purposes within the Dark web. Attackers compete against each other to have as many “zombie computers” as possible in order to increase their value when proposing services to other attackers, especially when it comes to spreading infrastructures. The more computers – the more money an attacker can make. This is something we’re seeing here as well.
<img class="alignnone size-full wp-image-2712" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4fba3ee72221abb7/611a824b27c23615df85c554/1.jpg" alt="" width="817" height="144" />
Comparing current running process on the list to a file located in %APPDATA% (“LoadOrd.exe” in this case)
<img class="size-full wp-image-2713 aligncenter" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff55abf34a8a7651/611a824a41804c1602840f8e/2.png" alt="" width="826" height="408" />
In case there is a match, terminate the process and delete it
<img class="size-full wp-image-2715 aligncenter" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4b438346eb6cf7f9/611a8248e5ae3415fd070ee8/3.png" alt="" width="853" height="318" />
<img class="size-full wp-image-2714 aligncenter" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3f1d15ad1904aabd/611a824aa64423165ba4980d/4.png" alt="" width="779" height="191" />
<img class="size-full wp-image-2716 aligncenter" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt09ecd69091d2409f/611a824805b244160df00311/5.png" alt="" width="782" height="150" />
<h4>The Expected Damage </h4>
Once installed, the botnet shuts down Windows Defender and Windows Update while blocking additional ports on the Firewall. It also shuts down and deletes any EXE file running from %APPDATA% folder, which can cause loss of data. The main functionality of the botnet enables an attacker to take complete control of the user’s system - it behaves as a gate to download additional payloads from the command and control servers. The expected damage here depends on the payload the attacker decides to distribute. It can vary from downloading and executing ransomware and banking trojans, among others. This can result in loss of tremendous amount of data, the need to shut down computers for recovery purposes, which can lead to disasters in enterprises. The fact that the botnet behaves as a gate for additional payloads, puts the enterprise in risk for leak of sensitive data as well, following the risk of keyloggers / banking trojans installations.
Although this kind of complexity in the malware’s structure is extremely rare, Deep Instinct detected and prevented it on a client’s production environment. Once again, this is a true testament for the superiority of deep learning based solutions in the cybersecurity warfare.
For a full detailed analysis of Mylobot, download our free research paper on botnets&gt;&gt;
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/913094bf-e488-48be-9c44-44ebbb020188"><img id="hs-cta-img-913094bf-e488-48be-9c44-44ebbb020188" class="hs-cta-img" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/913094bf-e488-48be-9c44-44ebbb020188.png" alt="New call-to-action" width="1000" height="250" /></a>

Meet MyloBot - A New Highly Sophisticated Never-Seen-Before Botnet That's Out In The Wild

Sometimes we do things “without thinking” and take for granted that we can do them. When you see a picture of a dog, you identify it immediately, in r

CybersedefenceMag-600x330.jpg

Sometimes we do things “without thinking” and take for granted that we can do them. When you see a picture of a dog, you identify it immediately, in real-time and with high confidence. Even if a percentage of the pixels is modified, you will still easily recognize that the image is that of a dog, in no less time and in the same degree of confidence. This is not the case for cybersecurity solutions. Hundreds of thousands of new malware are launched daily, with nearly all of them based on small mutations of known malware (by some estimates the vast majority of new malware are mutated by less than two percent in comparison to known malware). Yet, many security solutions are incapable of detecting most of them. With so many breaches reported on almost a daily basis, is there a way to combat these zero-day threats? We believe that the answer is yes and it lies in applying deep learning.<a href="https://www.deepinstinct.com/2019/04/16/applications-of-deep-learning/" target="_blank" rel="noopener">Deep learning</a> is a novel branch of artificial intelligence that is inspired by the brain’s ability to learn. Once a brain learns to identify an object, its identification becomes second nature — the dog is recognized. When applied to cybersecurity, deep learning facilitates new predictive capabilities of detecting, with unmatched accuracy, any type of cyber threat, including malware that has never been seen before.Most current detection methods fail to detect new malware and&nbsp;<a href="https://blog.www.deepinstinct.com/2015/11/16/the-abc-of-apt/" target="_blank" rel="noopener">APT (Advanced Persistent Threats, the most a sophisticated malware)&nbsp;</a>because they rely on manually-tuned heuristics. More advanced solutions use manually selected features, which are then fed into classical machine learning modules to classify the file as malicious or legitimate (and even then the <a href="/glossary/malware-detection" target="_self">malware detection</a> rates are abysmal). Several methods rely on running the malware in a sandbox environment to obtain more information about it. While this allows for more accurate detection it comes at the cost of protection, due to the time consuming process.<a href="https://blog.www.deepinstinct.com/2016/03/07/deep-diving-into-deep-learning/" target="_blank" rel="noopener">Deep learning</a>&nbsp;has shown groundbreaking results, even compared to classical machine learning, in detecting first-seen malware, superseding any solution currently available on the market. In deep learning, it takes just a few milliseconds to feed the technology with raw data and pass it through the deep neural network to obtain the prediction. This enables not only detection, but also prevention in all cases (the moment a malicious file is detected; it is already removed as well). Our brain works in a similar way as well; it takes us a long time to learn something, but once we learn it, we can use it very quickly in prediction mode.Furthermore, when applying deep learning, as opposed to machine learning, there is no need to conduct manual feature engineering. Instead, datasets of many millions of malicious and legitimate raw files are fed into the infrastructure, enabling deep learning to learn on its own the useful high-level, non-linear features necessary for accurate classification. Moreover, due to the input-agnostic nature of deep learning, any malicious file type (e.g., EXE, DLL, PDF, DOC, Android APK, etc.) is detected.The application of <a href="https://www.deepinstinct.com/2019/04/16/applications-of-deep-learning/" target="_blank" rel="noopener">deep learning to cybersecurity</a> results in cutting-edge capabilities of highly accurate detection and real-time prevention – instinctive protection –&nbsp; on any device, platform, and operating system.&nbsp;<a href="https://www.deepinstinct.com/" target="_blank" rel="noopener">Deep Instinct</a>,&nbsp;the first company to apply deep learning to cybersecurity, is blazing the trail to a new level of protection that effectively overcomes the growing sophistication of cyber-attacks. <a href="https://cta-service-cms2.hubspot.com/ctas/v2/public/cs/c/?cta_guid=5cb932ed-008e-431d-9919-a9b291a6b818&placement_guid=d3ef579d-fe8e-491b-94ed-e2c2a7089293&portal_id=2183098&redirect_url=APefjpHSZWCl0IEBIPu4aR_LUp6hlZ47YOFNfINQHI_mocBrh-KTJaEn_fuZKPf1YYQDIMbUC2r6sDYk62dAlpuyFIIBBBTUSGN8NbuIlwniEfwKfONZOmUiZyi8YLH34y1C4Xv4XV7ouZIE42rfyB98e_Vu7akmekSXLT1JgHvgl7P2Jwknik4&hsutk=c7a000001faf1e16120f0163f4dd3fee&canon=http%3A%2F%2Fdeep-blog.s100.upress.link%2F2018%2F02%2F10%2Fdeep-learning-an-artificial-brain-that-protects-against-cyber-attacks%2F&click=18d3efee-2cc1-4e7e-813b-62cadfbb9eeb&utm_referrer=http%3A%2F%2Fdeep-blog.s100.upress.link%2F2018%2F02%2F" target="_blank"><img id="hs-cta-img-d3ef579d-fe8e-491b-94ed-e2c2a7089293" class="hs-cta-img " src="https://cdn2.hubspot.net/hubfs/2183098/hub_generated/resized/c68d2c81-4fa3-42f2-8dc1-8711c6cb6ad1.png" alt="New Call-to-action" width="800" height="200" style="width: 800px; height: 200px;"/></a>

Unit 221B Validates >99% Zero-Day and <0.1% False Positive Threat Prevention Accuracy

Dalya Guttman

From Dalya Guttman.