di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Storage

Prevention for Applications

Prevention for Endpoints

Data Security: Powered by Deep Instinct

Deep Learning: Prevention-First Cybersecurity

Products

>99% Threat Accuracy

Prevent Ransomware

Prevent Zero-Day Attacks

Why Deep Instinct

Extend & Enhance EDR/XDR

+ Microsoft Defender

+ Tanium

Legacy AV

Enhance Existing Cyber Tools

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Events & Webinars

Resources

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick links

EXPLORE THE PREDICTIVE PREVENTION PLATFORM

End-to-end predictive prevention platform built on a deep learning framework that protects storage, applications, and endpoints.

Prevent >99% of zero-day exploits, ransomware, and unknown threats in your NAS and cloud storage repositories.

Proactively prevent malicious files from entering your storage environment through application uploads by customers, employees, and third parties.

Prevent known and unknown malware, zero-day exploits, ransomware, and script-based attacks before they execute on the endpoint – faster than a blink of an eye.

Leverage advanced predictive prevention technology to protect data across your entire environment.

Data Security: Powered By Deep Instinct

Deep Instinct is the only deep learning framework in the world built from the ground up for cybersecurity.

Unparalleled Prevention

Leverage deep learning to deliver highly accurate threat detection and reduce false positives in a rapidly evolving threat landscape.

Stop threats using real-time classification and prevention techniques to ensure robust and efficient cybersecurity.

Proactively stop zero-day threats in <20ms with unparalleled accuracy and minimal false positives.

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ MICROSOFT DEFENDER

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ TANIUM

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

LEGACY AV

Threat Research

Voice Of SecOps

Leadership Team

Board of Directors

Partners

Login

content_block

Recent Blog Posts

Recent Blog Posts

posts_listing

Blog Listing Page

By: Ally Benoliel, Marketing Communications Manager

Wrapping up 2018 in one of the noisiest and most fascinating industries, I noticed that cyber-a

top_stuff_2018-1.jpg

By: Ally Benoliel, Marketing Communications Manager
Wrapping up 2018 in one of the noisiest and most fascinating industries, I noticed that cyber-attacks are becoming an increasing issue and combating them is becoming more and more challenging. At Deep Instinct, we focused a large part of our marketing efforts, on creating content around the most pressing issues in cybersecurity today.
Take a look at some of our top picks.
Prevention is back! 
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/d22e9c54-f967-4c04-86d6-0d26b3741693"><img id="hs-cta-img-d22e9c54-f967-4c04-86d6-0d26b3741693" class="hs-cta-img alignright" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/d22e9c54-f967-4c04-86d6-0d26b3741693.png" alt="New call-to-action" width="200" height="200" /></a> 

While the number of security vendors has increased dramatically lately, not only did the security landscape not improve as you would expect it do, but it is doing much much worse. More and more enterprises are being compromised with attacks originating on the endpoint.
How can this be explained?
Well for one, there are over <a href="https://www.av-test.org/en/statistics/malware/">350K machine-generated malware appearing daily</a>, and while there are tons of security solutions, none are offering actual security.
If we look back, we can see an <a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/ffcc9f6f-5f5b-4387-90d3-58d48b011274?__hstc=160033954.9dcdf969025385f1e7faa46479d2c985.1529445781258.1544536478425.1544616560878.148&amp;__hssc=160033954.2.1544616560878&amp;__hsfp=3057413405">evolution in the approaches</a> led by security solutions:
Back in the 90’s when the malware was known, the approach was to prevent it. But with time, as the sophistication of malware continued to evolve, the industry gave up on the innovation of prevention technologies and moved into a detect-and-respond mode.
Thankfully, with innovative technologies available, we can now revive the concept of prevention, even for unknown attacks. With deep learning, we are reinventing and redefining cybersecurity “prevention” to its original classification: The idea that you can prevent attacks from happening.
To learn more, download this free whitepaper: <a href="https://info.deepinstinct.com/whitepaper-reinventing-prevention-with-deep-learning">Reinventing Cybersecurity Prevention with Deep Learning: Endpoint Cybersecurity Evolution</a>
Be Fearless When it Comes to Fileless Malware Attacks 
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/22d14362-58b7-4821-8f93-ceb3958690ba"><img id="hs-cta-img-22d14362-58b7-4821-8f93-ceb3958690ba" class="hs-cta-img alignright" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/22d14362-58b7-4821-8f93-ceb3958690ba.png" alt="New call-to-action" width="200" height="200" /></a> 

Cyber criminals are constantly looking for new and sophisticated ways in which to avoid being detected and successfully perform a malicious attack. This was most evident in the past few years. Apart from the rise in ransomware attacks, there has also been an increase in the amount of fileless attacks, which pose a threat to organizations and challenge for security solutions due to the use of sophisticated attack techniques and various non-executable file formats.
The definition of what is considered fileless attack is wide, as the term “fileless attack” encompasses several possible attack scenarios, only some of which don’t write any files to disk, while very few scenarios are completely fileless.
To learn about the anatomy of fileless attacks, and get an in-depth explanation of the challenges and solutions involved, download this free whitepaper: <a href="https://info.deepinstinct.com/whitepaper-making-sense-of-fileless-malware">Making Sense of Fileless Malware</a>
The Rise of New Sophisticated Evasive Malware 
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/645b561f-f16c-4c42-b53c-6ad5fdefe4d0"><img id="hs-cta-img-645b561f-f16c-4c42-b53c-6ad5fdefe4d0" class="hs-cta-img alignright" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/645b561f-f16c-4c42-b53c-6ad5fdefe4d0.png" alt="New call-to-action" width="200" height="200" /></a> 
In the last few years we have seen various ways of spreading malicious code, one main infrastructure of spreading malware being the dark web.
In June 2018, one of Deep Instinct’s researches, Tom Nipravsky, noticed a highly complicated botnet (number of internet-connected devices, where the owner can control them using command and control servers), which was detected and prevented in one of our client’s live environment and devices – by our deep learning cybersecurity solution.
This highly sophisticated botnet, dubbed MyloBot (named after Tom’s dog) incorporates different malicious techniques and complexities.
To read the full analysis of how Mylobot works, download this research paper: <a href="https://info.deepinstinct.com/meet-mylobot-a-sophisticated-never-seen-before-botnet">Meet Mylobot - A Sophisticated Never-Seen-Before Botnet</a>
The Increased Need for MSSPs 
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/d49a7d91-0835-4795-9abf-f540c3562dae"><img id="hs-cta-img-d49a7d91-0835-4795-9abf-f540c3562dae" class="hs-cta-img alignright" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/d49a7d91-0835-4795-9abf-f540c3562dae.png" alt="New call-to-action" width="200" height="200" /></a> 
Today, more and more cyber-attacks are targeting industry sectors and organizations of all sizes, and the potential damages have increased the <a href="https://info.deepinstinct.com/whitepaper-multi-tenancy-security-solution-for-mssps">awareness for advanced security services by MSSPs</a> (Managed Security Service Providers) in order to stay protected.
But for MSSPs to block the most advanced threats, they are required to adopt innovative technologies, such as advanced EPP solutions that are “MSSP ready”, meaning they can be managed in a multi-tenant environment. Currently, there are very few advanced security solutions that can be be managed in such an environment.
In Deep Instinct’s latest release, version 2.2, Deep Instinct added the ability for MSSPs and large enterprises to manage all entities from the same instance and management console along with more capabilities required for MSSPs.
To learn more, download this free whitepaper: <a href="https://info.deepinstinct.com/whitepaper-multi-tenancy-security-solution-for-mssps">Multi-tenancy security solution for MSSPs</a>
Obliviousness Around Employee Mobile Security 
Employees need to be aware that their mobile device is a vulnerable endpoint that can harm their employer and cause significant damage. Awareness that their device on which they use company resources, can cause significant damage resulting in millions of dollars of losses. By raising employee awareness of the risks and vulnerabilities, up to a third of cyber-attacks targeted from mobile devices on organizations and companies can be prevented.
This cannot be denied or ignored anymore, companies must ensure that their employees are well-informed when it comes to mobile threats and learn how to manage situations that may develop, insuring the company’s security. This all begins with AWARENESS.
Read more here: <a href="https://www.deepinstinct.com/2018/03/26/6-key-ways-to-raise-employee-mobile-threat-awareness/">6 KEY WAYS TO RAISE EMPLOYEE MOBILE THREAT AWARENESS</a>
The Need for AI-based Solutions 
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/f4d03b1a-d24a-40ee-a577-7287241a409d"><img id="hs-cta-img-f4d03b1a-d24a-40ee-a577-7287241a409d" class="hs-cta-img alignright" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/f4d03b1a-d24a-40ee-a577-7287241a409d.png" alt="New call-to-action" width="200" height="200" /></a> 

From ransomware, to spyware and banking trojans, the types of malware threats are many. Yet the one threat that seems to be posing the greatest challenge to organizations and their cybersecurity solutions is unknown malware.
This is because the means that have most typically been used to counter cyber threats to date remain insufficient when it comes to unknowns.
Yet, the demand for beating the threat of unknowns is only getting bigger as the threat continues to grow at a dizzying pace.
There is one approach, though, that overcomes the pitfalls of other means, as it is inherently designed to handle unknown malware. This approach is deep learning.
For a quick recap – <a href="https://info.deepinstinct.com/deep-learning-for-dummies">deep learning is the most advanced branch of artificial intelligence today.</a> Its learning method is inspired by the way the human brain learns – taking in all the data and learning from it automatically and intuitively.
Deep learning is the first — and currently the only — learning method that is capable of training directly on raw data. There is no need for feature engineering with deep learning, as is needed with machine learning. To the contrary, deep learning can dive into the raw data of the file, without explicitly being told to pay attention to certain features, which have been specified by human experts.
Moreover, deep learning scales well to hundreds of millions of training samples. As the training dataset gets larger and larger, deep learning continuously improves. And the third aspect of deep learning that makes it unique is its ability to pick up on patterns and correlations in the raw data that are too complex for any human or AI to pick up on.
Thus, its unique approach to training and learning endows it with both intuitive and predictive capabilities – which is probably one of the most critical capabilities for picking up on unknown threats. For, if you can’t ‘know’ in advance what it is, you must be able to predict what it is.
To learn more about the power of deep learning, download our <a href="https://info.deepinstinct.com/deep-learning-for-dummies">Deep Learning Book for Dummies</a>.
Summary
The cybersecurity domain never ceases to amaze me. With more and more solutions, more and more attacks and the continued cat and mouse chase between defenders and attackers, we are always kept on our toes.
My hope is that 2019 will bring a better understanding to the market, that cybersecurity may not be bullet-proof, but with innovative cutting-edge technologies, you can get pretty darn close to it.
&nbsp;

Deep Instinct’s 2018 Most Read Content Pieces

By: blt786b6230d0ad1dfa

Intro
Ursnif (aka Gozi), a veteran banking malware, which has recently been reported taking part in a very active camp

urnsif-1.jpg

By: blt786b6230d0ad1dfa
Intro 
Ursnif (aka Gozi), a veteran banking malware, which has <a href="https://myonlinesecurity.co.uk/large-ursnif-campaign-hitting-uk-using-brexit-as-lure/" target="_blank" rel="noopener">recently been reported</a> taking part in a very active campaign targeting the UK, is also at the center of a concurrent, rapidly mutating campaign targeting North America.
This, together with a recent sprawling <a href="https://www.deepinstinct.com/2018/11/20/emotet-is-back-in-full-swing-with-massive-north-america-focused-e-mail-campaign/" target="_blank" rel="noopener">Emotet campaign </a> indicates that banking malware threat actors are ramping up their activity right before the busy Christmas shopping season and the upcoming holidays. It seems threat actors’ intent is to infect as many victims as they possibly can at a time when they are very likely to engage in online transactions, leading to more opportunities for malware to infect and compromise users, and more opportunities for the actors to fraud victims and drain bank or credit accounts.
Background 
Ursnif has been an active banking malware for over a decade, with several variations of its source code being leaked repeatedly over the years, leading a multitude of variants and “siblings” existing in the wild concurrently.
As with most banking malware, it spreads mostly by E-mail messages with malicious attachments, usually Office documents and PDFs.
Most recently, this infection scheme has been <a href="https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/" target="_blank" rel="noopener">modified and improved</a> to make use of E-mail messages from legitimate compromised accounts replying to existing E-mail threads, increasing the perceived credibility of the malicious E-mail and the likelihood of a victim opening the malicious attachment and infecting themselves with the malware.
Ursnif’s Winter 18’ edition 
This most recent campaign particularly stands out as having a very high number of lightly mutated variants. Attackers are employing tactics designed to decrease the chance of being detected by traditional and signature-based security solutions.
The attack begins with an E-mail response from a compromised account, in many cases on an existing thread, containing an attached document:
<img class="size-full wp-image-4702" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0ae1a0b4f1b616e8/611a8029ffd778164aa236ba/Email.png" alt="" width="478" height="340" />
[caption id="attachment_4701" align="aligncenter" width="1188"]<img class="wp-image-4701 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf12aabcc39c53a86/611a802ba2609d1623b8f679/Doc.png" alt="" width="1188" height="632" /> E-mail and malicious attachment, in response to an existing thread, intended to infect the victim with Ursnif.[/caption]
When the victim opens the malicious attachment, a lightly obfuscated VBA script is executed, which calls for cmd.exe, which in turn runs powershell.exe to execute a short, obfuscate PS script. The script downloads the malicious executable payload from hxxp://abderfiene[.]com/tyclam/fressr.php?l=creb[1-14].tkn to \%appdata%\Local\Temp\ and executes it.
[caption id="attachment_4707" align="aligncenter" width="972"]<img class="wp-image-4707 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7ce54189d32a12af/611a80273badaf16581b055f/PS_both.png" alt="" width="972" height="332" /> Obfuscated and deobfuscated PowerShell code.[/caption]
Each time a document dropper of this type requests a payload from the infection server, the server responds with a unique payload with a constant size but never-seen-before unique file hash.
While this tactic is not new, it is not very common, and is intended to increase the chance of evading security solutions or any other file/hash reputation mechanisms by infecting each victim with a unique payload every time an infection attempt takes place.
Repeated executions of the same document dropper in a sandboxed environment resulted in a unique, never-seen-before payload each and every time. This indicates the executable payload is not target, IP, or machine specific, but rather re-generated per request. We did however discover that the infection server employs a strict Geo-IP filtering scheme which seems to target requests emanating from North America exclusively.
Mutation “factory” and nature of mutations 
The main distinguishing feature of this recent campaign is the variants “factory” mentioned above (hxxp://abderfiene[.]com). We haven’t found indication of new features or functionality with regards to the payload, compared to previous Ursnif/Gozi campaigns.
This domain has been registered on December 11th , and the IP address it resolves to is 46.29.160[.]75. Both have been communicated to by the droppers, and are documented in various threat intelligence sources as serving the latest Ursnif samples as of Dec 12th. It is the same date in which Deep Instinct's telemetry indicated attacks being prevented in customer environments.
It was rather disappointing to discover that many of the samples generated and served as part of this campaign remain undetected by most security solutions. Given the simplicity of the infection infrastructure, the campaign being active for at least 8-9 days, and the extreme resemblance between the variants generated (as detailed ahead) we find it disturbing that such a large portion of the samples are undetected according to multi-scanner and threat intelligence data.
A quick and basic static analysis of a few of the variants reveals the mutation scheme used for the unique variant generation is quite simplistic. All variants are of the same size, share the exact same version info, compilation time-stamp and contain the same sections. The mutation is focused on a single section (.text) of every payload. Being the code section and given that even binary entropy is identical across mutated variants, we believe the mutation is based mostly on code obfuscation, prior to compilation.
<img class="aligncenter size-full wp-image-4696" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4f639152d1eb9f6a/611a802d49650215ea9eb5c1/1_sections.png" alt="" width="1081" height="209" />
<img class="aligncenter size-full wp-image-4697" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt81494de580e09dbc/611a802d4ad2dd166c48162f/2_sections.png" alt="" width="1062" height="203" />
[caption id="attachment_4698" align="aligncenter" width="1091"]<img class="size-full wp-image-4698" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9965f529239a8d8f/611a802c27c23615df85c502/3_sections.png" alt="" width="1091" height="205" /> PE sections from 3 “unique” samples. in Blue – identical sections, in Red – mutated .text section.[/caption]
An additional constant artifact which has been observed across all samples is a shared debug path:
c:\Score\Modern\Fill\Piece\Centurytogether.pdb
Unfortunately, many solutions (including some which are AI/ML based) are evaded by some, or all variants. This is a clear demonstration of the short-comings of signature or traditional ML based solutions in dealing even with a simplistic static mutation scheme.
Summary 
This new, large-scale campaign which is timed at a very opportune time of year, employing droppers of a very legitimate look and feel and an array of endlessly polymorphic payloads, can be incredibly difficult for traditional solutions to detect and prevent.
[caption id="attachment_4703" align="aligncenter" width="1076"]<img class="size-full wp-image-4703" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0b54c32ee171e3f0/611a8029113fce161684570d/FE_image.png" alt="" width="1076" height="558" /> Deep-Instinct’s management console displaying a prevention of Ursnif from this recent campaign.[/caption]
&nbsp;
Deep Instinct customers are fully  protected from Ursnif. All new droppers and payloads are detected and prevented pre-execution using Deep Instinct’s Deep-Learning cybersecurity solution.
IOCs 
Mutation “factory”
hxxp://abderfiene[.]com/tyclam/fressr.php?l=creb[1-14].tkn
Droppers 
5c4a7c26fbb7f079e80aa5bc477fc86c8a8e1a519503cb79ad4117fe83f8c84b
60646a95a9fed1ef84e2e6dc3ef7306cc23e9632434474e3fa78a3f65ca40f37
d87b7256a2ef427c75d7276de07237dc130b6ab1a1a298836ed09e6f18d636fb
e05644a2ca60f1ee15a173f40316470c7ccd90951a73d452af49395b9c2d9744
8079a1ecbb37382833a24c0a067d4bb33bc0babd4946d7b34351de32f7d4ff30
a0ab317544707883e162010535e341848358517f571ce5f186af4dcf9f8099b5
0be10e0e286263774069ed3ff6c05109a87b507440b2030cca639bb7c1736f4c
e6fb279be0838bbdc5e0887bedd11d4799183beb9c2541e4bc69d8ab630dc582
9643456663447feb1eaa9f88bb306b896505668a0148d490d0b23b7f8a5a4620
9190532e0d2bfabc471b98405c8be5c29c19703b861dc69df0f63bf7b642925b
fe4f12f922cbc0f32bd891145ec54dcd64299a4b34ef500a0cbbc56dacd70372
bf68422d00956ad51b45ccd2a0d0ccde609d04532606ffc785b0b715928aad87
15e4611f9c066fc71242fd1b10cceb0aa6f7e54e44ffae711efef43dd72f4ebc
87af97cfcc1a85cf7e60ccf7cd24e4392c141516c331cf653436383894a11952
Payloads 
ec9745408deff472e259c136a1e901f62dfcf9a17c3cead11732225fb44632a1
780b08b821219fa64a14d87eb0eb33ac5cc3ecc634f54cbbf17eb322f61fee5e
b344a945a3fdd33dc042b6032a3c92cd534b7a522953d7fa4ca479554451bb79
233083f200d30e2712d770ba4e9789fc8a88d6cc6acd868736cc823076094bca
7a70c5c48f81b11c889f2db42ba2c4b0393a291ec9ec606adf0fedb2b3ff78c0
5780e1bef78ef18674aa6de21d226165521031fabae7e39569d32e7fb53e6f94
c2ed7a54104e60c900b32f0627c3fefb044fbee73c33ec38e7fd521541a0a741
34793b1f8d86d7938ac9f5b308c39171ba5e89a2319fccece94854e366011e05
ea077f0de5b4a89b84c5c990654ff3a88a26b004a36c9f4a6d8dc46ebb540d6b
6c8640366d06187d06c074d9cea309358fd71b5300342e7d4c154661b7204e7f
1d0f1e94552a606aee3d3121d08b5e278ba6baf9e23beefc114234b1f0b4ce9c
464d85d073f33f1e8f849afb932ba45d39bea336f75414bf89c9a837da92bd6c
d8bac8b56c70923c9a3b64c0d03992670ead26212d98a0e6e327aadadf480f99
bdb7f54163bfa99daabb4a6ac5d64e843e1e5e28558e1a6ff116ad1f910bd9c1
10738dbab8675f9a9884d60e527678291d95422a74892ec7c610a36f62dc6169
a8700b511468741252b32036daf42e44803ca93e1ace17635d57eee099b64bd4
fcceb1d785a912a1e6e4ee903ce9b546be1a05d30ccb27188366824bc6907cca
92bbe38273ef01da146dcc773ccaa35138c9a75d66446faa879a8291e3586cc3
c72797a7ed0a169d3c5573b6fd2f076e9fff0ab325017757f202832948e3c805
05b50d16435b589cf728bbb3d2b3cfc9cbe2b9b9239ba76c3d0598464819f90b
65d869ff2d708bd23f70a04c484b18c0fda788bad52cc2e4ff0d32d7b8b89a95
84d4ec1001617918e327a0b0586879e27e4c342f7108cfd2428cdb0c9bd610ad
1ef6cd6e98a3aac78855e63dbcaf48930fd023a2a57af5f5076e3cb01637e6ea
d17d01b77c2d9f28fc95a3c12b9dff9e74c1687e9512ac88bf90b891e94cbd4e
f5c5594292b116c6eb4054ecc0d6e8791cd4832c63ab5ca4d177b79c4b5199f3
C2 servers 
aershariar[.]com
biesbetiop[.]com
roqualdlio[.]com
zardinglog[.]com
imminesenc[.]com
zosmogroel[.]com
qibricrias[.]com
sycingshbo[.]com
kircherche[.]com
toforemedi[.]com

Season’s Greetings from Ursnif

By: blt2b8a66ae602e419b

We’re excited to announce the release of a new and updated D-brain version!

D-Brain is a critical part of Deep Instinct’s D

new_brain_2-1.jpg

By: blt2b8a66ae602e419b
We’re excited to announce the release of a new and updated D-brain version!
D-Brain is a critical part of Deep Instinct’s <a href="https://www.deepinstinct.com/">Deep Learning</a> based malware detection and prevention engine. D-Brain, built of Deep Instinct’s proprietary deep learning architecture, is the core component of our cybersecurity solution. D-Brain provides unparalleled accuracy in known and unknown malware detection and prevention and covers a wide range of attack vectors and file types. A new D-Brain version with new capabilities and improved performance is now released as part of our continued efforts to provide the best <a href="https://www.deepinstinct.com/product-overview/">malware prevention</a> and detection available.
<h3>Background</h3>
D-Brain training cycles, in which millions of benign and malicious samples are fed into deep neural network architecture, occur in Deep Instinct’s labs. In the training process D-Brain learns to identify, recognize and distinguish between malware and good-ware. This process happens only a few times a year due to deep learning’s powerful prediction capabilities and resilience to the ever-changing threat landscape.
The end- result of a training cycle is a production-ready D-Brain. D-Brain containing a trained neural network, can then be deployed, and run in prediction (inference) mode. Prevention and detection decisions made by D-Brain are used to prevent and detect the newest, most evasive and most challenging attacks in today’s threat landscape, across multiple file types, ranging from PE (executables, DLLs, drivers) to document files and additional formats carrying sophisticated exploits. D-Brain is used to prevent even the most unique and rare attack vectors such as exploits in malicious font and TIFF files.
<h3>From Collection to Training in Deep Instinct’s deep learning architecture of neural network </h3>
Data Collection and Labeling
Data-sets used for training the latest D-Brain version were sourced from a sample collection that includes well over a billion files, both malicious and benign. This sample collection, along with all associated metadata, file reputation and prevalence data is processed, labeled and stored in D-Cloud, Deep Instinct’s threat-intelligence and file reputation cloud. D-Cloud is continuously fed with samples and metadata from many different threat intelligence and file reputation sources. D-Cloud’s wide accessibility and accurate triage and classification schemes, enable us to create training data-sets which are not only extensive in numbers, but also highly accurate in labeling, and provide the widest possible coverage of the threat landscape from various aspects such as attack vectors, threat actors, regions, mutations and more.
Challenging the Brain
In addition to collecting massive amounts of in-the-wild malware, we challenge D-Brain as it’s trained even further, by introducing never-seen-before and highly evasive samples and exploits. These samples are curated based on several sources: unique access to dark-web forums and communities, publicly available malware which we independently mutate, and our very own home-made, self-developed (never to be used ?) malware.
Deep Learning and Training infrastructure
Publicly available DL frameworks are not intended and indeed cannot deliver the performance, adaptation, scale and data-handling requirements for cyber-security related implementations. Therefore, Deep Instinct, has internally developed an end-to-end deep learning framework customized to meet cybersecurity needs and deliverables. Our deep learning framework allows us to train on hundreds of millions of files in a matter of 24-48 hours.
Latest improvements introduced to the framework make it faster than ever and more robust. During the creation of the latest D-Brain version, multiple training cycles based on a few dozen different data-sets were run, which resulted in dozens of different neural network model versions. We selected the very best D-Brain version for production release.
<h3>Performance and detection capabilities</h3>
Here are just a few examples for some of the improvements and capabilities of the new D-Brain version:
Office and RTF
D-Brain detects the newest, most widely used and most challenging threats and exploits found in today’s landscape of document-based attacks, including those based on embedded or dynamically loaded OLE objects. The detection of more traditional malicious document using Macros (VBA) and older Office/RTF related exploits is higher than ever. The unparalleled detection is matched with a false-positive rate as low as several digits after the percentage point.
PE files
D-Brain now demonstrates detection rates that are better than ever, across threat types, attack vectors and threat-actors. This ranges from simple unwanted applications (PUA) to sophisticated ransomware, crypto-miners, financial malware and APTs. In addition, accuracy has been improved in the PE landscape as-well, with false-positive rates lower by an order of magnitude compared to competing solutions.
<h3>Summary </h3>
D-Brain is the only static engine that is purely based on deep learning and has the widest coverage of the threat landscape based on artificial intelligence. D-Brain 109 is another milestone in our continued efforts to provide the best prevention technology ever.
&nbsp;
Do learn more about <a href="https://www.deepinstinct.com/architecture/">deep learning architecture</a> and neural networks, and how it is reinventing prevention - download this free whitepaper &gt;&gt;
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/ffcc9f6f-5f5b-4387-90d3-58d48b011274"><img id="hs-cta-img-ffcc9f6f-5f5b-4387-90d3-58d48b011274" class="hs-cta-img" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/ffcc9f6f-5f5b-4387-90d3-58d48b011274.png" alt="New call-to-action" width="800" height="200" /></a>

Congratulations! Now Smarter Than Ever, We Got a New Brain!

By: Jonathan Kaftzan

In last few years, the number of Infosec vendors increased dramatically. Though as you would expect the security landscape to 

prevention.jpg

By: Jonathan Kaftzan
In last few years, the number of Infosec vendors increased dramatically. Though as you would expect the security landscape to improve, it is actually doing much worse than in the past.  Nearly two-thirds of enterprise players have been compromised in the past year by attacks which originated on the endpoint, according to a <a href="https://www.barkly.com/ponemon-2018-endpoint-security-risk" target="_blank" rel="noopener noreferrer">Ponemon Institute survey</a>. The report says that figure is a 20% increase year-on-year.
Ponemon Institute showed that costs of a successful attack increased 42% year-over-year – with attacks on SMBs costing an average of $7,120,000 ($763 per endpoint), nearly two times the cost per endpoint for larger organizations ($440).
And, perhaps most astonishing, the survey showed that respondents estimated their current anti-virus platform is effective at blocking only 43% of attacks. This is because these solutions are only effective against known malware.
The report highlighted that the biggest threat to organizations are zero-day and fileless attacks.
The reasons for this may vary, but 2 main reasons are that over 350,000 machine-generated new malware is created daily which makes it almost impossible to have an effective solution against it and because many of these security vendors do not offer actual security. While they may offer data management solutions, BI suites, ways to analyze data, and different post-execution and post-infection management solutions, it is not what real security should be all about.
<h3>Prevention vs. Detection </h3>
In life, there are situations in which you want (and need) to prevent things from happening. For example, always better to put up an effective wall to prevent an intruder from getting in rather than have the alarm go off when it’s a little too late.
Same goes for cybersecurity.
Originally, the concept of cybersecurity was all about prevention: perimeter security, anti-virus programs – these original security solutions were about prevention, meaning not letting bad things happen or enter in the first place.
<h3>The Evolution of Prevention</h3>
Looking back at cybersecurity, in the early 1990s, technology was not where it is today. Once hackers realized what they can gain from cybercrime, they ratcheted up their game. The intricacy, impact and scale of their criminal activities quickly evolved. Polymorphic malware and encrypted code caused anti-virus programs to become less effective and that led to an assumption – wrong as it may be -- that it was not possible to prevent malware or unknown attacks.
In a way, the industry started to give up on the innovation of prevention technologies and instead moved into detect-and-response solutions.
However, thankfully, through innovative technology, we can now revive the original concept of what security is and should be about.
Hackers today have all the best technology readily available. So, the security against these worms, viruses, target breaches, IP theft, spyware and ransomware has to evolve, too.
Deep learning in cybersecurity, reinvents and redefines  “prevention” to its original classification: The idea that you can prevent attacks from happening.
When you prevent things from happening, you can save resources, costs, damages, time, and your reputation.
<a href="https://www.deepinstinct.com/2019/04/16/applications-of-deep-learning/" target="_blank" rel="noopener noreferrer">Deep learning</a> in cybersecurity is the most promising and most important technology today. Actually, deep learning has revolutionized pretty much every field it has been applied to. Deep learning has advanced AI and computer science by leaps. Deep learning is motivated by a prevention approach, and prevention solutions are the future of cybersecurity.
Real-time prevention harnesses deep learning technologies and provides 20%-30% better results than currently available cybersecurity solutions.
Real-time prevention means producing high detection rates and low false positive rates. Real-time prevention using deep learning in cybersecurity is specifically designed to keep safe any type of device, any operating system, and any file type.
As such, today’s real-time prevention technology is an essential cybersecurity solution to get – and stay -- one-step ahead of the next breach.
&nbsp;
To read more about the different approaches over time in cybersecurity, download the whitepaper "Reinventing Cybersecurity Prevention with Deep Learning"
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/ffcc9f6f-5f5b-4387-90d3-58d48b011274"><img id="hs-cta-img-ffcc9f6f-5f5b-4387-90d3-58d48b011274" class="hs-cta-img" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/ffcc9f6f-5f5b-4387-90d3-58d48b011274.png" alt="New call-to-action" width="800" height="200" /></a>

Reinventing Prevention: Deep Learning in Cybersecurity

Emotet, one of the most prolific financial malware threats of the last two years is being spread en-masse these days as part of a wide E-mail campaign

shutterstock_394552096-1.jpg

Emotet, one of the most prolific financial malware threats of the last two years is being spread en-masse these days as part of a wide E-mail campaign. Since the beginning of November, Deep Instinct (as well as <a href="https://threatpost.com/emotet-campaign-ramps-up-with-mass-email-harvesting-module/139041/" target="_self">other security vendors</a>) has witnessed a significant rise in Emotet activity. Emotet variants that <a href="https://www.zdnet.com/article/emotet-malware-gang-is-mass-harvesting-millions-of-emails-in-mysterious-campaign/" target="_self">surfaced in October</a>, included new e-mail exfiltration capabilities. It seems that threat actors behind Emotet are now using harvested email accounts, trying to further expand the malware outreach.Data from Deep Instinct’s D-Cloud (Deep Instinct’s threat-intelligence and telemetry cloud) indicates the attack is focused in North-America, with some targets found in other parts of the world - EMEA and APAC. We have spotted targets spanning across multiple verticals such as healthcare, education, financial services and hospitality to name a few. Since the beginning of November, we’ve identified and prevented thousands of attempted infections, carried out by a large set of droppers and 2nd stage payloads, which are mutated repeatedly on a daily basis.<h5>Background</h5><a href="/glossary/emotet-malware" target="_self">Emotet</a> is one of the most prevalent financial malware threats of the last years. It first appeared in German speaking countries in Europe around mid-2014, and after two years without signiﬁcant activity, Emotet reappeared in 2017, attacking mainly in the UK and US.From its very ﬁrst version Emotet spread mainly via Spam campaigns, imitating financial statements, transfers and payment invoices. Once it is dropped and run, Emotet intercepts and logs network traﬃc, injects to browsers and tries to access banking sites, in order to steal and store financial data.In recent attacks (as of 2017), the dropper in use is usually an Office document containing VBA which downloads the PE payload, which might also drop additional malware. Emotet has developed since its reappearance in 2017 when it started adopting new evasion techniques. One example is searching for common applications found on security products such as debuggers and for common usernames found on sandboxing environments. And another is a rather rare code-injection technique where instead of using RunPE based process hollowing for injection, some new Emotet versions use windows API functions to create a Timers-queue timer, which call Emotet’s payload instead of calling the windows API callback function.<h5>Emotet’s Back, Again…</h5>Since its return to the financial malware scene in 2017, Emotet has been replicated and mutated frequently, both manually and by using automation to generate large numbers of variants. Emotet’s samples are based on continuous mutations (which vary in scope, complexity and evasion) of droppers and payloads for each target or attack wave. The latest attack wave is based on a set of mostly simple mutations of several dozen newly prepared droppers and payloads.In several occasions in 2018 Emotet’s infection infrastructure and droppers have also been used to spread other financial malware/spyware such as Trickbot and Dridex. We can confirm this is case in the latest Emotet campaign – several droppers communicate with C2s serving both Emotet and TrickBot payloads.As seen in previous attacks, the current campaign’s emails are financially related.<img class="aligncenter size-full wp-image-4710" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4b23bd14400c3ad4/611a80255739461637def3cb/Picture1.png" width="845" height="456" style="width: 845px; height: 456px;"/>[caption id="attachment_4711" align="aligncenter" width="839"]<img class="size-full wp-image-4711" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltedf1e5c6125d9dea/611a802521164f161dab5d47/Picture2.png" width="839" height="579" style="width: 839px; height: 579px;"/> Spam email and malicious attachment of the Emotet dropper, from the November 2018 campaign[/caption]&nbsp;&nbsp;The droppers are either PDFs carrying malicious JavaScript or MS-office files with an obfuscated malicious Macro embedded. The content of the documents aims to lure users to allow and run the active content which is essential for infection to occur.Once enabled and run, the malicious script (JS/VBA) will drop and execute Emotet’s payload with a simple cmd.exe command on the victim’s machine. As mentioned earlier, in some cases, the payload dropped is a of different malware strain known as Trickbot. This recurring scenario where Trickbot and Emotet share dropper and payload distribution infrastructures, or one is using the other as a secondary payload or a loader, might indicate a shared backend environment, in attackers have implemented a logic or mechanism which controls and decides the malware to serve.Associating many of the new payloads to Emotet can be done based on several static artifacts known to be related to Emotet. In addition, Deep-Instinct’s deep-learning malware classification module (a secondary neural network used to classify malware to threat types and families) classifies the payloads which are part of this campaign as Spyware, immediately upon prevention.[caption id="attachment_4758" align="aligncenter" width="974"]<img class="size-full wp-image-4758" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0098c78187874368/611a7fbff01a3a162c1ef8ea/Picture3.png" width="974" height="452" style="width: 974px; height: 452px;"/> Event page in Deep-Instinct’s management console following Emotet payload prevention[/caption]&nbsp;The new, large-scale campaign proves Emotet is here to stay and remains an imminent threat. Its polymorphic and mutating nature make its detecting challenging to many anti-malware products. New dropper and payloads variants are coming out daily and are successful at evading a wide range of solutions as is indicated by reports of infection as well as multi-scanner threat intelligence.Deep Instinct customers are fully protected from Emotet. All new droppers and payloads are detected and prevented pre-execution using Deep Instinct’s Deep-Learning based solution.&nbsp;IoC (prevalent samples)Droppersefdfe8f4b5aada41e97e47e1c439a2695e656c71dd973bb7789b13f5163877972074fc77244a06c505e78a81d8e97bb0869aa3f7812aadb2a8b8e8a1cf3c95eadaaf91eb4fb13da6233472df892398bd2ea8cd115398d7087121d6d42b0701edfef1c172e68f5812e669577b7d2f003cd0dc533d4d3d041f0f5969a40e39895b7eddb2b15af34d65a8aaf5a891cddfc60bf278f6de6bede09c76e854363e50b0533da9e9871ee55d5d60c2a7290f404948e75e1c18582e02d3df5ae0583b9ac2a809d9fddb75b1643e8aa4b77600a988f6649592603177a406a33629fc2577d11112203340b2d66f15b09046af6e776af6604343c1e733fe419fdf86f851caa31f09bdbe1013422deff83817196f4c3bf6a9c83481c485d69851c0c0ae9d5f929c1468cf0ec8794f7a75fb8537e1a42e24436bcf63298792eb62ff55ee517f38ba154a65b97dd287b4b85191759be5cae2bfb1b663bd5f6269dea7cb5e80f3a234cebe5a052d2d3a5c23059350443b4e6a133983029f9f8c3d275bb8a342402dd610a705417b20cca16f07ded6445e844816e83747cd3655c5191fb0ed6615916a34569bf87487070e6ddd5896b403b7dffb7d9a29341fda5813151a3511aaf600ad96a25485e893980b4d37bc4c8146c8b14644e4d6f9b6f6c4af9c2cd8a86c02ed455630207e7d6f6fcd205d5f041f7721d474e39ae6c95194952b23e63cdf064a9ec44e485f80efa82d29122c82dabb268dcca5b18ab6fe114ee657a6a84d0734985f67598ec0a0caf9ca31edd54bc93c5072ab0facc09f3d5164c8930afe0b15a15c61725f6f8f8981dc8ae068752de11018877c161bc578669fbdf65a610e8bb19a89fb67502ac0bfadf9f7e9cb0a1f6a239e886ab4d0066209cde3b0e219b5e022c1cb7ee7db9d922e90f885926db5e051ae54cdda107a3b98fc1b7dbb1b70d7e452d68eee61465edc3c8adcd7cf4a1ec155e8ddfe846db68c6807f9a0240be36c2dd40f30dc6ed9439b1d03b8ec602de20d52fa2c0c19411d365ac7c52ec4615e010a107133c1480a3a3a703a38924e64995b212ca50c65a57e88492d2f7ee884d642d6bb0c92907c1322face20646abde7ea4e3ccaee8cdd65e7bed8385a7461909257b9a1b154ee0a0f4db583283f741de418d622adbf7d32a4cb8a3a8c93b83bbf3a15771881a49594ad822947aee3cc5010f92817b02db7b3a54f4862ce1febc9746994796ede4ec763b77112fde15e63eeff5e1056cbec55adf44aaac5950c0405bd5afd633c56330709075d0f7b4afe49eb2842985db5ff6faa528ea86eaf014de4edf23460006f8cdff14824296552cf2f9db3d1ad03a2880f56d209dd8183f988088d5465f0035062f3c52c7541924a851cb7bba4564dac9d5c534ae4e830cf73ddc02a19368138b60bfe0cd8ab12d1bb89106872fb73553960c17dc600c05fc34a7ac198d6ae84f56c45f10dbddbb2f03420e7b0201d40f1617a25491c3d643a73d54effbd4352cfa35d47078a76d9fee607961f0573bfac70bb6ec457f876eaf97f6c27d88e7024b7ebf888fcd404573e5ce458d59cc27d7176349ecf5ae7f73d255fd3144b5c7bfff57f814afcdec7b62c9dd788b6d53a75b87903540c9362854bfb71f79dc3408a370b1c7aa829af6d12d04fa62fc0267c0fb0e2bcd06fc2182b48d3833173c373fc000ad30c9006e9ead9ec1a6f26fd8039cc157c4e9043521973fed5b0fe6ad374874063ebee389060272f61024da391df6bf7a128fad2e1fbe9e9af70539984717c40d96fd69ca007c26901c48b9caebb81a6d05b646ad0c345c4ef4b4f8a1ec08d703cd48f1d4f149095f47e7a1aba582d3578f14646617e19847cd2f2cb340f24d210131ad60048b4f15548a16bbb8473cab0b5d82cce325a1cfcd434e0641a52d0c100376fdbf6290c1a5af688d1d239d52d6332a737259c555ed2014ae6637e1c06fbe2fbb7bd3b180f8802f5d207d1043348768094e636fdb28bf8b4e1e49cff3196360d5317aa168fa396f9d66c21e2f60e2d27d3120457f9985791253e4e67df66a0f7efda961788005c06d787f37aaaa575b0a19aa886fbc8b78743a0834f5f75462ba34d9d894df211e5ddef4d5d13f37b145e50bce81b79c4b2108c76f17bc2295c9c20424bba55935ee9daffb5fc1ef635eca9afcde827b82221c1f6905c6b2d4ba1922f922ed96808ecd992117410d1a83ae3acca3499415387d7f3f73125de93c61c55426c2c36a8f07be30c7f7158311ebad7481f2a5cc2e3f2a97a80b68882f727a0ece5356668f247b6d306315dfaf756021628b33b4e6865109329b1bdff4632e9b9635c51dbf898411e938a4016c3af84a9a75466b2eb4eb7d0bd0f37bf0c84c242f39c9739fe82376ba340ca82e24462e88ec7b4f24a02063d0230c7d2371b0d458af5c5a4ffa274f2e3086a6ee4fbb8cacfa7f2e28026362481109ee0f88141016d51bbbb01392dbc6794f27b39606bddd5726b1534f649bb2d36f1f6e837f8931d09904410e9aeb45fd32f385d5fef1cc9d46a434421da798a87ddacd1327701363921f430b8cbdc6fa7ef8f110b27ecf1117b889a778d4e3f62d35e9e1a5df3d1a5f03d4ef4ab4a8bd718f5c3e475e9c11c3d15b72d6c9475fd36974c1e719a0b23194d56b2232c9bbdc0730880e3b29c9a791b18dff5bc7f25cad6fac2b2b8fe8d14146bc84cca2436f09a7211dc2466ba696f8ff0c70278ab53d10df7443266aaa17b97d93672bdf6b1894bc079f0afd621ab878accbb5d52eee457df3d02b809f9849deb9c2ab558a4dee62dc1da89e238854c31d96c175c88e501d76925a58f834ca2ca4385f6cad68879e4d279c0a24bbfb8e105e9ba54397e87ee1f5433822e7fa54e00135723727834499e280282d93ffe9d6f79adc224b012a2e3660a0c03a2c06786289db6e826a8b2e0129bf90355bec19d6bf399ce3fa5603537ddbdcbd9c4867001647e4cb6ad3a4b768964343ac732b6b4d41b0dcdae3595f1c81ea4fc091311a798e62667b9752bd7c7e6812caa44f30974f29bd6b8697f4a87cb3e423599f8ecdbec7b5876a8304d7b8809c0f426161008fb2478dcb2f446fd0edd034b24be8697cb45f22249dab86c46bd77cfdd8eac2c237aecf0d14de99578ae5360b7acb9e2b35a4b1b8ca59cacc57fe2642296065b25ba458f3781beec4f6da979af46ab095b237cd3f36807e493ce8690cb581d349f69615ce8174f9fa86e979ecc92a2bf0415036c3baad32b8caf8379568b40df61f617750d0cc4265c4d939f5e0f806d5d048806b0ea77022247cb940c6b098a0598fcdd8bd387ac355af3a33fa1158321b7f44681e836c4cf5cb6b5114da52d8dcdf1d35c56f5525925f9cae3f836be95674521b1462e02d55449147d95663d85a69dde1af58f34df91c6d3f24f89e57eab8d5ffdae152a8b24f49fef773c4cad82f486acc660055c02e3d7e8e6c0630b3874f2bf7de5a10a588c39c409b9e75d28dd7972f5140f08030bda9f6f8155360ade1fe357630959f7a73869d11d8e04714dfa7bded6a79014aadd51dd3d7c04547597afcfc31e5f0c3af528745003c1691260dcffadbcd02ef9de6fb65182e86c22b9112a1e6f03b425cf9552d513551a9d0b4f1e5cc48f3fcff224a5440bd277d7208c4d62d80e81bcc322f19a360c8aa27d1459747c743a61f605ae380f52ea5a42c0f2de6e16f0c000cd242131cbfbff359f3cb6f7b25c9b0016e9e223d9ae55eadaf9f0292c25feb4d7dd0430b6f86549e8f586504a746d03728e25298349487fbdfe05c773c6c708caa5426f22762a4a11d5d0f7c41a8210191c86a3ad4e1f88cbe3c2cdd0fc9b87b7f06b567dbfa30adaff783017ea921aebfb780136439c31d8ae0cfd38945c7d66665a65b7b7aad5e4926ed5827c731ebcecb51f02464ffe76c566dce08bca74af6f0213e4e62ae554bcf7edd8e36e2074aa67a1a9dd4573a5fd34359e9a0b551faff26cb55f4f67593036944adcd528b434b6d8ba77390fddefe16ba0e488d507211b384d34cf3eead7fc5a95a9982e8c933b1a647c86a2b97c1aaad5f8670272f3a6cd991bdef59513f9e951612739a36eee98f1e55f71b6bf80e9c87f4f9c1683c45739075dcc5241e2e98bb6003b971f116d4dc6f32146729441cae789e3fb4860f435fe1647e70a63f1655a4a4a455e0a53007d2bc3092d2ed1ba66ca53993255f154100d6e4675822aeff9474dd713cba9002fb3d769973a7cb59fd21e304ebbdc48c2814ff0692d69201e64518b13f6ba63ea1a958fe82f06581710a8ad9d88fff4396500be1f21e678330c57d24769c8dd4ea3ef673402fc8768d27f9d231ef22baf1d42dd648e8859b55458b152ad9500d8df9bf401cfa0505f03012ea99f5b216f78a6c661473c8967c3633b5b4541f0f037760050ca6a8b8717635ee4ce76baa1d4717d7b0f08ae0bb871149b457bea5c3cd9746f7a00ba499e42e461acf87f260bdc64b17e12af64d473d7f5cabfc82d7bd8a54e03ecb51567d81ac5dfa8dc1bd36670daede4e6c4828a30d1c386b48bcc6e7aaeb05493d97225552a0976bb4ce958a10b00af264baeab4e5d7bc57b1ef35f09d0f12a20f770d17ab10e22e6d2c66397072da9257ce8aed428c7d35f2f06ac9d19d16329e6c7cf8ea3bdfd5e393a39566a73bb5b7cceb303dbd7790be21de9b61e812537ef369ce7327fd536f46dbe3105f7c0273c80bcc03fc3afc5c709d0ffe34346895f0dde4ca74c900e855e4eea4d9ef40457fadc296220562c8ed2aa0ae5f99ff692826a82711c4d7dab4d62e330e1b4aebdb2e7dcbaaec834d3b3accd527299f71fd1056b9b88e5156d83ec6e928d13872177f3dfd5cbe82858026348fb76b9400e5c810b7642553dc08220a4261f158fa8b0ff5a9627b2c8c3871d4dbaea80dfc3c94f35f7f80d9f92203a1a638e68e4b3f61112608cf6deef9ec6ada125d068e84fa67d6b081e26753860de055d86907e9dPayload5f0df0c31c47da2cf9e379f392144bf8d2437d436d9ea7c14ff07f5d04a705e70ea0d10daa8441022afe01bc1bdae16d5a858b77311c3f71a6d1c535e645e62386b7c8c206ee81e2396a1c16a1014d3759479db9b133cb1906ad33e06cf915e9f2cbb164dd9defb79c2bc94f075dfaa84cd9fd285f44b8ea1d7ca1c81a537c22d69a3f1620bf2a442cd584a0a657fc93b47d4f08f446ca84f1d5471e669a59b9ef2301ce298dc73ed2022e5607400e8ce00a563ea2e6d78cfdafcfb7612fa8297c359f37bc807c4c2daf5b8f6b705f70f4fbf6fc62b4e02d48cb6b9679b274b021248a7f14f2159fd4768e64b1c531358a793c558966dca00aefcbb7ed217c678906c39fab5491d47a9502ff8914949afc920914257d31fbc7f92d8d58576b68a25625f7d1e3bcd30477059562cfa0d0ec618fc076d73b3ca02beabde7a5a601e6c95255a8926b0f99d7b83bd00b7062bea8e815838e7e8cda471edc32253ffb10339b0cc22729340f8e538735d29b8839fe325bb8d4f70a33026765dd7f71b2951f1946669138459a5185ea594d13fa358486cf05daab305d4174c1a1cf0579b2c5e2ce8d94d854f39b418afdbb373e1cf9e40d273046255350366e177156b98f3f1ddad7c13b3757ca200fa93d2afd33c52b1c7dc2f27caa8ecd989291f748a149821063817e9473392d7b3e330db8e4bfbba989bd8ad5f0ad31a1e0629ecce468da459d9023c5e6a64e2aa3bea761d05e423cea3f6e594f0569bc922ea4162b9084bebcb7655879818bf44c15571ce3161e8dd9b3ef5c8387e9c598c0234d2b641d37a926b7050f9fa179e6cb3439d0eea4e66b9ce4cd84d4ee3c60446c4f95caccb8371619ba3b340f6bf82b965db08b24286aa75ddcf71e9cde14d34180582e0912fee577fb52ea5f06ec43a8b241f4baa431ef1ed3a575f7ec0a11a51e42d1d8cd25db430abe8c665e361fc249ecf773b63721dd52c2db8e12be5095625cfd134c67b2ea0ddd16a2b7f1e639f4b71301efe22775ce5639a2338ff8576f9155a2f84c7a36f27deaa0a3f63bbcb426ace329e10edcbe7d9a8aa8a20cb133e3b29504f62f153921f4f91260c2a7288deeba3c1c8978ed101191a0ebd8cab9da07fc26a9dded88ef3c27f0cd5145f68620fb599f2d56ce1675a801bfa878ecafbb5d83f5c9d104a2e478a05d4350f9ad01aa82b66554f452f1336005461346412d5f1887c34fe7ee92a3fa9328c6003edfd345ad9020f1aed42a4a81341e3796650fb7488f2d2b7c6c88f5b02428cdc5b54a61f513a28b290450d10b24ff08667cda76b582c0771f85ad12167238e0f4bb12f479030d99c8a15d7f08eb9975

Emotet is back in full swing with massive, North-America focused E-Mail campaign

By: Deep Instinct Product Management

GDPR, a set of regulations that places new restrictions on how companies handle personal data, is about much m

gdpr_blog830x569_2.jpg

By: Deep Instinct Product Management
GDPR, a set of regulations that places new restrictions on how companies handle personal data, is about much more than just updating privacy policies. With more and more cyber-attacks in the headlines, the way people are protecting their data has become more crucial, and GDPR marks the turning point in security policies and is redefining the way we protect data.
We’re happy to announce that <a href="https://www.coalfire.com/">Coalfire Systems, Inc</a>., a leading independent industry provider of IT security, governance, and regulatory compliance services, has validated that the Deep Instinct Real-time Threat Prevention Platform is <a href="https://info.deepinstinct.com/whitepaper-gdpr-coalfire">suitable to meet the General Data Protection Regulation</a> (GDPR) for protection of personal data.
Our real-time threat prevention platform predicts and prevents known and unknown malware, across multiple vectors, and provides true adaptive defenses against the most advanced cyberattacks.
The European Union (EU) GDPR replaces the Data Protection Directive 95/46/EC and is designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens’ data privacy, and to reshape the way organizations across the region approach data privacy.
The GDPR not only applies to organizations located within the EU, but also applies to organizations located outside of the EU if they offer goods or services to monitor the behavior of EU data subjects. It also applies to all companies processing and holding the personal data of data subjects residing in the EU, regardless of the company’s location.
According to Coalfire, “Deep Instinct supports GDPR Article 32 and 33 by recording any relevant activities (detected or blocked) that could result in a breach. The Deep Instinct UI console provides details about malware activities that were detected or prevented. Malware events can be investigated further to confirm when the event occurred, the status of event, the type, threat severity, lifecycle of the event, process chain information, and the affected device details of what happened.”
Coalfire conducted the validation by completing a multi-faceted technical assessment which included technical testing, reviewing the architecture of the endpoint solution, compliance validation and additional testing to cover macOS and the behavioral analysis feature developed for Windows.
“GDPR has made major headlines in 2018 and will continue to do so.  Deep Instincts Threat Protection Platform is an advanced technical measure that can support a robust cyber defense strategy” Said Nick Trenc, Practice Director at Coalfire. “A robust cyber defense strategy is a vital component to ensuring the privacy of personal data is maintained.”
By using deep learning, the most advanced AI technology to prevent threats that can steal private information from company employees and customers, we remain committed to delivering the highest level of protection.
&nbsp;
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/f4959e43-eab2-4f9a-8466-976f9e1c73a1"><img id="hs-cta-img-f4959e43-eab2-4f9a-8466-976f9e1c73a1" class="hs-cta-img" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/f4959e43-eab2-4f9a-8466-976f9e1c73a1.png" alt="New call-to-action" width="800" height="200" /></a>

Coalfire determines Deep Instinct solution suitability for meeting the GDPR for full protection

By: Mark Arapovic, SE Manager

Security 'guys' are an eclectic mix of personalities. The people working in this industry of ours are as varied as th

football_cyber_2.jpg

By: Mark Arapovic, SE Manager
Security 'guys' are an eclectic mix of personalities. The people working in this industry of ours are as varied as they come, but I have to say, one topic which continues to dominate a lot of pre and post meeting small talk over the past few weeks has been the FIFA World cup. Surprisingly, for a group of people that are stereotypically supposed to be 'nerds', there are more of you in vendor/channel/customer land I know that have been waking up at 4am, or pulling allnighters to watch the matches than I expected.
I for one, am one of them. (though the Australian time zone can put a football fan's dedication to test)
Another hot topic over the past few months/years (within meetings this time) is the discussion around Detection vs Prevention in terms of a security strategy. It's never been a tougher time being a customer wading through all of the security solutions currently on the market. It’s safe to say that the explosion of Malware since 2008 has been matched by the explosion of startups and cybersecurity vendors claiming to have a silver bullet for the troubling times we find ourselves in.
<h4>Why 2008? </h4>
Well, Bitcoin of course. It has given the 'bad guys' a way to monetize their handywork and has been a quite lucrative way for them to get away with a clean pair of heels. Combine this anonymous monetization of threats with the treasure trove of tools leaked from the NSA (which have given us such hits as WannaCry) and you have an environment of fear and uncertainty ripe for the picking from a vendor perspective. This 'feeding frenzy' of opportunity for security vendors has really thrown a lot of traditional assumptions and foundational principles of Cybersecurity out the window, and as the months roll on, and another breach is disclosed, another attack discussed, the water is becoming muddier and muddier as vendors reach beyond their core discipline to get a larger chunk of the pie.
<img class="aligncenter" src="https://media.licdn.com/dms/image/C5612AQGP2QnmZRJKvg/article-inline_image-shrink_1000_1488/0?e=2131315200&amp;v=beta&amp;t=KdcTzECWdw7YN1ds-6TkQauAivowXROQ5yCErQIMiUE" />
I don't want to use the word 'cowboys' but some of the conversations I have had with customers relaying the claims of some vendor solutions is just down right iresponsible. Come to think of it, some of the most entertaining exchanges I have read online recently have been grandiose vendor postings on LinkedIn that quickly get shot down by independant researchers or security professionals.  Maybe its desperation, maybe those of us in vendor land are just not as knowledgable as we used to be, or maybe it's just hard to find good security people that wont struggle to keep up with new concepts and new technologies. But whatever it is, I get the feeling that the channel, in particular a strong security focussed partner is more important than ever, especially when it comes to making big decisions in terms of security strategy.
<h4>So, Detection vs Prevention, why is this even a question? </h4>
The tidal wave of threats that have been unleashed in recent times really broke the banks for a lot of tradtional vendors. The philosophy (from a prevention perspective) of layering signature based engines with a multitude of other complimentary technologies has been barely viable whilst burdening our endpoints with so many running services and processes, our end users have been screaming for it to stop. This approach of adding another driver or agent to provide a small uplift in detection or to stop a specific type of threat is akin to buying as many lottery tickets as possible to get better chance of winning a clean environment. (and dont get me started on prevention capabilties that rely on a cloud connection) Sustainable? not at all. Effective? Not really. When I see videos posted online showing Malware running but then get caught after the fact, or rolled back, I feel like I am the only one in the room questioning how that is even acceptable, and why any vendor would advertise they missed in the first place. Not impressed.
Maybe I am from the old school where prevention was what we were measured on, where incident response implied that something got through, there has been a failure, an error, an apology letter and explination needed after we hopefuly cleanup the mess the miss has caused. But not these days. A piece of Malware that runs past the pre-execution layer of any product doesnt raise any eyebrows, and seems to be almost acceptable because we have apparantly hit the ceiling of pre-execution and prevention capability. For a few years now its almost as if the industry has thrown its hands in the air and said, we cant do much better than what we are doing with prevention, so lets just let it run and figure out what it is doing after the fact...
<h4>Enter the wonderful world of EDR. </h4>
At the point when everyone realised the shortcomings of available prevention technologies, and this imaginary ceiling was hit, EDR solutions all of a sudden were not just tools designed to pick up a live attacker moving throughout the environment (or should I say, that theoretical 1% that AV products missed), but had now crossed over into the world of making up for the shortcomings of traditional prevention based solutions. Endpoint Security vendors all of a sudden expanded their forensic and detection/response capability and traditional EDR vendors started building in preventative layers and marketed themselves as an AV replacement technology. This is essentially where we are today and why there is so much uncertainty.
Speaking with customers, I have heard many times the desicion boiling down to if they wanted an EDR solution with some Threat Prevention, or a Threat Prevention solution with a sprinkle of EDR. Too many vendors trying to be too many things? Or is having a single budget for securing your Endpoints and being forced to pick the problem?
I can imagine how difficult it must be for a CIO forumlating a security strategy, when the 'experts' can barely decide where all of these varying solutions sit in a report or quadrant. This is why it is in this day and age customers should really go back to basics, and why I love the analogy of picking your all star Football team.
<h4>If you guys out there could only be a fly on the wall..</h4>
Having worked in the industry for over a decade, its natural that some very close friends of mine work for a whole range of vendors, including competitors. So besides the FIFA World Cup discussions recently, we have had just as equally heated debates about Security and the current landscape. It is natural if you work for a vendor that has a particular philosophy or approach, that you too evangelize this approach, which is why it is so important to keep vendors honest by building a relationship with a security focused solutions provider or MSP (who is hopefully one or two steps removed from all of the vendors out there), or go and do the hard hards yourself with putting vendor claims the test.
During one of my recent 'catch ups' with some former collelagues we had some interesting discussions around EDR and Next-Gen AV. After the chest thumping had died down, and when using the analogy of approaching your Security strategy the same way you would a Fantasy Football team, there were some really interesting admissions.
<h4>If only they had agreed to be quoted here</h4>
A peer working for an 'EDR' vendor said:
"Using your analogy, I would say that expecting an EDR solution to be highly effective at actual threat prevention, is like putting Lionel Messi as Goalkeeper in the fantasy World Cup team. The EDR premise after all is that the prevention layer will let through more than it will stop, which makes the EDR solution more relevant. "
Another, who is a self described EDR-phobe said:
"Of course EDR should be part of your security philosophy, but before heading down that path you have to understand its not exactly a 'set and forget' type of solution. You need to dedicate multiple head count to the management of the solution, wether that be internal or outsourced to a partner, I would imagine the more you invest, the more useful the solution becomes'
The assumption that a prevention layer will miss, in my humble opinion, is overstated somewhat depending who you talk to. Not only are we now at a stage where innovation on the prevention side of the fence has exploded once again, but those of us that were starting to lean toward the Detection and Response approach are now having second thoughts with these new developments, specifically around Deep Learning.
Yes, yes, I know, the first rule in security is that nothing is 100%, but having an overly pessimistic view on prevention tech and dismissing the advances made on this side of the fence in recent years is bordering on ignorance. At the same time, no prevention based solution is bullet proof, which is why you need to build on this the deeper you move toward your own security utopia.
So, who is on your team?
So, the question you should ask yourself is, who is in your Security Fantasy Team? Who provides the best prevention, the best visibility, the best control, the least performance hit, the most operational advantage, and should each of these things really be from a single vendor? I think the Football analogy is very relevant in this regard, because in the past we have seen certain Footbal philosophies come, dominate, then fade away.. much like in our Cybersecurity world. So my view is that a mix and the best of each philosophy is probably the safest way to go.
<h4>The Cyber Security Experts Guide to Football (Soccer) Tactics and Philosophy:</h4>
Catenaccio = Application Whitelisting
Emphasis on Defense, made famous by the Italian teams of the 70's ad 80's that was super-effective but counter productive to the spirit of the beautiful game, angered a lot of fans but appreciated much more when scaled back.
Gegen-Press/Rock'n'Roll Football = Next-Gen AV / AI based prevention
Defending from the front, having your strikers act as your first line of defense, new, fresh, exciting and in the modern generation pioneered by Jurgen Klopp with his Boroussia Dortmund and Liverpool teams. Pretenders are easily caught out if you do not have the correct framework or approach to this, a lot of teams claim to use this philosophy but on game day its evident a lot cannot pull it off.
Total Football = Security as a System (i.e. Endpoints talking to Firewalls either directly or via SIEM/Orchestration utilities)
The famous dutch team of the 70s, one of the greatest teams never to win a world cup spear headed by the late, great Johan Cruyff, this system is still the foundation of the Ajax (Amsterdam) youth academy today where every player at some stage, plays in every position in order to get an understanding of every position.
Tiki-Taka - Endpoint Detection and Response
Made famous by Barcelona and the Spanish team in recent history, typically no striker, but relying on short, sharp passes, complex triangles and posession of the ball. Exploded onto the scene, won Spain a world cup, but as you may have seen, the Spanish were just knocked out of the recent tournament in Russia... how times change.
The Long Ball game = Old School AV and/or Firewall
Typically a Sunday League tactic, still employed by a lot of English and Scottish teams, where you simply launch the ball up front and hope one of your players gets on the end of it. Not really effective when up against high quality opposition, but some times the best you can do with budget restricitons limiting the recruitment of good players.
So, if I were to build my Fantasy Football team, I would use a mixture of all the above systems and tactics depending on my opponent... each has their strong point, but each has weaknesses too.
&nbsp;
* Disclaimer * 
I work for Deep Instinct here in Australia. The first company to apply Deep Learning to Cyber Security. I have my biases, yes, but after working in Cyber Security for 12 years for multiple vendors, my personal belief is that prevention is better than finding a cure.
I joined Deep Instinct because I was blown away by what a custom Deep Learning framework can do to revolutionize and reinvent the way we look at prevention and our <a href="https://www.deepinstinct.com/2018/06/20/meet-mylobot-a-new-highly-sophisticated-never-seen-before-botnet-thats-out-in-the-wild/">recent discovery of MyloBot</a> validates what our approach is capable of. - Mark Arapovic, Sales Engineer Manager
Meantime, to learn more about how deep learning works and why it’s revolutionizing how cybersecurity is done, we invite you to download the Deep Learning for Dummies book  &gt;&gt;
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4" target="_blank" rel="noopener"><img id="hs-cta-img-39c4111b-3a7a-4680-a472-137ad9c7b4c4" class="hs-cta-img" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4.png" alt="New call-to-action" width="800" height="200" /></a>

The World Cup of Cybersecurity - who is in your fantasy team?

INFOGRAPHIC: Deep Instinct Unraveled in 8 Steps: How Deep Learning Works



Interested learning more about Deep Learning and how its applied to cy

deepinstinct_infographicrgb.jpg

INFOGRAPHIC: Deep Instinct Unraveled in 8 Steps: How Deep Learning Works
<img class="alignnone wp-image-3141 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcf22e3a9de01bfef/611a8191e38a40163ef5db66/deepinstinct_infographicrgb.jpg" alt="" width="994" height="1387" />
Interested learning more about Deep Learning and how its applied to cybersecurity? Read the Deep Learning book for Dummies
<a href="https://info.deepinstinct.com/deep-learning-for-dummies"><img class="alignnone wp-image-3003" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta02f8d011e98cb4a/611a81b3ed05ed1671c9f1a1/dummies-blog-banner.png" alt="" width="648" height="162" /></a>

Deep Instinct unraveled in 8 steps [INFOGRAPHIC]

From ransomware, to spyware and banking trojans, the types of malware threats are many. Yet the one threat that seems to be posing the greatest challe

Why-Deep-Learning-Is-the-Only-Option-for-Stopping-Unknown-Malware_2.jpg

From ransomware, to spyware and banking trojans, the types of malware threats are many. Yet the one threat that seems to be posing the greatest challenge to organizations and their cybersecurity solutions is <a href="/glossary/unknown-malware" target="_self">unknown malware</a>.This is because the means that have most typically been used to counter cyber threats to date remain insufficient when it comes to unknowns:Signature-based: traditional antivirus solutions usually lean on such technique. With this technique, key data from given files is signed, and so for next times files are matched with the same signature, those will be classified as malicious. The key data is usually strings, or other byte sequences of code piece. This approach is not adequate since it can only be used for known attacks, based on known pieces from current existing malicious files. With unknown attacks, the signature won’t match anything.Heuristic-based: this is an advanced technique for signatures. Instead of using a fixed signature, some parts of the signature can be random, and so it doesn’t necessarily have to be an exact signature match. The downside is that it is time consuming and works better with known than unknown files.Sandboxing: involves running suspicious files within an isolated environment for a few minutes, while dynamically testing what the file is doing while it is running, in order to understand whether it is malicious or not without impacting the production environment. In most cases, such implementations would be in detection mode, as it is time consuming to analyze and get a verdict, and so it delays on-going organizational work (e.g. receiving emails with attachments). In addition, many malware campaigns are well familiar with such platforms, and have many anti-VM capabilities to bypass detection by such solutions. For example, in a case where there is a match with the drivers, hostname or username used by sandboxing platforms, the malware won’t execute its malicious activities.Machine learning: a branch of artificial intelligence (AI). It allows computers to learn, by feeding large amounts of feature-based data to the ‘machine’ to teach it how to identify malicious files, based on certain file features. While more advanced and coming ahead of signature, heuristic, and sandboxing, one of its main downsides is that it relies on such feature engineering – meaning, it only uses a small part of the file structure, and is based on known attack vectors that are represented by those features. As a result, most of the data goes unprocessed, unanalyzed, and the correlations between the data points do not undergo analysis either. This means that machine learning is partial by its very nature and can never properly or fully pick up on, nor prevent unknow files. In addition, classical machine learning algorithms tend to not be very much accurate, mostly in domains that are not easy to solve, such as cybersecurity. That leads to moderate recall (detection rate) and false positive rate on unseen samples that were not involved in the training phase of the algorithm.Accordingly, none of these approaches fare well in today’s world that is primarily battling new and unseen malware variants.<h4>The Ever-Growing Threat of Unknowns</h4>Yet, the demand for beating the threat of unknowns is only getting bigger as the threat continues to grow at a dizzying pace. Consider these staggering stats, for example:<ul><li>There are over 100 unknown malware attacks hitting an organization every hour; and</li><li>Over 360,000 new malicious files appearing daily.</li></ul>It’s no surprise, then, that in a recent <a href="https://securitybrief.com.au/story/study-says-unknown-malware-biggest-threat-security-professionals/" target="_self">report</a>, it was found that of the 300 global IT and InfoSec professionals surveyed, 49% believe that unknown malware is the greatest risk to their organization.<h4>The Unique Abilities of Deep Learning Cybersecurity</h4>There is one approach, though, that overcomes the pitfalls of other means, as it is inherently designed to handle unknown malware. This approach is <a href="https://www.deepinstinct.com/deep-learning-cybersecurity/" target="_blank" rel="noopener noreferrer">deep learning cybersecurity</a>.For a quick recap – deep learning is the most advanced branch of artificial intelligence today. Its learning method is inspired by the way the human brain learns – taking in all the data and learning from it automatically and intuitively.Deep learning is the first — and currently the only — learning method that is capable of training directly on raw data. There is no need for feature engineering with deep learning, as is needed with machine learning. To the contrary, deep learning can dive into the raw data of the file, without explicitly being told to pay attention to certain features, which have been specified by human experts.Moreover, deep learning scales well to hundreds of millions of training samples. As the training dataset gets larger and larger, deep learning continuously improves. And the third aspect of deep learning that makes it unique is its ability to pick up on patterns and correlations in the raw data that are too complex for any human or AI to pick up on.Thus, its unique approach to training and learning endows it with both intuitive and predictive capabilities – which is probably one of the most critical capabilities for picking up on unknown threats. For, if you can’t ‘know’ in advance what it is, you must be able to predict what it is.Machine Learning vs. Deep Learning<img class="wp-image-2940 aligncenter" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6be9d875f565d277/611a81ca844c89162405ef18/table_2.jpg" width="626" height="618" style="width: 626px; height: 618px;"/>Thus, deep learning is unique among all other cybersecurity approaches and is best positioned for handling unknowns. In fact, deep learning has a specific expertise with unknown files, delivering the highest detection and prevention rates along with unmatched low rates of false positives.<h4>Deep Instinct Is Leading the Deep Learning&nbsp;Cyber Security&nbsp;Revolution&nbsp;</h4>Deep Instinct is proud to make available the first cybersecurity solution that harnesses the power of deep learning to prevent, detect, and respond to unknown threats (and known, of course), to protect any device type, running on any operating system, and against any file-based and even file-less attack. Deep Instinct not only provides autonomous cybersecurity in preventing cyber-attacks from executing on your devices, but also the <a href="https://www.deepinstinct.com/automatic-threat-analysis/" target="_blank" rel="noopener noreferrer">malware analytics</a> and threat classification you need to be well informed. Key features of our automatic threat analysis include an intuitive security management console, attack chain identification, advanced threat analytics, and in depth threat analysis reporting.&nbsp;<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4" target="_blank"><img id="hs-cta-img-39c4111b-3a7a-4680-a472-137ad9c7b4c4" class="hs-cta-img" style="width: 800px; height: 200px;" src="https://no-cache.hubspot.com/cta/default/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4.png" alt="New call-to-action" width="800" height="200"/></a>

Why Deep Learning Is the Only Option for Stopping Unknown Malware

By Ishai Rosenberg, Algo Team Leader

In our last post, “From Machine Learning to Deep Learning, And What It Means for Cybersecurity – Part 1,” we i

Deep_learning_for_dummies_part_2830x569.jpg

By Ishai Rosenberg, Algo Team Leader
In our last post, “<a href="https://www.deepinstinct.com/2018/06/24/from-machine-learning-to-deep-learning-and-what-it-means-for-cybersecurity-part-1/" target="_blank" rel="noopener">From Machine Learning to Deep Learning, And What It Means for Cybersecurity – Part 1</a>,” we introduced deep learning, how it evolved, and its real-world application.
In today’s second installment of our four-part series, we will cover the neural networks that power deep learning.
<h4>The Original Neural Network</h4>
Before diving into the neural networks of artificial intelligence, let’s first take a look at the original neural network that is the inspiration for all this deep learning – the human brain.
The human brain consists of different regions, each of which performs a specific task, and each consisting of dozens of billions of small processing units known as neurons, which are connected to each other via synapses.
The ‘deep learning’ of the human neural network happens when input arrives to the brain, neurons process it, and the more the input, the more and better it learns. For example, when the optic nerve transfers signals (the input) from our eyes to a certain region in the brain (the processing area), the neurons in that area learn to process these signals, enabling us with the ability to see.
Everything human beings learn, everything we remember, everything we do, is the result of this kind activity in the brain. Research suggests that the reason why human beings are considered more intelligent than other animals is the fact that we have many more neurons in the main processing area of our brains, i.e. the cerebral cortex.
The original neural network (the brain) and how it processes information, where the more the neurons, the better (smarter) – is the very inspiration for the artificial neural networks that are at the heart of deep learning.
<h4>Artificial Neural Networks</h4>
The concept of artificial neural networks is based on the idea that ‘signals’ can be received from other ‘neurons’ in the format of numerical values –e.g., the raw bytes of a memory file.
And, when attempting to bolster the capabilities of processing these input numbers by the neural networks, it was discovered that if more layers of neurons, known as ‘hidden layers’, were added between the input and output layers, then the network could achieve much greater data processing capabilities.
Then, taking things even further, in the 1980s when a sophisticated algorithm called ‘backpropagation’ was developed, state-of-the art <a href="https://www.deepinstinct.com/2019/04/16/applications-of-deep-learning/" target="_blank" rel="noopener">training of deep neural</a> networks was finally made possible.
<h4>Training Neural Networks</h4>
The complex principle of training neural networks with backpropagation can be explained with a relatively simple cat metaphor.
Let me explain.
Imagine that you’d like to train a “cat detector.” You would assemble a training dataset with 10,000 images containing cats, plus 10,000 images that do not contain cats.
All these images are of size 30 x 30 pixels, and they are in grayscale (that means a single value describes each pixel, rather than three values for red, green, and blue).
A neural network for this classification task would contain an input layer, a few hidden layers, and an output layer. In this example, the input layer could contain 900 neurons, which is 30 times 30, as is determined by the number of pixels. The output layer should contain two neurons (one neuron representing the “no cat” class, and the other neuron representing a “cat” class).
Here we would have the simplest type of network, which is a fully connected neural network, and which means that all the neurons in each layer are connected to all the neurons in the subsequent layer.
As the neural network is initialized, it doesn’t yet have any useful knowledge. Given an image, it won’t do any better than a coin toss when it comes to detecting whether the image contains a cat or not. It obtains the knowledge about how to recognize a cat through the training process. The training is done in two stages:
<ul>
<li>Feed-forward: where neurons in the input layer send their values to the neurons in the next layer, aggregating inputs to the next layer, and so on, until the output neurons deliver the results.</li>
<li>Backpropagation: where at first the resulting output vs. the expected output is measured to gauge the error rate. Then the backpropagation algorithm is used to backpropagate the error rate to the input neurons and teach them how to modify their answer the next time they receive such input: the bigger the error, the bigger the change in the answer would be.</li>
</ul>
When you’ve finished training a neural network, you must further test the accuracy using a set of samples that weren’t used during the training. This set is the test set, and its purpose is to make sure the network has not simply “memorized” the training set without learning the principles behind it.
Once the results are satisfactory, the neural network can be used for real-world predictions.
<h4>Taking Neural Networks One Step Forward</h4>
Deep learning is by far the hottest field within artificial intelligence today. That’s pretty remarkable when you consider that until a few years ago, just about everyone other than a few research groups had completely given up on neural nets.
However, during the past few years, several innovations have helped overcome the potential barriers to the effectiveness of deep learning, and which now allow researchers to train deeper neural networks.
important contributor to the greater proliferation of neural networks is the use of graphics processing units (GPUs) instead of central processing units (CPUs). This is because GPUs are designed as massive parallel processing units, which excel at performing the same instructions over many different data values in parallel. And, this is exactly what neural networks must do.
Accordingly, with the advancements in the algorithms used in deep learning along with the use of GPUs, deep learning on neural networks has become a new and formidable force to be reckoned with when it comes to the great promise of artificial intelligence.
Meantime, to learn more about how deep learning works and why it’s revolutionizing how cybersecurity is done, we invite you to download the Deep Learning for Dummies book  &gt;&gt;
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4" target="_blank" rel="noopener"><img id="hs-cta-img-39c4111b-3a7a-4680-a472-137ad9c7b4c4" class="hs-cta-img" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/39c4111b-3a7a-4680-a472-137ad9c7b4c4.png" alt="New call-to-action" width="800" height="200" /></a><script charset="utf-8" src="https://js.hscta.net/cta/current.js"></script><script type="text/javascript"> hbspt.cta.load(2183098, '39c4111b-3a7a-4680-a472-137ad9c7b4c4', {}); </script>

Announcing Deep Instinct Prevention for Storage for cloud storage and NAS environments

Blog

Recent Blog Posts

Deep Instinct’s 2018 Most Read Content Pieces

Season’s Greetings from Ursnif

Congratulations! Now Smarter Than Ever, We Got a New Brain!

Reinventing Prevention: Deep Learning in Cybersecurity

Emotet is back in full swing with massive, North-America focused E-Mail campaign

Coalfire determines Deep Instinct solution suitability for meeting the GDPR for full protection

The World Cup of Cybersecurity - who is in your fantasy team?

Deep Instinct unraveled in 8 steps [INFOGRAPHIC]

Why Deep Learning Is the Only Option for Stopping Unknown Malware

Understanding The Neural Networks That Underlie Deep Learning - Part 2

Products

Why Deep Instinct

Enhance Existing Cyber Tools

Company

Resources

Quick links