Page 1 of 2
Executives at security startup TaaSERA, Inc. believe their new malware detection technology can identify attacks before information is sent back to a remote server, enabling incident response teams to remove malware before it results in a data breach.
The Cupertino, Calif.-based company's technology sheds malware signatures for deeper behavioral analysis for malware detection. Using static and dynamic analysis and whitelisting, the agents can check to determine if files are acting suspiciously. The detection technology's attack warning and response engine collects data, combining it with threat intelligence feeds, and uses behavior modeling to score potential actions that need to be addressed, said Srinivas Kumar, TaaSERA's chief technical officer who previously served as a security architect at VMware.
"Our approach of analysis is radically different," Kumar said. "We look at detection as the trigger for analysis rather than taking everything on the wire and analyzing it."
[Related: Google Aurora Attackers Behind Internet Explorer Zero-Day Attacks]
The TaaSERA (Trust-as-a-Service) technology is based on research conducted at SRI International, formerly the Stanford Research Institute. The technology analyzes the data it collects to identify the early stages of malware activity. Over days and weeks it can identify patterns, looking for actions, such as a piece of malware reaching out to a command-and-control server to communicate that it has infected a system. It builds an evidence chain, which eventually builds up, triggering an alert that the system is potentially infected.
The company is still testing its technology, but it plans to use it in the release of its NetAnalyzer, PC Analyzer and AWARE Mobile app for Android within the next several months. A threat intelligence service is also being developed.
NetAnalyzer inspects the same traffic that a network intrusion detection or intrusion prevention system (IDS/IPS) appliance would examine. Instead of looking for malicious traffic, the technology looks for bad behavior by correlating activity and communications that happen between internal systems and external systems, Kumar said.
"We're looking at an internal system that has been communicating with other internal systems or with external systems, building into a lifecycle a model of potential threats," Kumar said. "The detection is based on traversing the early malware lifecycle rather than signatures."
NetAnalyzer comes with a console to view the network at a glance, generates reports and configures the threshold used to generate alerts from the modeling scores.
NEXT: Other Security Firms Use Behavioral Analysis
1
|
2
|
Next >>
