The Cloud-y Future of Security Technologies Adam J. ODonnell, Ph.D. - - PowerPoint PPT Presentation

▶
the cloud y future of security technologies
SMART_READER_LITE
LIVE PREVIEW

The Cloud-y Future of Security Technologies Adam J. ODonnell, Ph.D. - - PowerPoint PPT Presentation

Jun 03, 2023 155 likes •852 views

The Cloud-y Future of Security Technologies Adam J. ODonnell, Ph.D. Director, Cloud Engineering Immunet, Inc. Monday, August 22, 2011 The Cloud-y Future of Security Technologies Adam J. ODonnell, Ph.D. Chief Architect, Cloud

slide-1
SLIDE 1

The Cloud-y Future of Security Technologies

Adam J. O’Donnell, Ph.D. Director, Cloud Engineering Immunet, Inc.

Monday, August 22, 2011

slide-2
SLIDE 2

The Cloud-y Future of Security Technologies

Adam J. O’Donnell, Ph.D. Chief Architect, Cloud Technology Group Sourcefire, Inc.

Monday, August 22, 2011

slide-3
SLIDE 3

About Immunet

  • Founded in mid-2008 to build next-gen AV
  • Funding through Altos

Ventures, TechOperators in Nov 2009

  • Acquired by SourceFire Dec 2010,

announced Jan 2011

Monday, August 22, 2011

slide-4
SLIDE 4

About me

  • Founded in late-1978 to build next-gen of

the family line

  • Funding through Guardent, consulting, and

NSF GRFP @ Drexel University

  • Acquired by Cloudmark in 2005, started

Immunet full-time when funded in 2009.

Monday, August 22, 2011

slide-5
SLIDE 5

Monday, August 22, 2011

slide-6
SLIDE 6

Monday, August 22, 2011

slide-7
SLIDE 7

Virus vs. Anti-Virus, 1980s Style

  • Viruses:
  • Count: 102
  • Mutation rate: What

mutations?

  • Propagation:

sneakernet

Monday, August 22, 2011

slide-8
SLIDE 8

Virus vs. Anti-Virus, 1980s Style

  • Anti-Virus:
  • Low definition

count, updated monthly

  • Mutation rate: What

mutations?

  • Propagation: USPS

Monday, August 22, 2011

slide-9
SLIDE 9

Virus vs. Anti-Virus, 1990s Style

  • Viruses:
  • Count: 103-4
  • Mutation rate: Fairly

low

  • Propagation:

Sneakernet, BBS, Internet

Monday, August 22, 2011

slide-10
SLIDE 10

Virus vs. Anti-Virus, 1990s Style

  • Anti-Virus:
  • Definitions updated

daily to weekly

  • Mutation rate:

Busines hours response teams

  • Propagation:

Sneakernet, BBS, Internet

Monday, August 22, 2011

slide-11
SLIDE 11

Virus vs. Anti-Virus, Today

  • Viruses:
  • 2000: 5*104

2003: 105 2008: 106 Today: 107

  • Average in field

lifetime: 2 to 3 days.

Monday, August 22, 2011

slide-12
SLIDE 12

Virus vs. Anti-Virus, Today

  • Anti-Virus:
  • Definitions updated

every 5 minutes

  • Mutation rate:

Follow the sun response teams

  • Propagation:

Internet-only

Monday, August 22, 2011

slide-13
SLIDE 13

How do AV firms know what viruses exist?

Monday, August 22, 2011

slide-14
SLIDE 14

Monday, August 22, 2011

slide-15
SLIDE 15

Sample Sharing Alliances

  • Informal groups of AV researchers at firms

that agree to share, on a hourly or daily basis, drops of new malware

  • Based upon who you know and what

samples you regularly have

Monday, August 22, 2011

slide-16
SLIDE 16

Monday, August 22, 2011

slide-17
SLIDE 17
  • 1980’s: Informal sample sharing alliances.

Monday, August 22, 2011

slide-18
SLIDE 18
  • 1980’s: Informal sample sharing alliances.
  • 1990’s: Informal sample sharing alliances.

Monday, August 22, 2011

slide-19
SLIDE 19
  • 1980’s: Informal sample sharing alliances.
  • 1990’s: Informal sample sharing alliances.
  • 2000’s: Informal sample sharing alliances.

Monday, August 22, 2011

slide-20
SLIDE 20
  • 1980’s: Informal sample sharing alliances.
  • 1990’s: Informal sample sharing alliances.
  • 2000’s: Informal sample sharing alliances.
  • 2010’s: Informal sample sharing alliances,

some centrally collected logs from the big boys.

Monday, August 22, 2011

slide-21
SLIDE 21

Virus Count

Monday, August 22, 2011

slide-22
SLIDE 22

100 1000 10000 100000 1000000 10000000 1985 1992 1998 2005 2011

Virus Count

Monday, August 22, 2011

slide-23
SLIDE 23

100 1000 10000 100000 1000000 10000000 1985 1992 1998 2005 2011

Intel

Virus Count

Monday, August 22, 2011

slide-24
SLIDE 24

End result?

  • Analyst teams are overwhelmed with

stopping threats days after they disappeared from circulation.

  • Current, real world, in field efficacy of AV

products is approximately 43% for new malware for generic detections

Monday, August 22, 2011

slide-25
SLIDE 25

What can Cloud do for you?

(If you are building a security technology)

Monday, August 22, 2011

slide-26
SLIDE 26

?

Monday, August 22, 2011

slide-27
SLIDE 27

Source: Amazon’s Cloud Player FAQ

Monday, August 22, 2011

slide-28
SLIDE 28

The Cloud is...

  • Services where data is held and

computation is done server-side and presentation is done client-side

  • Business models built around pricing as a

function of service usage

Monday, August 22, 2011

slide-29
SLIDE 29

What does Cloud AV Look like?

Monday, August 22, 2011

slide-30
SLIDE 30

Conventional v. Cloud

Monday, August 22, 2011

slide-31
SLIDE 31

Conventional v. Cloud

Monday, August 22, 2011

slide-32
SLIDE 32

Conventional v. Cloud

Monday, August 22, 2011

slide-33
SLIDE 33

Conventional v. Cloud

Monday, August 22, 2011

slide-34
SLIDE 34
  • From a high level it is

similar to what lives on the desktop

  • Accepts crypto hashes,

fuzzy hashes, machine learning feature vectors and spits out “good/bad”

Monday, August 22, 2011

slide-35
SLIDE 35
  • Multi-tier data storage

(cache, database, flat files)

  • Allows for analysis of

events on a global scale, rather than system local

Monday, August 22, 2011

slide-36
SLIDE 36

So why is this even possible?

Monday, August 22, 2011

slide-37
SLIDE 37

Virus Count Local Application Count

Monday, August 22, 2011

slide-38
SLIDE 38

100 1000 10000 100000 1000000 10000000 1985 1992 1998 2005 2011

Virus Count Local Application Count

Monday, August 22, 2011

slide-39
SLIDE 39

100 1000 10000 100000 1000000 10000000 1985 1992 1998 2005 2011

Virus Count Local Application Count

  • System cache may be blown out, but

globally there is a high level of cache locality

  • Bandwidth of round-trip lookups is

dramatically lower than that of shipping virus updates

  • Low-latency bandwidth is practically

ubiquitous

Monday, August 22, 2011

slide-40
SLIDE 40
  • Intelligence
  • Accuracy
  • Data for and ability to apply novel

techniques

What does this give you?

Monday, August 22, 2011

slide-41
SLIDE 41

Intelligence

  • Continuous collection of who saw what,

when, and in what context

  • Can request additional data on any file that

is suspicious or requires further analysis

  • Extracted from your community, not what is

passed around by sample vendors

Monday, August 22, 2011

slide-42
SLIDE 42

Accuracy

  • Closes the gap between when a signature is

first published and when it is available to the client

  • Optimize around real metrics (not guesses)

about in-field efficacy based upon lookups from end users

  • Crowdsourced whitelisting and blacklisting

(more on that in a bit)

Monday, August 22, 2011

slide-43
SLIDE 43

Novel Techniques

  • Global prevalence tracking
  • Real data for machine learning
  • Retrospective conviction
  • APT hunting

Monday, August 22, 2011

slide-44
SLIDE 44

Monday, August 22, 2011

slide-45
SLIDE 45

Monday, August 22, 2011

slide-46
SLIDE 46

Monday, August 22, 2011

slide-47
SLIDE 47

Monday, August 22, 2011

slide-48
SLIDE 48

Monday, August 22, 2011

slide-49
SLIDE 49

Monday, August 22, 2011

slide-50
SLIDE 50

Algorithm Design

  • r, just because it isn’t O(nx), doesn’t mean it’s fast.

Monday, August 22, 2011

slide-51
SLIDE 51

Bad Algorithms

  • O(xn), where x, n are any of the following:
  • User count
  • Rule count
  • Anything that may grow as the system

gets older

Monday, August 22, 2011

slide-52
SLIDE 52

Monday, August 22, 2011

slide-53
SLIDE 53

Good Algorithms

  • Anything O(1)
  • Use hash tables extensively
  • If O(xn)
  • x, n should be constants, such as the

number of features examined in an executable

  • Or, do it offline / out of band

Monday, August 22, 2011

slide-54
SLIDE 54

Everything is a queue

And there are bad queues, and good queues

Monday, August 22, 2011

slide-55
SLIDE 55

Monday, August 22, 2011

slide-56
SLIDE 56

Good Queues

  • Shoot for G/D/n, with service rates defined

by aforementioned O(1) algorithms

  • Thank you, Harish Sethu @ Drexel

University, for making me take Queueing Theory

Monday, August 22, 2011

slide-57
SLIDE 57

Take only what you need

You can’t store everything online

Monday, August 22, 2011

slide-58
SLIDE 58

Current, stable, SoTA

  • Multithreaded server
  • Memcached layer
  • MySQL/MSSQL/Oracle below
  • Log files

Monday, August 22, 2011

slide-59
SLIDE 59

Current, non-stable, SoTA

  • Asynchronous server
  • Memcached layer
  • NoSQL: Redis / MongoDB / Riak /

Membase / Cassandra, pick your poison

  • Log files

Monday, August 22, 2011

slide-60
SLIDE 60

Monday, August 22, 2011

slide-61
SLIDE 61

CPU Analogy

  • Be

VERY choosy about what data sits in L1, L2, L3, and disk, otherwise see Chernobyl slide

Monday, August 22, 2011

slide-62
SLIDE 62

In Conclusion...

Monday, August 22, 2011

slide-63
SLIDE 63

Stop griping, start building.

Monday, August 22, 2011

slide-64
SLIDE 64

Cloud AV isn’t just AV

It’s a combination of...

Monday, August 22, 2011

slide-65
SLIDE 65
  • Traditional catch-and-block
  • Real-time analytics
  • Retrospective repair
  • Deep forensics

Monday, August 22, 2011

slide-66
SLIDE 66
  • HIDS/HIPS
  • DLP
  • 2FA (Duo Security)

But why just reinvent

  • ne acronym?

Monday, August 22, 2011

slide-67
SLIDE 67

Questions?

Monday, August 22, 2011

slide-68
SLIDE 68

Contact Info

Adam J. O’Donnell, Ph.D. Chief Architect, Cloud Technology Group Sourcefire, Inc. aodonnell@sourcefire.com

Monday, August 22, 2011