Groundbreaking Threat Intelligence Advancements From .

SOLUTION BRIEFGroundbreaking Threat IntelligenceAdvancements from McAfee LabsGain the advantage over adversariesEnterprise security professionals are well aware that attackers are rapidly gaining an advantage. Securityteams are constantly scrambling to stay ahead of the next complex, large-scale campaign often targeted atspecific organizations. Adversaries have fine-tuned their tools to such an extent that only 12 to 15 toolkitsare responsible for generating millions of unique malware samples. And 70% to 90% of malware samples areunique to a single organization.1 Sophisticated and continually evolving cyberattack techniques, like botnets,ransomware, and advanced persistent threats (APTs), evade security solutions and are increasingly difficultto detect, thwart, remediate, and prevent in the future. A sense of urgency dominates every decision andevery action.Organizations are coming to the realization that a collaborative, proactive threat defense is absolutelyessential for an effective defense. Security operations and threat/incident management start with a solidunderstanding of who the adversaries are, the tactics they use, indicators of compromise (IoCs), the surfacesat risk, and, potentially, the motivations behind the attack. And that’s where high-quality, actionable threatintelligence comes into play for protection, detection, analysis, and containment.1Groundbreaking Threat Intelligence Advancements from McAfee LabsThreat intelligence is gaining groundin today’s security organizations.A recent SANS Institute surveyreveals that 69% of respondents areusing threat intelligence to someextent, and 37.6% of those usingthreat intelligence are seeing a 50%improvement in their organization’sresponse to events in terms ofcontext, accuracy, and/or speed. 2

SOLUTION BRIEFThreat Intelligence ObstaclesBut getting visibility to today’s threat landscape can be acomplex proposition. It’s easy, for example, for securityteams to drown in the high volume of threat intelligencedata produced by sensors and other threat intelligencesources. The endless variety of threat intelligence dataand the relevance of this data require understandingand advanced analytics to extract value and high-qualityinsights to help solve cybersecurity problems.There’s also the issue of freshness. As attackers evolvetheir techniques and strategies, a certain amount of threatintelligence loses relevance quickly. By the same token,having a historical perspective can help researchersunderstand context and help them get a better handle ontrends. Data consumption and analysis need to occur atlight speed so that hackers lose their edge.Finally, turning threat intelligence into tacticaland operational wisdom requires more than justtransformation. It also calls for cross-correlation frommultiple sources. The bottom line is that not all threatintelligence is created equal, nor should it be used in thesame way.The question also arises as to whether organizationshave the wherewithal to have their own in-house threatintelligence teams. The main obstacles are the shortageof threat analysts and their high salaries, which arebeyond the budgetary reach of most enterprises.2Groundbreaking Threat Intelligence Advancements from McAfee LabsMcAfee Labs Today: Proactive, Predictive, andPrescriptive Threat IntelligenceA better approach is to engage with a leading-edgethreat intelligence provider. Based on solid threatvisibility, CISOs and security operations teams cannow make decisions with greater confidence—withoutthe expense of hiring an internal team. McAfee Labshas evolved into an innovative provider of proactive,predictive, and prescriptive global threat intelligencewith a proven reputation that spans more than twodecades. Combining in-depth threat knowledge with abroad set of advanced identification methodologies andautomation tools, McAfee Labs enriches products andenables them to protect, detect, and correct faster andmore accurately.McAfee Labs offers a unique approach to threatintelligence grounded in research, threat analytics, andknowledge. Its latest advancements include three keyfunctional components: A cloud infrastructure connected to millions of globalsensors.Automation and machine learning to collect andtransform data sourced from sensors, third-partysharing communities, historical repositories, andcustomers.A broad variety of analytics and human interpretationsfrom a variety of data sets. The analysis processencompasses both real-time interpretation andhistoric data mining based on two decades of researchand is facilitated by a large cloud compute surface.McAfee Labs 250 researchers across 13countriesPortfolio of approximately 300patents since 1990 and almost 100in the last six yearsA network of millions of sensorsspanning the Internet anddistributed globallyMore than 300 new threats talliedevery minute, or more than fiveevery secondsServices consumed by multipletypes of security tools: webprotection, firewall and intrusionprevention systems, endpointdefenses, sandbox technologies,and integrated third-partyproducts

SOLUTION BRIEFThe Cloud Infrastructure and Big DataAutomationWith threat coverage across historical and geographicalparameters and multiple threat vectors, the McAfeeLabs cloud infrastructure expands the size, dimension,and collection/ingestion speed of threat intelligence.Data is gathered from millions of endpoints, gateways,and mobile devices and a broad sweep of ITenvironments, geographies, and threat actors. McAfeeLabs is able to respond to millions of requests aroundthe world via nine data centers whose data is refreshedevery five minutes.Advanced McAfee Labs automation technologiesimprove the volume and speed of threat intelligencedelivery. These automated capabilities, enhancedby human assistance, collect and transform threatinsights, such as file types, indicators of compromise(IoCs), reputation lists, and exploits into knowledgewithin minutes, rather than hours. Suspicious filesare consumed and processed at a capacity of onemillion files per day. Innovations in automationhave resulted in a 20% improvement in URL cloudpublication intervals. The window of threat exposure isnarrowed, thanks to reputation refresh intervals everyfive minutes. Ultimately, automation helps transformproduct telemetry and threat intelligence data intocountermeasures and containment procedures acrossMcAfee and third-party solutions.This is further enhanced by 25 years’ worth ofaccumulated data to provide enterprises with knowledgefor deep analytics and trend mapping. This broad setof data types is stored in the McAfee Labs proprietaryclassification system and covers one petabyte ofdata—which is equivalent 13.3 years of HDTV content(approximately 58,292 movies).Shared third-party threat information via the CyberThreat Alliance further enriches this knowledge base.The Cyber Threat Alliance is a consortium of 174 differentthreat intelligence and threat feed providers thatcrowdsource and share threat intelligence. Cyber ThreatAlliance processes more than 500,000 file samplesand 350,000 URLs daily. The goal is to both strengthenvendors’ capabilities against adversaries and constantlyimprove their customers’ defenses across all sectors.Intelligence FlowProductTelemetryExternal TIResearchAutomation/MLMultipleData StoresResearcherFigure 1. The flow of threat intelligence across McAfee Labs.3Groundbreaking Threat Intelligence Advancements from McAfee Labs

SOLUTION BRIEFBased on telemetry from millions of endpoints plusexternal threat intelligence submissions, McAfeeLabs generates more than 10,000 new and updatedprotection drivers daily. Average processing time is12 minutes. Additionally, automated machine learningfeeds via data mining; proactive, in-depth threatsurface inspection; and expert analysis conducted byour researchers—all processed in a multisequenced,automated manner—provide users with swift protectionand detection and a 99.98% accuracy rating.As described in Figure 1 above, the combination ofcontinuous product telemetry, human analytics, machinelearning, and existing heuristics increases detectionaccuracy and containment quality. Our team of datascientists monitors data 24/7 for quality, with an internalbaseline standard of 0.01% false positives. For example,over the past several years, external tests placed McAfeeEndpoint Security among the top security solutionswith low false positive rates. In early 2016, Intel Security(now McAfee) received the AV TEST usability award forits McAfee Endpoint Security client solution. To test itsability to protect users, this client solution was requiredto visit websites, evaluate installations, and scan millionsof files without triggering any false positives.Analytics and Deep LearningTo get to results, threat insights are gleaned frommachine learning, as well as from automated, behavioralbased classification in the cloud to detect zero-day4Groundbreaking Threat Intelligence Advancements from McAfee Labsmalware on endpoints. Machine learning, which drivesthe proactive threat intelligence model, is derived fromthe combined capabilities of a number of key elements:applications, analytics and collaborative data science,data handling, and the cloud infrastructure.Applications:Specific solutions forvisualization and humaninterpretationAnalytics and collaborativedata science: Discovery andrefinementData: Big Data platform fordistributed and scalablestorage and processingMachinelearning andalgorithmsPerformance,management,and security toprotect enterpriseplatformsInfrastructure forautomation: Compute,virtualization, networking,and cloud presenceFigure 2. McAfee Labs cloud infrastructure.Human analysts work hand in hand in a closed loopwith machine learning tools to adjust the learning andanalytic models. For example, exclusive McAfee Labsautomation technology gathers intelligence from livemalware samples though its extensive network ofmillions of global sensors. The automation technologyexecutes multiple analytics against these samples todetermine whether the files are malicious or not. Theoutput is often a file hash ( id) with a classification thatcan be used by human investigators.