Malware reversing is a conventional threat intelligence strategy that is being challenged to keep up with the fast-paced evolution of threats. To stay ahead of bad actors, the next generation security intelligence engine is big data, not malware reversing. An advanced generation of security intelligence teams has risen with mathematicians, algorithmic geniuses and big data researchers. The buzz words sound impressive but what does this actually mean in practice? On Jan 22nd, OpenDNS Security Researcher, Dhia Mahjoub, and Senior Product Manager, Dima Kumets, went under the hood of OpenDNS Security Research Labs. Their discussion included such topics as: -What the OpenDNS Researchers actually do and why it's so different from traditional sample analysis -The process of developing and improving learning machines as developed by Dhia and the Labs Team -Insights gained from looking at Internet traffic as a whole -The difference in Big Data insight vs Malware Reversing -The latest threats OpenDNS Security Labs is mitigating

1. 1_Title (1)
Under the Hood:
OpenDNS Security Labs
with Dhia and Dima

2. COMPANY BACKGROUND
1_Light Title
Only



3. UMBRELLA BY OPENDNS
1_Light Title
Only



4. 1_Title (1)

5. ANALYZING DATA TO EXTRACT ACTIONABLE SECURITY INFORMATION



6. Changing Threat Landscape
A crime economic model
• Distributed specialists
• Scalable
• Profitable
Examples of players
• Vulnerability specialists
• Distributors
• Malware Writers

7. PREDICTIVE
THREAT
NTELLIGENCE
Internet-wide pattern analysis
Predictive in nature
OpenDNS Approach
MALWARE
ANALYSIS
Sample analysis
Reactive in nature
Most common approach

8. Who is OpenDNS Labs?
Graph Theory Scientists
Visualization Experts
Predictive
Threat Labs
Algorithmists/Programmers
Machine Learning
Developers

9. Process
Goal: Automated, Real-time threat intelligence fo
prevention and containment
•
•
•
•
•
Analyze huge data sets
Develop model for bad actor behavior
Create classifiers
Validate and test
Combine to detect new threats

10. The Big Data
Traffic patterns
• Source
• Destination
• Volume
• Time
50B Queries/Day
Example: Cryptolocker
Co-Occurrence + DGA

11. DGA: Domain Generation Algorithm

12. DGA: Domain Generation Algorithm

13. The Big Data
Passive/Infrastructure
• Domain
• IP
• Prefix+ ASN
• Changes
Example: Fast Flux

14. Fast Flux

15. Fast Flux

16. Fast Flux

17. Build Classifiers
• What’s a classifier
• How does it work
• How to test for false positives
• Combining classifiers to productionalize

18. THANK YOU! ANY QUESTIONS?...

